Updated October 2026 · By Ambika Sharma, Founder and Chief Strategist at Pulp Strategy Communications · 10 minute read
If your AI pilots keep passing the demo and failing on data permission, you are in the majority. In a Cloudera survey published in August 2026, 95 percent of respondents had delayed or canceled an AI project over governance in the past year.
Most enterprise AI isn’t stuck on compute. It’s stuck on permission.
Cloudera’s answer, in a paid Forbes BrandVoice feature on 11 August 2026, is to rebuild enterprise AI data architecture so models run wherever data sits. That fixes where the data lives. It does nothing about what the customer said the business could do with it. Under India’s Digital Personal Data Protection Act, 2023, that gap is a liability.
Executive Overview
Enterprise AI data architecture fails on permission when a business decides where data runs before it knows what the data may be used for. Cloudera’s August 2026 survey shows the shift. Security, governance, and compliance now lead the reasons to re-architect at 42 percent, ahead of performance at 35 percent.
Marketing carries the sharpest version of the problem. Personalization, lead scoring, churn models, and AI service agents all reuse the customer record for purposes it was never collected for. India’s DPDP Act ties consent to the purpose stated at collection, so a new platform cannot settle the question. A CMO’s real choice is sequence. Fund the consent map before the platform, and the covered use cases scale this quarter. Fund the platform first, and the business pays for pipelines it may not be allowed to fill.
- Cloudera’s 2026 survey: 95 percent of respondents delayed or canceled an AI project over governance.
- Governance now outranks performance as the reason to re-architect, 42 percent to 35 percent.
- Cloudera sponsored the survey; its Forbes feature discloses no sample size, countries, or fieldwork dates.
- A platform can move a workload. It cannot move a customer’s consent.
- India’s DPDP Act, 2023, limits consent to the purpose stated when the data was collected.
- Marketing AI sorts into three groups by permission: ready now, ready after a notice check, redesign first.
In this article
- What does Cloudera’s survey show about enterprise AI data architecture?
- Why do data governance rules stall enterprise AI projects?
- Can a new data platform fix AI governance delays?
- Which marketing AI use cases are ready to scale today?
- What does India’s DPDP Act change for marketing AI?
- How should a CMO sequence data and platform decisions?
- Frequently asked questions on enterprise AI data architecture
- What should a marketing team do before the next platform review?
Permission-first data architecture is a design order in which a business decides which customer data an AI use case may read, and for what purpose, before deciding where that data is stored or processed. It treats consent as an input to the platform choice rather than a control added after launch.
What does Cloudera’s survey show about enterprise AI data architecture?
It shows the reason for rebuilding has changed. Enterprises used to re-architect for speed; Cloudera’s respondents now re-architect for control. Governance, 42 percent. Performance, 35 percent. Scaling AI across the business, 33 percent.
Cloudera’s headline figure is 95 percent: respondents who delayed or canceled at least one AI project over governance in the past year. The 55 percent who delayed six or more matter more. One stalled project is a bad review. Six points to how the business decides.
Cost and location are moving too. AI workloads raised infrastructure costs for 84 percent of Cloudera’s respondents. Within the year, 66 percent moved AI workloads off public cloud to on-premises or private systems.
Read it for direction, not precision: Cloudera sells the platforms its findings point toward, and the feature publishes no sample size, countries, or fieldwork dates.
Sorting AI use cases by permission before procurement prevents the costliest failure in an AI program, a migration built for data the business cannot use. With 95 percent of Cloudera’s respondents already reporting governance delays, a consent review run first moves the delay to where it costs a workshop.
CMO Takeaway:
| Enterprises now rebuild for control, not speed. Cloudera’s survey ranks governance ahead of performance, 42 percent to 35 percent. Its 55 percent of respondents with six or more delayed projects show a decision pattern, not bad luck in the review queue. |
Why do data governance rules stall enterprise AI projects?
AI does not create new data. It creates new uses for old data, and every new use asks a question the original consent never answered. That is where projects stall, often in the last review before launch.
The CRM that holds a customer’s number for delivery updates is the same CRM a model now mines for a next-best-offer message on WhatsApp. The record did not change between the two uses. The purpose did, and purpose is what the customer agreed to.
Classic analytics ran fixed reports on fixed datasets, so one compliance review held for years. An AI program asks new questions of the same records every quarter. Hybrid estates multiply the reviews, because each extra location adds a jurisdiction, an access policy, and another copy to keep consistent. That is the likeliest reading of the 73 percent of Cloudera’s respondents who said AI has made data governance more complex.
The rules did not get stricter; the uses got wider.
CMO Takeaway:
| AI stalls on governance because it reuses old data for new purposes, and each purpose needs its own permission. Cloudera’s 73 percent who find governance harder since AI arrived are describing that reuse inside their estates, not a stricter rulebook from outside. |
Can a new data platform fix AI governance delays?
Only the location half. A modern data platform can apply one access policy across clouds and keep regulated records in the right jurisdiction. It cannot grant a permission the business never obtained. Location matters for security and residency, and a good platform handles that half well.
| “AI changes the scope of governance.” Sergio Gago, Chief Technology Officer, Cloudera, in the Forbes BrandVoice feature of 11 August 2026 |
Sergio Gago is right, and his own sentence shows where the vendor reading stops. In Cloudera’s framing, wider scope means more environments to govern. For a CMO, it means more purposes to justify, from churn scoring to per-customer messaging. Only the customer sets those, at the moment of collection.
My position, which every data-platform vendor will dispute, is that a marketing AI program should not commission a re-architecture until it has mapped the consent behind each use case. Bought first, the platform builds faster pipes to data the business may not be allowed to use. The pipes will work. The permission will not.
A platform can move a workload; it cannot move a consent.
CMO Takeaway:
| A data platform governs where customer data runs, and consent governs whether it may run for a new purpose. Cloudera’s 66 percent who moved AI workloads off public cloud changed the location of their data, not the permission behind it. |
Which marketing AI use cases are ready to scale today?
The ones whose data the business already has a clear basis to use for that purpose. Sort a marketing AI portfolio by permission instead of ambition and it falls into three groups, each with a different budget decision attached.
- Ready now. Use cases on non-personal or aggregated data: generative copy and creative variants, media-mix modeling on campaign aggregates, and AI search visibility analysis. Fund them today. The open questions are claims review and security, not consent.
- Ready after a notice check. Use cases on first-party records collected with notice: CRM lead scoring, churn prediction, and next-best-offer models. Fund the notice review first. Each scales the day someone confirms the original notice covered the new purpose, or issues one that does.
- Redesign before scaling. Use cases that send personal data to new processors or uses: per-customer AI outreach, account-level service agents, and audience data shared with ad platforms. Fund consent design and processor contracts before any media or platform spend.
To sort a use case, list the personal data it reads, find the notice behind each field, and test whether that notice named this purpose. Where it did, scale it. Where it did not, redesign it or collect fresh consent. Only then decide where the workload runs.
Take a churn model. Built on account history collected for customer service, it fails the notice test and costs one workshop to redesign. Found after a platform migration, the same failure costs the migration, the pipeline build, and the quarter the model was meant to protect.
The cheapest place to fail a use case is before anyone has priced a platform for it.
Unlike a platform-first re-architecture, Pulp Strategy’s permission-first review clears consent for each marketing use case before it chooses where the workload runs.
Marketing AI use cases sorted by data permission, October 2026
| Use case | Personal data read | Consent question | Where it can run | Ready to scale | First fix |
| Generative copy and creative | None | Not applicable | Any approved environment | Now | Claims review |
| Media-mix modeling | Aggregated only | Aggregation threshold | Any approved environment | Now | Aggregation rules |
| CRM lead scoring | Contact and behavior data | Did notice cover scoring? | Where CRM data resides | After check | Notice review |
| Churn prediction | Account and usage history | Did notice cover modeling? | Where account data resides | After check | Notice review |
| Per-customer AI outreach | Profile and message history | New purpose, new notice | Approved processors only | After redesign | Consent design |
| AI service agent | Live account access | Access scope and logging | Controlled environment | After redesign | Access controls |
| Audience sharing with ad platforms | Hashed identifiers | Transfer to third party | Platform terms apply | After redesign | Processor contract |
Source: Pulp Strategy analysis, October 2026. Readiness is a planning category, not a legal opinion.
CMO Takeaway:
| Marketing AI sorts by permission into three budgets. Fund generative creative and aggregated media-mix modeling today, and CRM scoring and churn models after a notice check. Fund per-customer personalization only after consent design under India’s DPDP Act, 2023, and not before. |
What does India’s DPDP Act change for marketing AI?
REGIONAL NOTE: INDIA
It makes purpose the unit of permission. Under the Digital Personal Data Protection Act, 2023, consent must be free, specific, informed, unconditional, and unambiguous, and limited to the personal data needed for the stated purpose. A new AI use of the same record needs a basis of its own, whatever platform holds it.
Three provisions land directly on a marketing roadmap. Notice must describe the data and the purpose before consent is sought. Withdrawal must be as easy as consent. Transfers abroad are allowed unless the central government restricts the destination by notification.
Most obligations under the Rules notified in November 2025 take effect within a normal two-year marketing plan. Penalties for failing to take reasonable security safeguards can reach INR 2.5 billion. That figure moves consent off the legal backlog and onto the CMO’s agenda, where the use cases are chosen.
A use case approved this year on an old notice will still be running when those obligations apply in full.
CMO Takeaway:
| India’s DPDP Act, 2023, makes purpose the unit of permission and requires notice before consent. Most obligations under the 2025 Rules arrive within 18 months of notification, so every 2027 marketing AI use case needs its consent basis mapped first. |
How should a CMO sequence data and platform decisions?
Permission first, platform last. Run in this order, each decision lands where reversing it is still cheap. The platform review then starts from a sorted portfolio, not a wish list.
- Inventory every live and planned AI use case in marketing, with an owner named for each.
- List the personal data each one reads and the notice each field was collected under.
- Sort each use case: ready now, ready after a notice check, or redesign first.
- Close the consent and processor gaps for the use cases worth scaling.
- Set residency and access requirements, then choose the architecture that meets them.
Each step can end the case for the next, so a use case that fails step 3 never needs a platform decision. Cloudera’s 55 percent with six or more delayed projects fits the reverse order. Delays surface one project at a time, after the budget is committed.
A team that starts at step 5 finds its step 3 failures after signing the contract.
CMO Takeaway:
| Fund the consent map before the platform. Inventory, consent mapping, sorting, and remediation come first, in exactly that order. The 2027 architecture budget is then spent only on marketing AI that India’s DPDP Act, 2023, allows the business to scale. |
When your next AI use case reaches the steering committee, will it arrive with a consent map or a platform quote?
What should a marketing team do before the next platform review?
Start with an inventory, not a vendor shortlist. List every marketing AI use case planned for 2027, the personal data each one reads, and the notice under which each field was collected. Sort the list into the three groups above before any platform is presented. Pulp Strategy runs this review with marketing and privacy teams in a single working session, booked through the contact page.
