Most organizations approach AI governance as if it’s a greenfield problem. It isn’t. If your data governance was weak before AI, AI just made the weakness visible, faster, and more expensive to ignore.
I learned this firsthand leading a proof of concept for a major European telecommunications provider, applying machine learning to detect anomalous patterns in treasury transactions. The ambition was sound: move beyond rule-based controls toward predictive risk detection. The organization had solid traditional controls in place. What it didn’t have was a mature data governance foundation, clear data ownership, standardized business definitions, or real data lineage transparency.
The PoC didn’t deliver the actionable insights it promised. Not because the machine learning was wrong, but because the data underneath it couldn’t support what we were asking of it. Add strict regulatory requirements around pseudonymization, which further stripped traceability from an already fragile data structure, and the project became a case study in a pattern I now see everywhere: advanced analytics ambition outpacing foundational data maturity.
That experience is what pulled me into data governance as a discipline, not as an abstract interest, but because I watched a well-resourced, well-intentioned initiative stall for reasons that had nothing to do with the AI itself.
The organizations getting this right today aren’t the ones with the most advanced AI stack. They’re the ones who treat AI governance as an extension of data governance, not a parallel workstream. Concretely, that means three things.
First, data ownership has to be resolved before model deployment, not after. In the treasury case, unclear ownership meant nobody could authoritatively say what a given field meant or whether it could be trusted. No model output can compensate for that gap.
Second, regulated industries need explainability built into the data layer, not bolted onto the model. Pseudonymization requirements are non-negotiable in many jurisdictions, correctly so. But if privacy and traceability aren’t designed together from the start, you end up with data that’s compliant and unusable at the same time.
Third, governance frameworks need to move at the speed of the business, or people will route around them. Ambition without governance produces stalled pilots. Governance without pragmatism produces the same result, just slower.
None of this is really about AI. It’s about whether the fundamentals were solid before the AI conversation started. In my experience, the gap between “AI-ready” and “AI-exposed” organizations comes down to work that was supposed to happen years earlier.
