Responsible AI fails without a governed data layer

Forrester has named us a Notable Vendor in The Responsible AI Solutions Landscape, Q2 2026. The report is clear about what's breaking and where governance has to start.
Access the full report →

Table of contents

About the report
‍Key takeaways
‍Why now
‍The framework
‍How we cover Forrester's framework
‍What the market is saying
‍Access the report
‍

About the report

Forrester's Q2 2026 Landscape names 30 Notable Vendors in the responsible AI market and provides technology, risk, and compliance leaders with an independent overview of them. It defines responsible AI as "software ensuring that organizations' AI models and systems are explainable, accountable, and trustworthy" — and maps the capabilities buyers should look for across nine use cases and fifteen functionalities.

The report outlines what a responsible AI program must do and where, in practice, most programs still come up short.

‍

Key takeaways

Three findings from the report should change how leaders think about AI controls.

Point-in-time governance is broken. Forrester is blunt: most organizations still rely on "point-in-time, reactive, and narrowly data-focused" approaches that can't deliver the continuous oversight AI now demands. Quarterly risk assessments cannot govern systems that operate every second.
Agents have changed the surface area. Observing and remediating agent behavior across multisystem decision chains is the top disruptor reshaping the market. Agents read, write, trigger, and decide across systems — and most governance stacks were not built for that.
The market is conflating distinct problems. AI governance, compliance, risk management, and responsible AI are being treated as a single entity. They are not. They overlap, but they sit at different layers — and the data layer is the one that gets ignored.

‍

Why now

AI moved faster than the rules. Then it moved faster than the tools.

AI is reshaping how every organization uses data and makes decisions. As adoption accelerates, AI governance, security, privacy, and data governance can no longer operate in silos — oversight has to be continuous, automated, and built into everyday operations.

The organizations moving slowly on AI aren't short on ambition, they're short on proof. They cannot yet show what AI systems are doing or what data those systems can reach — and without that proof, AI is stuck in pilots.

Regulators, auditors, and boards are catching up faster than the controls are. AI failures are no longer hypothetical. They show up as exposed sensitive data, breached entitlements, hallucinated decisions, and audit findings that can't be answered. The cost of an AI program that cannot be defended is rising, and it is rising fastest in the industries that move first.

Agentic AI compresses the timeline again. When an agent can retrieve a record, write to a system, or shape a downstream decision, periodic review is a fiction. The work has to be continuous, operational, and provable. That work starts at the data layer because everything an AI system does, it does to data.

We believe Forrester's overview reflects that shift, naming the vendors helping regulated organizations modernize governance, scale AI responsibly, and meet rising regulatory expectations. Being included reinforces our commitment to helping customers move fast without losing visibility, accountability, or control.

‍

The framework

The two layers — and what sits between them.

Forrester's framework rests on three outcomes: explainability, accountability, and trustworthiness. In production, all three require coordinated control across two connected layers.

The AI system layer. What models, copilots, and agents are running. How they behave. What actions can they take. Who approved them.

The data layer. What information those systems can access. How sensitive it is. Where it came from. Whether it should ever have been exposed in the first place.

A governed model drawing on ungoverned data is still risk. A governed data estate exposed to AI systems without a policy is still at risk. Responsible AI needs both layers to work together — and one control layer between them.

RecordPoint governs the full responsible AI stack — the systems in use, the data they access, and the controlled bridge between them. It gives regulated organizations one permission-aware, policy-governed, audit-ready operating model for scaling AI safely.

Govern the AI. Govern the data. Connect them safely.

‍

How we cover Forrester's framework

Forrester's overview describes the capability areas a responsible AI program needs. Here is how each one shows up in RecordPoint today, across the AI systems your teams use and the data those systems can reach.

Explainability and fairness
AI system inventory with model, data, and decision lineage
Risk management and policy enforcement
Policy enforcement embedded in approval and exception workflows
AI observability and lineage
Continuous monitoring of AI systems, prompts, and connected data sources
Human oversight
Reviews, approvals, and escalations captured as defensible evidence
Robustness
Incident and vulnerability management tied to the AI system register
Third-party risk management
Visibility into vendor AI tools, copilots, and agents in use
Data lineage and control
Discovery, classification, and lifecycle controls on the data AI reaches

What the market is saying

The shift from principle to practice is already visible in how AI leaders spend their time. Forrester's State of AI Survey, 2025 found the three most common responsible AI actions organizations are taking or planning over the next 12 months are training technical roles on responsible AI (27%), implementing responsible AI standards across all programs (26%), and implementing AI observability (24%). The work is moving from policy documents into operations.

We hear it more directly from our customers:

"As a public agency rolling out Microsoft Copilot and other AI tools across the workforce, we're subject to open records requests and we needed real guardrails before adoption ran ahead of us. We were in a 'we don't know what we don't know' state — what AI was already in use, what data those tools could reach, and whether we could prove any of it later. RecordPoint is the only platform we found that lets us seamlessly govern both layers in the one solution: visibility and policy enforcement over the AI tools themselves, and control over the underlying data they're allowed to access. That's what gives us the confidence to scale AI without creating issues we can't unwind."
Senior Manager, Information Governance & Management, Regional Transportation District (Denver)


Access the Forrester report

Get Forrester's full overview of the responsible AI market in Q2 2026 — vendor categories, capability areas, and the agentic-AI disruptors reshaping how regulated enterprises buy.

  • Market definition and vendor categories
  • Capability areas to use during vendor selection
  • How agentic AI is reshaping responsible AI requirements
  • Where RecordPoint is listed in the overview

‍

‍

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester's objectivity at forrester.com/about-us/objectivity/.