## Why governance suddenly matters again
For years, data governance had a reputation as the slow lane: committees, spreadsheets and rarely-used policies. AI has changed that overnight. Every leader now wants to plug their data into a model, and every regulator wants to know what data was used, by whom, for what purpose. Governance has become the gating factor on AI value.
The organisations that move fastest are not the ones with the most data. They are the ones that can confidently answer four questions: what data do we have, who owns it, where can it flow, and what is its quality?
## A blueprint that scales
A practical AI-ready governance programme has five pillars.
### 1. Catalogue
A central, automated catalogue is non-negotiable. It should crawl databases, lakes, warehouses, SaaS apps and file shares, and present a unified view. Tag every asset with owner, purpose, sensitivity and retention. Without this, the rest of the programme is guesswork.
### 2. Classification
Classification is what turns the catalogue into action. At minimum, classify by sensitivity (public, internal, confidential, restricted) and by regulatory category (PII, PCI, PHI, sensitive personal data under GDPR Article 9). Use automated scanning to keep classifications current. Manual classification at scale always rots.
### 3. Lineage
Lineage tells you where data came from and where it went. For AI, this is critical. If a model was trained on a dataset that turns out to contain restricted data, you need to know within hours which other systems consumed that dataset. Modern catalogues capture lineage from ingestion through transformation to consumption automatically when you instrument your pipelines properly.
### 4. Quality
A model trained on poor data is a confident liar. Define quality dimensions that matter for your business: completeness, accuracy, timeliness, consistency, uniqueness. Measure them continuously and surface scores in the catalogue so consumers can see whether a dataset is fit for purpose before they use it.
### 5. Access and use
Access control is the last mile. Use attribute-based access policies so a user\u2019s role, project and clearance combine with the data\u2019s classification to decide what is visible. Mask, tokenise or redact sensitive fields by default and require explicit justification to unmask. Log every access and review the logs regularly.
## The AI-specific layer
On top of the foundation, AI introduces new requirements:
- **Training data registers** that record exactly what data each model was trained on, with versions and consent provenance.
- **Use case approval** that links every AI use case to the legal basis, the data sources, the model and the risk assessment.
- **Output controls** that prevent models from echoing sensitive training data back to unauthorised users.
- **Vendor data flow mapping** so you know which prompts and documents leave your perimeter to a third-party model and under what contract.
The EU AI Act and similar regimes elsewhere now require much of this in writing. Building it once, properly, is far cheaper than retrofitting it under audit pressure.
## Operating model
Governance fails when it lives only in a central team. The pattern that works in 2026 is federated:
- A small **central governance team** owns standards, tooling and the AI use case register.
- **Domain data owners** in each business area own their datasets, quality and access policies.
- **Stewards** in each domain handle day-to-day classification, quality issues and access requests.
- **A council** of leaders meets regularly to resolve disputes and approve high-risk use cases.
Keep the central team small. Their job is to enable, not to gatekeep.
## Metrics that matter
Measure the things that actually correlate with AI success:
- Percentage of high-value datasets with named owners and quality scores.
- Mean time to approve a new AI use case.
- Number of policy violations detected and resolved.
- Coverage of automated classification across the catalogue.
## Where to start this quarter
If you are starting from scratch, pick the top five datasets that AI projects keep asking for. Catalogue them, classify them, document lineage and assign owners. You will quickly learn which parts of the blueprint need the most work in your environment, and you will unblock real AI initiatives along the way.