What Data Governance Covers
Privacy — Who can access what data, and under what conditions? GDPR, CCPA, and emerging AI regulations impose strict requirements on how personal data is collected, stored, and used in AI systems.
Lineage — Where did this data come from? How was it transformed? Can you trace a model’s prediction back to the data that informed it?
Retention — How long is data kept? When must it be deleted? AI training data may need to be preserved for audit purposes even after the model is deployed.
AI-Specific Governance Challenges
Training data consent — Was the data used to train the model collected with appropriate consent? Multiple lawsuits (New York Times v. OpenAI, Getty v. Stability AI) are testing this question.
Bias auditing — Does the training data systematically under-represent certain groups? If so, the model will inherit and amplify those biases.
Right to explanation — Under GDPR, individuals have the right to understand how automated decisions affecting them were made. This requires knowing what data the model used.
Critical for leaders: Data governance is not just a compliance checkbox. It’s a risk management function. The EU AI Act (effective 2025–2027) imposes significant obligations on AI systems, including requirements around training data documentation, bias testing, and transparency. Chapter 27 covers this in depth.