As governments move to investigate incidents involving AI agents, Liquibase research finds 96.5% of respondents report AI interactions with production databases, yet only 32% consistently create audit-ready database change history.
AUSTIN, Texas--(BUSINESS WIRE)--#AI--Liquibase, the leader in Database Change Governance, is calling attention to a growing accountability challenge as AI agents take on a greater role in changing production systems. Findings from the company’s 2026 State of Database Change Governance Report, published in March, show that 96.5% of respondents report at least one AI or LLM interaction with their production databases, while only 32% always or often create audit-ready database change history. The warning follows new government action on autonomous AI.
On October 12, 2026, the UK government announced it is developing a specialist capability to respond to serious incidents involving AI agents, working with the National Cyber Security Centre, Department for Culture, Media and Sport, and the AI Security Institute. The government said that when such incidents occur, it must be able to quickly establish what went wrong and contain the risks. In the United States, a concept paper from NIST’s National Cybersecurity Center of Excellence focuses on identity, authorization, and auditing for AI agents, noting that agents are often treated as generic service accounts without dedicated accountability controls.
For enterprises, the same implications extend to production databases. Whether investigating an incident or proving control to an auditor, organizations need a reliable record of what changed, who or what initiated it (human or an AI agent), whether it was authorized, and what controls ran. When AI agents generate and deploy database changes, sometimes through shared service accounts, that record is often the hardest evidence to produce.
“AI is changing who makes software changes, but it doesn’t change who’s accountable for them,” said Pete Pickerill, Co-Founder at Liquibase. “When an AI agent initiates a change to a production database, organizations still need to know what changed, whether it was authorized, and which controls were enforced. If proving that requires reconstructing activity across tickets, logs, and spreadsheets, the governance model isn’t keeping up with the technology.”
The Database Audit Readiness Gap
The 2026 State of Database Change Governance Report, based on a survey of 426 database, platform, technology practitioners and senior technology leaders, reveals a gap between how frequently organizations face audits and how consistently they maintain the evidence needed to demonstrate control:
- Audits are constant. 95.3% of respondents face multiple compliance or database audits annually, including 21.6% who face seven or more.
- Evidence is inconsistent. Only 32% always or often create audit-ready database change history. Another 39% do so sometimes, while 21% rarely or never do.
- Controls depend on people. Only 35% always or often automate security or compliance checks on database changes.
- Drift detection is inconsistent. Only 31% always or often automate drift detection, while 48% do so only sometimes.
- AI adds new risk. 46.5% cite ungoverned AI-generated SQL as a top AI-related database change risk.
Most organizations have governance processes, but the controls and evidence supporting those processes aren’t always applied consistently. As AI increases the speed and volume of database change, that gap becomes increasingly difficult to manage.
When AI Makes the Change, Who’s Accountable?
The accountability questions haven't changed: What changed? Who authorized it? Were the right controls enforced? What has changed is how hard they are to answer once AI agents generate SQL and initiate change through automated workflows. In the same survey, 33.6% of respondents report AI-generated SQL interacting with their production databases, and 21.8% report human review if governance controls aren’t embedded upstream.
Organizations can’t rely on someone remembering to review a change, or on reconstructing its history after deployment. Governance has to be enforced inside the delivery process, with the evidence captured as each change happens.
Liquibase Secure 6.0 Brings Continuous Governance to Database Change
As AI accelerates software delivery, organizations need consistent policies, visibility into change activity, and a reliable record of how controls were applied, regardless of whether changes originate with developers or AI agents.
Introduced September 30, Liquibase Secure 6.0 brings these capabilities together in a unified platform to see, govern, and control database change across teams, pipelines, databases, and agents:
- Change Intelligence centralizes database change activity, deployment history, and policy outcomes, making it easier to understand what changed and demonstrate which controls were applied. Changes originating from developers or AI agents can be governed and tracked when deployed through supported Liquibase workflows.
- Centralized policy management lets teams define rules once and apply them everywhere, starting from 50+ prebuilt policy rules.
- Role-based access control and governed exceptions determine who can manage policies, assignments, exceptions, and governed assets, preserving separation of duties without slowing developers down.
The release builds on Agent Safe Governance, which helps enterprises validate, track, and govern database change whether it's created by people or AI.
It’s Audit Season. Be Audit-Ready. Always.
Audits shouldn’t test your memory. Organizations need to know what changed, demonstrate that the right controls were followed, and produce evidence without reconstructing activity across tickets, logs, and spreadsheets.
To help organizations address these challenges, Liquibase has launched It’s Audit Season, an initiative focused on closing the gap between database change governance and audit readiness.
The campaign draws on findings from the 2026 State of Database Change Governance Report to highlight the risks of inconsistent controls, fragmented evidence, and the growing role of AI in software delivery. It includes a free Audit Readiness Assessment, an audit checklist, and practical guidance informed by the 2026 report.
Audit season comes around. Audit readiness never leaves.
Learn more: www.liquibase.com/auditseason
About Liquibase
Liquibase empowers teams to deliver mission-critical applications, data products, and AI initiatives by automating and governing database change. We are the company behind Liquibase Community, a project with deep open-source roots that has been downloaded more than 100 million times and is trusted by thousands of teams worldwide.
Liquibase Secure, built on that proven community foundation, is the only enterprise platform that unifies DevOps, security, and compliance at the database layer. It enables organizations to deliver applications and data products with velocity, safety, and confidence. Trusted by the world's most innovative and highly regulated enterprises, Liquibase Secure powers the last mile of application and data delivery.
Learn more at www.liquibase.com. Follow Liquibase on LinkedIn and X.
Contacts
Media Contact:
Torry Cullen
Torry@MadisonAlexanderPR.com
(781) 363-2542
