Securing the enterprise software supply chain in the AI era

Across Europe, the Middle East, and Africa (EMEA), enterprise IT is undergoing a fundamental shift. Artificial intelligence (AI) is no longer restricted to isolated sandboxes or pilot projects. Autonomous AI agents, embedded software-as-a-service (SaaS) features, and automated workflows are actively running in production across business-critical environments.

Yet, as AI accelerates the speed and complexity of the digital enterprise, a critical strategic tension is coming to light. To better understand how IT leaders are managing this transition, Red Hat surveyed 1,400 chief information officers (CIOs) across 14 EMEA countries¹. The findings reveal a sharp disconnect between high-level governance confidence and the underlying, day-to-day operational visibility required to manage risk effectively.

The governance paradox: High confidence, partial visibility

When asked about high-level governance, CIOs in EMEA express significant optimism. 86.7% of surveyed CIOs report feeling confident in their organization's ability to govern deployed AI agents securely, compliantly, and in line with corporate business rules.

However, when we look closer at the operational mechanisms that make governance possible, that confidence begins to show strain:

• Data traceability: While 84.8% believe they know where AI-related data is processed, stored, and shared, only 39.6% express complete confidence in their total data visibility.
• Regulatory risk: Nearly half (45.2%) acknowledge minor blind spots in tracking data flows as AI becomes quietly embedded into approved cloud platforms and enterprise software.

In an era of stringent compliance frameworks -such as General Data Protection Regulation (GDPR) and the EU AI Act - even minor visibility gaps in data lineage expose organizations to severe regulatory, financial, and reputational risks. High-level policies mean very little if IT teams cannot trace data movements in real time across hybrid cloud environments.

Software supply chains: The danger of patching in the dark

This control gap extends directly into cybersecurity and software infrastructure. The survey indicates that modern IT organizations have built impressively fast remediation processes: 76% of respondents report that they typically deploy critical security fixes within 24 hours of a vulnerability patch becoming available.

However, remediation speed is only half the battle. You cannot patch a vulnerability you do not know exists:

• Only 32.9% of EMEA CIOs maintain a complete, continuously updated view of their open source software supply chain, including direct and indirect (nested) dependencies.
• 43.0% have visibility into primary components, but lack clear insight into the underlying open source libraries buried inside third-party applications.

Rapid patching capabilities create a false sense of security if an enterprise lacks Software Bill of Materials (SBOM) visibility. When a zero-day vulnerability hits a deeply nested open source dependency, organizations with limited supply chain visibility remain exposed regardless of how fast their patching team operates.

Trust is not a one-time event

A similar pattern emerges in how enterprises evaluate third-party AI technology providers. While most organizations perform thorough risk assessments before onboarding an AI vendor, ongoing verification drops off sharply after deployment:

• Only 34.4% establish formal, measurable criteria to monitor AI provider risks on a continuous, live basis.
• Nearly 20% (19.7%) conduct no continuous risk monitoring at all once an AI provider is integrated into live operations.

Treating AI provider risk as a static, one-time procurement task is inherently dangerous. Models drift, data usage policies change, and software dependencies evolve daily; trust must be continuously audited and verified throughout the entire application lifecycle.

Bridging the control gap with open, verifiable foundations

The key insight from our 2026 EMEA research is clear: the challenge facing enterprise leaders is not a lack of governance ambition, but a lack of operational visibility.

To bridge this control gap, governance cannot remain a passive administrative policy. It must become an active, automated discipline built on four operational pillars:

1. Complete lifecycle visibility: Map data flows, classify sensitive assets, and maintain real-time observability across all public cloud, on-premises, and edge environments.
2. Software supply chain transparency: Standardize the use of automated dependency mapping and SBOMs to track both direct and nested open source components.
3. Continuous verification: Shift from static, one-off vendor onboarding reviews to real-time, continuous monitoring of AI provider risks and model behavior.
4. Open hybrid foundations: Adopt open source architectures that provide centralized management and consistent guardrails, giving organizations complete freedom of choice without sacrificing control.

As AI adoption scales across EMEA, true resilience will belong to the organizations that pair high-level ambition with deep, verifiable operational control.

¹Methodology: research was conducted by Censuswide among 1400 CIOs (25+) in the UK, France, Italy, Germany, Spain, UAE, Sweden, Turkey, Switzerland, Poland, South Africa, Netherlands, Belgium, Saudi Arabia between 24.08.2026-01.09.2026. Censuswide is a member of the Market Research Society and the British Polling Council, and a signatory of the Global Data Quality Pledge.