Data governance for AI: the invisible foundation

There is an uncomfortable truth in artificial intelligence: the most sophisticated model fed with bad data produces bad results. That is why, when an organisation wants to accelerate in AI, my first question is not about algorithms, but about data. Data governance for AI is the invisible foundation on which everything else rests.

What data governance is and why it is the foundation

Data governance is the set of policies, roles and processes that ensure an organisation’s data is reliable, well managed and used appropriately. In the context of AI, this is critical: models learn from data, so the quality, provenance and governance of the data directly determine the quality and legality of the result.

Investing in models before data is like building a skyscraper on sand. Data governance lays the foundations first.

The pillars of data governance

Quality and traceability

Complete, correct data with a known origin. For AI, traceability also matters: knowing where each piece of data comes from is essential to audit the system and comply with the EU AI Act.

Ownership and accountability

Each data set needs a clear owner. Without defined ownership, quality degrades because no one is accountable for it. Assigning responsibilities is one of the simplest and most forgotten steps.

Compliance and privacy

Data governance must ensure that the use of information respects the GDPR and, increasingly, the EU Data Act. Feeding a model with poorly governed data is sowing a legal risk that will explode sooner or later.

How I approach data governance in AI projects

I always start by understanding what data exists, whose it is and what state it is in, before thinking about models. I establish owners, quality metrics and access controls. Only when the data foundations are solid is the AI built on top reliable. It is less flashy than training a model, but it is what really holds the project up.

From theory to practice: data catalogue and lineage

In the projects where I have seen AI fail, the origin was almost always data that no one could explain: where it came from, who had transformed it and what each column really meant. That is why the first thing I set up is a living data catalogue, where each data set has an owner, a clear definition and a measurable quality level. You do not need an expensive tool to start; discipline and a shared glossary that everyone respects are enough.

The second element I consider essential is data lineage, that is, complete traceability from the source to the model. When a result is surprising, being able to reconstruct the path that data travelled saves weeks of investigation. Moreover, lineage is the best defence in an audit: it demonstrates that you know exactly what information feeds your automated decisions and under what transformations. That rigour is, in my experience, what separates an improvised pilot from an AI system the organisation trusts.

The legal framework also governs your data

Data governance does not live isolated from regulation. The right of access and portability introduced by the new European regulation directly affects how I store, share and document the information that then feeds my models. That is why I integrate legal requirements into the very design of data governance, an intersection I explain in detail in my analysis of the EU Data Act in data and AI projects. Thinking of governance and compliance as a single discipline avoids redoing the work later.

One last piece of advice born from practice: measure data quality with concrete indicators and review them periodically. Completeness, consistency, timeliness and uniqueness are simple metrics that, monitored in time, prevent a model from learning from biased or outdated information. When the team sees those numbers improve month by month, governance stops being perceived as bureaucracy and starts to be understood as what it really is: the basis on which any reliable AI is built.

It is also worth assigning each data set a sensitivity level and a clear retention policy. Not everything deserves the same protection, and keeping information longer than necessary only adds risk and cost. Establishing from the outset how long each piece of data lives, who can access it and when it should be anonymised or deleted greatly simplifies compliance and reduces the exposure surface in any incident.

Conclusion: data first, always

Data governance for AI is not the exciting part of the project, but it is the decisive one. After many years, my conviction is total: whoever governs their data well has half the AI battle won; whoever neglects it, no matter how good a model they use, builds on sand.

Frequently asked questions about data governance for AI