Data governance

Data governance answers three questions: who is accountable for a data set on the business side, which rules apply to it, and who decides when departments disagree. The DAMA-DMBOK, the reference work of the Data Management Association (DAMA), describes data governance as the exercise of authority, control and shared decision-making (planning, monitoring and enforcement) over the management of data assets. ISO/IEC 38505-1 (2017) places data governance within IT governance, and thus corporate governance, and addresses governing bodies directly.

Data governance is not the same as data management. Governance sets what should apply and who decides. Data management carries it out, for example in storage, integration, backup and cleansing. Data quality describes how fit the data is for its purpose. AI governance sets who in the company may do what with AI, and it depends on governed data.

Executives should care because decisions rest on data, and AI applications process exactly the data whose condition and access rights are often unclear. When two departments report different revenue figures for the same month, that is a governance problem, not a math error. Only leadership can assign accountability across departments.

The building blocks of data governance.

A data governance framework has a few building blocks, at any company size.

The first is roles with decision rights: who sets what a data set must contain, who maintains it, who runs the technology? The second is policies and standards. These include shared definitions of business terms, such as what counts as an active customer, plus formats, retention and deletion periods and a classification by confidentiality.

The third is a decision path for conflicts. If sales and accounting record a customer differently, it has to be clear who decides which system is the system of record. Many companies use a council; smaller ones name a person on the leadership team.

The fourth is metadata: an inventory of which data sets exist, where they live, who is accountable and where the data comes from. That origin trail is called data lineage. The fifth is access rights that are configured in the systems, not just written down. The sixth is data quality metrics that show whether the rules work.

If one of these blocks is missing, data governance stays a document.

Roles: owner, steward, custodian.

Three roles have become common vocabulary. The data owner is accountable for a data set on the business side. The owner sets the requirements and decides who gets access. Usually this is a manager from the area that uses the data, such as the head of sales for customer data.

The data steward looks after the data set day to day. Stewards maintain definitions, monitor quality, sort out errors with the people who enter data and trigger corrections. The data custodian runs the technology: storage, backup, access management. This role usually sits in IT or with a service provider.

In smaller companies, one person often holds several roles. That works if responsibilities are written down. A role is not a new position but a named task for existing staff, with time to do it.

A common mistake is naming IT as owner because the data sits in its systems. IT cannot make the business decisions. Data governance works when business units carry accountability and IT implements it technically.

What law and regulation require.

No law requires companies to run a program called data governance. Several obligations, however, are hard to meet without clear accountability.

Article 5(2) of the GDPR requires controllers to be able to demonstrate compliance with the data protection principles. Add the record of processing activities under Article 30 and the right to erasure under Article 17. If you don't know where personal data lives, you can neither list it nor delete it.

The EU AI Act titles Article 10 "Data and data governance." For high-risk AI systems, training, validation and testing data must be subject to appropriate data governance practices, covering among other things origin, preparation and examination for possible biases. The EU Data Act (Regulation 2023/2854) has applied since September 12, 2025 and governs, among other things, access to data from connected products. Companies offering such products need to know what data they generate.

Despite its name, the EU Data Governance Act (Regulation 2022/868), applicable since September 2023, does not regulate internal data governance. It covers the reuse of public-sector data, data intermediation services and voluntary data sharing for the common good.

Why AI makes data governance more urgent.

Gaps in data governance used to surface slowly, in reports. AI changes that: an assistant answering questions from internal documents reads everything it can access.

Three consequences are typical. First, it repeats outdated versions as convincingly as current ones if no one has defined which source is valid. Second, it shows content to people who shouldn't see it if access rights don't apply at retrieval. Third, data flows to external models if no classification says which data may leave the company. For personal data, the GDPR requires a legal basis for this and, with service providers, usually a data processing agreement.

Then there is shadow AI: employees upload company data to unvetted tools. Classifying data by confidentiality is the basis for deciding what may go into which tool.

The order follows from this. Before an AI application touches a data set, its owner, the valid source and the access rights are settled. That step belongs in the project plan and budget, not in the weeks after launch.

Centralized, decentralized or federated.

In a centralized model, one unit decides on all data sets and sets uniform rules. That creates consistency but easily becomes a bottleneck. In a decentralized model, business units govern their own data. That is fast and close to the work, but definitions start to conflict as soon as data flows between units.

In a federated model, a central unit sets a few binding standards, such as shared core terms, security rules and formats, and the units apply them to their own data. This model is common in larger organizations and also underpins the data mesh approach. No model is inherently better. The right one fits the company's size, systems and decision culture.

For mid-sized companies, a narrow starting scope works well. Start with the few data sets that decisions and costs depend on, usually customers, products, orders and financial metrics, and with the places where departments argue about numbers today. For these, set the owner, the system of record and the core terms. Maturity models show where you stand; they don't prescribe a path.

What good implementation looks like.

Good data governance shows in daily work, not in the rulebook. Every important data set has a named owner, and people know whom to ask. Core terms are defined once and used the same way in reports. Each data set has a defined system of record.

Access rights live in the systems and get reviewed regularly, not just in a policy. Conflicts between departments have a set decision path. Data quality metrics are measured and owners actually look at them. New applications, AI included, go through a check of which data they may read before launch.

On cost: the largest item is usually not software but business units' time for definitions, maintenance and coordination. Data catalogs and lineage and access tools make the work easier, but they don't make decisions. If you only budget for software, you budget past the real effort. Missing rules often cost more over time, since conflicting numbers mean new reconciliation for every analysis.

When hiring a service provider, ask how owners are named, how rights are enforced and how success is measured.

Where the term stops working

Data governance sets rules and accountability. It doesn't clean data and doesn't replace data management. It differs from data quality, which measures the condition of data, from AI governance, which governs the use of AI systems, and from the EU Data Governance Act, which despite its name concerns data sharing between organizations. Data protection is only one part of it, since data governance covers all data.