AI governance and data governance: a practical playbook

Governance has a reputation for slowing things down. Done badly, it does. Done well, it is what allows teams to say yes to AI quickly, because the rules, owners and checks are known in advance. This guide is the short form of two of our books, The AI Governance Playbook and Data Governance in the Age of AI, and it treats the two as one system.

Why the two belong together

AI governance asks whether a model or agent is used responsibly: for what purpose, with what risk, under whose oversight. Data governance asks whether the data feeding it is trustworthy: who owns it, where it came from, whether it may be used this way and how good it is. An agent with excellent oversight and poor data still produces poor results, and clean data in an unsupervised agent is still a risk.

Seven building blocks

1. An inventory. You cannot govern what you cannot see. List the AI uses and agents in the organization, who owns each and what data they touch. Include the informal ones people have started on their own.
2. Risk tiers. Not every use needs the same scrutiny. Sort uses by what could go wrong: a drafting aid for internal notes sits in a different tier from an agent that acts on customer accounts. Define the review each tier requires.
3. Use-case review. A lightweight intake: purpose, data used, who is affected, what a bad outcome looks like, who can switch it off. Fast for low tiers, deeper for high ones.
4. Policies people can follow. Short, plain-language rules with the reasons attached, written so a practitioner can apply them without a lawyer in the room.
5. Human oversight. Decide where a person approves, where a person reviews afterward and where the agent may act alone. Make the approval points visible in the agent's design.
6. Monitoring and audit. Log what agents do, watch for drift and odd behavior, and keep records that someone can actually read after the fact.
7. Incident response. Know in advance how to pause an agent, who is told, how affected people are helped and how the lesson is captured.

Data governance for AI: the essentials

• Ownership and stewardship. Every important dataset has a named owner accountable for it and a steward who looks after it day to day.
• Lineage. Know where data came from and what has changed it, so an odd answer can be traced.
• Privacy and consent. Know what data is allowed to be used for which purpose, and keep personal data out of places it should not go.
• Quality. Define what good means for each dataset: complete, current, consistent and fit for the use. Measure it on a rhythm.
• Context. For agents that retrieve documents and lessons, the quality and freshness of that content matters as much as database fields. Each item should have an owner and a review date.

Make governance a learning system

A policy written once and filed away decays. Treat governance as a loop. When an incident, near miss or surprising result occurs, write a short lesson, update the relevant rule and tell the people who need to know. Over a few cycles the playbook becomes a record of what your organization has learned about using AI safely. That is scaled learning applied to risk.

Roles that help

• Agent owner: accountable for what a given agent does and for keeping its instructions and knowledge current.
• Data owner and steward: accountable for the data an agent reads.
• Reviewer: a person or small group who performs use-case review quickly and consistently.
• Executive sponsor: sets the risk appetite and unblocks decisions.

Starting without a big program

1. Create the inventory in a shared sheet this month.
2. Define three risk tiers and write one paragraph for each.
3. Pick one live agent and walk it through the use-case questions. Fix what you find.
4. Name an owner for the five datasets or document collections agents use most.
5. Schedule a monthly thirty-minute review of incidents and near misses, and capture one lesson each time.

What not to do

• Do not ban tools outright without offering a safe alternative. People will use them anyway, out of sight.
• Do not write a hundred-page policy no one reads.
• Do not assume the vendor handles governance for you. Responsibility for how you use a tool stays with you.
• Do not treat governance as a one-time project.

For measures and dashboards that depend on trustworthy data, see our guide to AI-driven balanced scorecards. For the knowledge that agents retrieve, read knowledge management with AI agents. We also run facilitated governance workshops for teams.