AI drives rapid database change, outpacing governance

Artificial intelligence systems now interact with production databases in 96.5% of organisations, Liquibase reported, but standardised enforcement of database change governance remains limited.

The figures come from Liquibase's 2026 State of Database Change Governance Report, which examines how enterprises manage database changes as AI becomes more embedded in production systems, analytics, and delivery pipelines. The research highlights a growing mismatch between the speed of database change and the controls organisations can demonstrate at the database layer.

Respondents said database updates now move too quickly for manual checks. The survey found 68.1% deploy database changes weekly or faster, including 10.8% deploying multiple times per day and 18.8% deploying daily.

Governance gap

Despite the pace of change, only 28.1% of respondents said their database change governance is standardised and consistently enforced. Another 42.3% described their maturity as ad hoc or emerging. Just 7.7% reported fully automated governance using policy as code with real-time enforcement.

Liquibase framed the shortfall as both an operational and assurance problem in an AI-heavy environment. AI introduces new pathways for database access and change, increasing the need for demonstrable controls and traceability.

"AI raises the standard for control. It adds new automation and new actors, and it does it right where trust is won or lost: the database," said Pete Pickerill, co-founder of Liquibase.

"If governance isn't enforced and measurable, you're operating with an unmanaged risk surface. The result is data quality issues, audit friction, and outcomes leaders can't explain. This report maps the gap and the practical path teams are taking to close it," Pickerill said.

AI-related risks

The report also highlights AI-era concerns tied to data and databases. Data quality ranked highly, with 64.3% citing it as a top AI-related risk. Nearly half, 46.5%, pointed to ungoverned AI-generated SQL as a key concern.

These risks sit alongside growing complexity in database estates. Respondents reported using an average of five database and data platform types, and 29.1% said they manage 10 or more. That mix can increase variation in how teams and platforms handle schema changes, access controls, and audit evidence.

Audit pressure

Compliance and audit workloads are also rising, the survey found. Liquibase reported that 95.3% of respondents undergo multiple compliance or database audits per year, and more than one in five face seven or more annually.

In that context, the report argues that governance approaches based on documentation and manual review often struggle to scale. Fragmented evidence and inconsistent enforcement add work when teams need to show who changed what, when it changed, and whether approvals and policies were followed.

Telemetry signals

Alongside the survey, Liquibase included anonymised product telemetry from Liquibase Secure, presented as a separate dataset.

The telemetry suggests governance settings are commonly enabled in Liquibase Secure. Liquibase reported that 99.25% of sessions run with governance enabled. It also said nearly 86% of observed changelog activity is in XML and YAML, which it linked to machine-readable change definitions.

Another telemetry finding was that about 90% of sessions run outside continuous integration environments. Liquibase said this suggests governance activity occurs in developer workflows and other stages, rather than being confined to CI systems.

Liquibase also said reporting is among the product's most-used features, which it linked to demand for traceability and audit-ready records.

Roadmap and metrics

Liquibase said the report includes a staged operating model for moving from ad hoc database change practices to more standardised, observable governance. It also outlines a CIO-focused scorecard that pairs reliability measures, such as mean time to detect and mean time to recover, with coverage measures for automated controls, audit evidence, and AI-governed change.

Liquibase is known for its open-source roots through Liquibase Community, which it said has exceeded 100 million downloads. Its commercial product, Liquibase Secure, focuses on database change governance across DevOps, security, and compliance teams. Liquibase expects governance requirements to become more demanding as AI-generated changes, AI-driven access patterns, and heterogeneous database estates expand across large organisations.