AI models andagentic systemsare only as good as the data they’re built on. Yet too often, enterprise data is missing, scarce or buried behind regulatory firewalls. The result is an incomplete or incorrect picture of events, which quickly skews any results.
Enter synthetic data. Thisartificially generated informationaims to mimic real-world statistical patterns. It’s particularly useful for filling in data gaps when an enterprise lacks factual information, whether that’s about customers, patients or transactions. The concept isn’t new; synthetic data has long played a role inprotecting sensitive information. Yet it is reinventing itself in the era of AI.
Financial services firms, healthcare providers, government agencies and others routinely use synthetic data — but it’s important to do so with caution. Without strong controls in place, synthetic data can generate misleading results and increase regulatory risks. “You can get it to be quite accurate, but it requires real effort to do that,” said Matt Kropp, chief AI officer at consulting firm BCG X.
For effective deployment, CIOs must recognize when and where synthetic data delivers value — and then install the rightgovernance modeland operational controls. Bias, drift andmodel collapsearen’t abstract risks, especially when dealing with something fabricated.
“At the end of the day, synthetic data is synthetic,” said Zeid Khater, an analyst at Forrester Research.
Fabrications matter
The appeal of synthetic data is quite apparent in an enterprise context. By swapping out actual data with realistic facsimiles, it’s possible to mask a person’s identity or shield proprietary business records for both internal and regulatory compliance purposes. An enterprise can also model situations and events when actual data is lacking, which can help it keep pace in a data-driven marketplace.
The challenge is harnessing those same benefits now that AI has altered the equation. AI has fueled demand for synthetic data while lowering the cost of creating it. In the past, “it usually involved a data scientist who sat down with a subject-matter expert, and together they created or formulated a data set that made sense for what they were trying to model,” Khater said.
That’s no longer the case. Generative AI (GenAI) models now compress weeks of synthetic data generation into seconds and can produce outputs that closely resemble actual data. Enterprises have been quick to take advantage; consulting firm Capgemini, along with Sogeti and OpenText,foundthat the use of synthetic data in testing rose from 14% in 2024 to an average of 25% in 2025, according to the more than 2,000 respondents to the World Quality Report 2025-26. In addition, 35% of organizations now generate more than a quarter of their test data synthetically.
Yet a fundamental conflict can follow: “[It’s] security versus utility,” said Ilker Taskaya, CTO at data management software firm Perforce. The closer synthetic data comes to the real thing, the more useful it is — but also the riskier it becomes from a privacy and security standpoint. On the other hand, if a CIO leans too heavily into safety, utility “degrades significantly,” he noted.
What makes the task so tricky is that LLMs excel at semantic understanding but stumble with consistency, Taskaya said. A model can “change its mind down the road.” And scale only dials up the difficulty. Producing 50 synthetic records is a simple proposition; generating billions of rows in a 60-terabyte production database sends token costs soaring and efficiency plummeting.
Complexity introduces another challenge. The more dimensions a data set carries — and the more relationships that exist within it — the harder it is to ensure that the synthetic data is accomplishing what it is supposed to, Khater said. There’s a more fundamental boundary as well: By its very design, synthetic data must be intentionally produced. That means synthetic data can scale scenarios an enterprise already understands, but it can’t reliably surface the edge cases nobody anticipated when the model was built.
Beyond the sandbox
Even though GenAI has made it easier to produce synthetic data, deploying it effectively involves more than “just spinning up your chatbot of choice and saying, ‘Generate 1,000 records of synthetic data,'” Kropp said. Some environments tolerate approximation; others do not. There’s a “bit of an art versus science” element required, Khater said.
For example, a developer testing a single feature may require synthetic data to analyze only 10 customers who touch 20 policies in a local database. On the other hand, an integrated test environment might span hundreds of customers and conflict with billing and payment systems. Models that also involve analytics and model training can further complicate things.
As the pool of synthetic data expands, so do the risks — especially when it travels outside the sandbox. It’s remarkably easy to miss even small chunks of data that somehow land in a production system. While a fabricated record is usually harmless in a test environment, once it contaminates a production model it’s possible to end up with biased models, botched business decisions and regulatory exposure. “You need to look at how the data is being used, and put the right controls in place,” Taskaya explained.
Effective controls orbit three core questions:
-
Where can synthetic data travel?
-
Can it be confined to a single environment using a sandbox or other tool?
-
What is its lifespan?
A CIO must understand the nuances of the situation — including when synthetic data is useful and when it’s best avoided, Taskaya said. For instance, strict controls aren’t necessary for building a software interface; an insurance underwriting model that relies on accuracy and lack of bias is another matter.
There’s also a need to examine the level of accuracy required for any given task. That’s best accomplished using an evaluation harness, a testing framework that cross-checks a system’s output against known correct answers, Kropp said. With such a tool, teams can spot undesired deviations and fine-tune the system during development and into production. Without one, “you have no idea how it’s performing,” he added.
Building guardrails
Even a strong governance framework fails without the right metrics. BCG X recommends direct oversight of critical factors — essentially mimicking how the financial services industry assigns regulatory responsibility. That means establishing strong ownership and accountability, including for line-of-business users who plug in their own tools and sometimes incorporateshadow AI.
These systems must also address the fact that AI is dynamic, not static. Becausemodels drift and sometimes collapse, ownership also extends across time. As new events take place and novel data streams in, relationships and outcomes change. Any oversight must acknowledge this movement.
Meanwhile, synthetic data suffers from the opposite problem: Frozen at the precise moment it was created, it can produce distortions and false conclusions within a dynamic system. As data flows back into training, it decays and performance degrades. The fix? Build mechanisms to ensure that synthetic data reflects current requirements, not just the original ones.
Make no mistake: Synthetic data can speed development pipelines, illuminate business opportunities and strengthen privacy protections. As CIOs recognize that they need more than real-world data to power the digital enterprise, they are tapping it in growing numbers, Kropp concluded. Synthetic data, used as a strategic tool rather than a shortcut, is “a way to bridge that gap.”
The distinction will be between the enterprises that update their governance for the AI era and wield synthetic data effectively — and those that don’t.
