Data governance stopped being compliance and became capability

Governance has spent a decade being the thing that slows delivery down. Every AI programme I have watched has quietly inverted that.

The teams moving fastest are not the ones with the best models. They are the ones who could answer "where does this data come from and who is allowed to see it" without convening a meeting.

Why the old framing accumulates debt

Treating governance as a gate means it gets applied at the end, to a thing already built. So it discovers problems at the most expensive possible moment and earns its reputation.

Retrieval makes this acute. The moment a model can pull from a corpus, every access-control question you deferred becomes a live one — and it becomes live at inference time, per request, per user.

That middle step is the one people miss. Ungoverned data does not just create a compliance risk — it forces you into exactly the unfiltered-volume pattern that degrades answer quality.

The reality on the ground

Lineage lets you scope retrieval. Classification lets you filter it. Freshness metadata lets you tell a model which facts expire — which is the single cheapest mitigation for an entire class of failure.

None of that is compliance work that happens to help AI. It is AI enablement that happens to satisfy compliance.

Where the sceptics are right

Governance programmes absolutely do calcify into documentation exercises that produce a catalogue nobody reads. I have seen more of those than the good kind.

The test is whether the output is machine-readable at inference time. A catalogue a human consults is compliance theatre. A classification your retrieval layer can filter on is capability.

If your governance artefacts cannot be queried by your retrieval layer, you built a library, not a control.

Can your retrieval layer read your data classifications at request time — or does a human have to?

Related