Red Hat has announced the results of a study that analyzes the adoption of enterprise artificial intelligence and risk management among 1,400 information technology directors (CIO) from 14 countries, including Spain. The research indicates that, although autonomous AI agents are already present in 100% of the Spanish organizations included in the study sample, a critical gap persists between perceived governance and actual operational visibility.
The majority of Spanish CIOs surveyed (85%¹) express great confidence that their AI agents operate securely and compliantly, supported by control and oversight mechanisms. However, the data shows that this optimism can mask a lack of visibility:
- 30% of respondents say they have a clear understanding of data flows within their organization, as well as where data is stored and processed.
- Only just over two in ten (22%) have a comprehensive view of their software supply chain and its direct and indirect dependencies.
- Only a third (28%) continually assess risks from AI vendors beyond the initial adoption phase.
These results indicate that, although participants consider that their AI environments and agents have adequate security and sovereignty controls, reality shows a lack of auditable evidence in these operations. The dynamic nature of AI innovation and market forces make it possible for a system to have high levels of security and compliance at the time of deployment, but to be fully exposed shortly thereafter.
In the words of Julia Bernal, Mediterranean region leader and country manager for Spain and Portugal at Red Hat, “to govern AI effectively, the first thing is to have total visibility. Organizations should track data flows, software components, and agent lifecycles before scaling. While accelerating productivity, AI multiplies vulnerability risks. To mitigate them, a secure software supply chain and open patch management supported by the open community are essential.”
Small visibility gaps, big data risks
Spanish companies are accelerating their AI adoption curve: 37% of respondents say they fully trust proven security barriers, continuous monitoring and automated intervention systems. Another 48% express “reasonable confidence” in having security and compliance under control, although they recognize small gaps in their control and oversight measures.
However, in production environments, unattended data sharing between enterprise platforms, cloud services, and external AI models can pose risks. 47% of Spanish organizations report small deficiencies in the visibility of data flows; 22% have already implemented AI functions without fully understanding these flows; and 1% have a very limited view of where data is stored.
In comparison, visibility varies markedly between the different countries surveyed: while 61% of respondents in South Africa claim to have end-to-end visibility of data flows, French organizations remain at 31%. For Spanish companies, which must operate within strict regulatory frameworks such as the General Data Protection Regulation (GDPR) and the European Union AI Law, ensuring verifiable data traceability throughout its life cycle remains essential to avoid legal breaches and information leaks.
The great risk of indirect software dependencies
Up to 79% of the Spanish companies consulted say they are able to patch critical software vulnerabilities within 24 hours after publishing the corrective patch. The rest take a few days, and none indicate taking more than a week.
However, most companies do not know exactly what software components are in use. Only 22% have a complete and constantly updated view of all the open source components they use, including their origin, version numbers, and direct and indirect dependencies. The average among all countries is just below 33%.
While 36% of companies have a good understanding of components and versions, they admit limitations in identifying sources and indirect dependencies. 35% know the main open source components they use, but do not have a complete view of the broader software supply chain. None of the companies surveyed fail to systematically monitor their open source software supply chain.
Indirect dependencies are common in many open source software projects, which means that they integrate libraries, frameworks and other elements from third-party projects. These dependencies can pose significant risks to an organization’s technology ecosystem, especially if they are not effectively assessed (78%²).
Risk assessments as a continuous and non-punctual task
Regarding the evaluation of the risks associated with AI providers, only 28% of Spanish companies declare that they are well prepared and have quantifiable and continuously monitored criteria in their daily operations with AI. This figure far exceeds that of the Netherlands, for example (just under 22%), but falls significantly behind that of Italy (51%).
Only 4% of Spanish organizations depend exclusively on external audits, certifications and contractual guarantees for their risk analysis
Although 34% of the companies surveyed in Spain carry out a risk assessment prior to the implementation of new AI technologies, they have difficulties in monitoring and assessing these risks afterwards. 32% rely solely on an initial assessment, which may be insufficient in a rapidly evolving AI environment where models, data, regulatory requirements, and threats vary almost daily.
Respondents are fully aware of this challenge and the need to address it through measurable and internally managed methodologies. Only 4% of Spanish organizations depend exclusively on external audits, certifications and contractual guarantees for their risk analysis. And only 2% rely on supplier reputation and past experience, or lack a structured approach to assessing such risks.
