Three stories this week draw a direct line from platform controls to data blind spots to a courtroom in Manhattan — and the thread connecting them is the governance gap.

Stories Covered:

1. Microsoft Copilot February 2026 Governance Update

Project Manager Agent — public preview March, GA April. Not a copilot. An agent with a named role.
Multi-agent workflows — agents calling other agents, with visible handoffs
Risk-based AI agent inventory in Microsoft Defender — every agent in a single pane with posture assessments
Third-party connectors in public preview — governed access to Canva, HubSpot, Notion, Linear
License requests now require business justification
New centralized readiness dashboard in the admin center

2. Thales / S&P Global 2026 Data Threat Report

Only 34% of organizations know where all their data resides
47% of sensitive cloud data is unencrypted
61% cite AI as their top data security risk
Nearly 60% have experienced deepfake-driven incidents
Only 30% have a dedicated AI security budget
Only 39% can fully classify their data

3. US v. Heppner — Claude Conversations Ruled Not Privileged (SDNY)

Judge Jed Rakoff ruled that conversations with Anthropic Claude are not protected by attorney-client privilege
Consumer AI terms of service do not create confidentiality expectations
Feeding attorney advice into consumer AI may waive privilege over the original legal advice
Enterprise AI subscriptions with contractual confidentiality provisions are the minimum standard
Litigators will now routinely request AI prompts and outputs in discovery

Key Takeaway: AI governance is not a compliance checkbox — it is an operating discipline that touches procurement, security, legal, and data architecture simultaneously.

Hosted by Stephen Forte, founder of BuildClub.