We were overconfident: How AI is changing the perception of data governance

AI can be merciless in revealing poor data management

AI is exposing weaknesses in data governance that organisations may have previously been able to ignore. At the IT Leaders Summit, governance experts explained how they are seeking to eliminate these gaps.

Governance starts with ownership

Given sufficient access, AI agents can quickly unearth and connect long-forgotten data in ways that can be quite alarming. Established governance frameworks may not address the access, ownership and quality questions raised when AI models begin accessing corporate information at scale.

Krishnan Chandrasekharan, director of IT at clinical research services provider IQVIA, said his organisation had initially been “overconfident” because of its decades-long pedigree as a data science organisation. The arrival of AI tested that assumption.

“We needed to completely rethink responsibilities,” he said during a panel session at last week’s Computing IT Leaders Summit. “Ownership is very critical. Who owns the data? Who’s responsible for the data being right? If there is any question on the underlying data or the quality of it, then the whole AI outcome becomes very questionable.”

At the Financial Times, senior data governance specialist Sophie Turner advocates presenting governance as an enabler rather than an obstacle.

“The word governance has a really bad rep,” she admitted. “I think trying to lead from an enablement perspective really helps.”

Her team begins engagements with a data-quality workshop, giving employees an opportunity to identify the manual interventions and recurring problems they encounter.

“It’s led by the business; they’re the ones making the decisions, and it helps with that feeling of ownership,” she explained. “We’re not dictating what they should be working on when it comes to improving the quality of their data. They’re telling us what those issues are that they’re facing, and we’re working with them.”

Gunjeet Sandhu, associate director at Macquarie Group, warned against treating it as a static tick-box exercise. “You can’t just define a document saying this is your governance,” she said. “It’s a living, breathing thing. As you transform, as technology evolves, the structures evolve.”

Consequently, cataloguing and traceability must be an integral part of the information lifecycle, rather than being undertaken only during initial discovery. “Anything that we process is catalogued and marked and it is part of the process cycle,” said Chandrasekharan.

Scaling AI safely

There is, perhaps, no better test of data governance than rolling out an AI proof-of-concept across the enterprise.

Before selecting testing groups, organisations should establish exactly what information and systems each participant can access. Long-serving employees may have been granted permissions through previous roles or projects, and an AI tool may inherit that person’s access.

“Whoever is in your beta group or your alpha group is going to use AI tools. Make sure that their security roles are audited, and make sure they have the right privileges,” Chandrasekharan warned, adding that IQVIA had discovered unexpected access rights during early-stage rollouts.

Scaling also requires business sponsorship and clear end-to-end responsibility. Sandhu explained that transformations often break down because each participant assumes somebody else owns the next stage. Project owners must not hand off responsibility, she said. “They have to own it from inception to the end; that’s the ownership people have to understand”.

Cross-functional product groups should be organised around the desired business outcome, rather than on the narrow interests of individual departments.

Sandhu also emphasised the importance of training, describing the introduction of an AI office at Macquarie, which provides regional learning sessions and education covering available tools and data. This training is now mandatory for all staff. “It’s not a nice-to-have, everybody has to do it,” she said. “If you put that investment in, the building blocks, then it’s easier to build on it.”

Finally, automation should only be progressed when there’s evidence that it can perform reliably. IQVIA keeps a “human in the loop” while processes mature and confidence increases. Consistent results, including the ability of a system to explain its answers without hallucinating or producing substantial variations, help identify tasks that can be automated more fully, with the human removed. “There is a lot of back and forth … but I think we need to go through it. We need to be patient.”

Trust must be earned

Ultimately, consistent results are a minimum requirement if AI systems are to be successful. Employees must believe that the organisation is using the technology responsibly; customers need to understand why and where it is deployed; and governance teams need to keep an eye on the evolution of models, tools and third-party suppliers.

As a media organisation, the FT has clear policies and frameworks on AI usage and ethics. “We're really outward facing about where we won't be using AI, particularly in editorial content,” said Turner. However, she acknowledged that documents alone have limited reach.

“People don’t read policies, unfortunately,” she said. “I wish that they did, but they don’t.”

So, her team proactively promotes its AI-usage policies through forums such as town halls, explaining the processes being introduced while being clear about its approach to AI and areas where the technology should not be used. This outreach should also increase trust in the governance function.

The FT has also introduced AI clinics through which employees experimenting with new uses of AI can seek guidance from specialists in data science, governance, legal and cyber security.

“We're there as a guiding hand and support. And then, in terms of our readers , we're really clear about what our approach is with AI. So I think that builds trust, and the FT is a brand really built on trust.”

Operating in the highly regulated financial sector, Macquarie also cannot afford mishaps with AI. Models and tools operate within defined guardrails and are examined by specialists. “We don’t let anybody just get access,” said Sandhu. “New models, tools and other third parties, all go through a proper risk assessment.”

Similar checks and balances are in place at IQVIA. Chandrasekharan explained that AI models lack a predictable update cycle. “You can’t just release a model into the wild or into the organisation just because it’s performing well,” he said. “So it needs to go through due process before it’s put out.”