The Governance Gap

Three stories this week draw a direct line from platform controls to data blind spots to a courtroom in Manhattan — and the thread connecting them is the governance gap. Stories Covered: 1. Microsoft Copilot February 2026 Governance Update Project Manager Agent — public preview March, GA April. Not a copilot. An agent with a named role. Multi-agent workflows — agents calling other agents, with visible handoffs Risk-based AI agent inventory in Microsoft Defender — every agent in a single pane with posture assessments Third-party connectors in public preview — governed access to Canva, HubSpot, Notion, Linear License requests now require business justification New centralized readiness dashboard in the admin center 2. Thales / S&P Global 2026 Data Threat Report Only 34% of organizations know where all their data resides 47% of sensitive cloud data is unencrypted 61% cite AI as their top data security risk Nearly 60% have experienced deepfake-driven incidents Only 30% have a dedicated AI security budget Only 39% can fully classify their data 3. US v. Heppner — Claude Conversations Ruled Not Privileged (SDNY) Judge Jed Rakoff ruled that conversations with Anthropic's Claude are not protected by attorney-client privilege Consumer AI terms of service do not create confidentiality expectations Feeding attorney advice into consumer AI may waive privilege over the original legal advice Enterprise AI subscriptions with contractual confidentiality provisions are the minimum standard Litigators will now routinely request AI prompts and outputs in discovery Key Takeaway: AI governance is not a compliance checkbox — it's an operating discipline that touches procurement, security, legal, and data architecture simultaneously. Hosted by Stephen Forte