Did AI break data governance?

1. The Governance Inheritance

Legacy data governance was designed for a specific industrial problem: Enterprises had accumulated data across a handful of systems of record, that data increasingly mattered for regulatory reporting and analytics, and the humans producing and consuming it were losing track of what it meant, where it came from, and who owned it. The question of the 2000s and early 2010s was "do we have data integrity," and the fear was regulatory exposure under Sarbanes-Oxley, PCI, HIPAA, and later GDPR. Governance was, in its origins, a program to bring documentation, ownership, and quality assurance to a set of relatively stable, relatively slow-moving data assets.

The frameworks that shaped this era encoded assumptions consistent with that problem. DAMA-DMBOK, first published in 2009 and revised in 2017, organized governance around eleven knowledge areas with data governance as the coordinating function at the center. The Data Governance Institute framework, associated with Gwen Thomas, formalized the council-and-steward pattern that most Fortune 500 programs still run today. ISO 8000 addressed data quality with a precision that assumed data was something you could measure against a specification. CDMC, published by the EDM Council in 2021, extended the frameworks into cloud environments and introduced the language of key controls, but preserved the underlying operating model. NIST AI RMF, released in January 2023, added a parallel discipline for AI systems but was explicitly designed as a voluntary risk management framework rather than a governance operating model. ISO/IEC 42001, published in December 2023, gave organizations a certifiable AI management system standard but again layered on top of the existing governance stack rather than reforming it. It has to change.

What the legacy model got right deserves to be said clearly. It established that data is a strategic asset, not just a technical byproduct. It named accountability by creating owner and steward roles that survived reorganizations and audit cycles. It produced defensible artifacts, glossaries, data dictionaries, quality scorecards, and control matrices, that gave organizations something to hand to regulators and something to point to when incidents occurred. It created a common vocabulary across IT, business, and audit, which is not a small thing in enterprises where those functions historically did not share language or terms. And it embedded the discipline that some decisions about data belong to the business, not to IT, which is a real truth the AI era is pulling at all directions, all at once.

Four structural assumptions in the legacy model no longer hold. First, the assumption that data velocity is bounded and human-reviewable. Legacy governance was designed for data that flowed in known pipelines and was reviewed on quarterly or annual cadences. AI systems produce, transform, and consume data at machine speed, and increasingly on paths the governance office did not design. Second, the assumption that a central council can adjudicate the meaningful decisions. When governance decisions numbered in the hundreds per quarter, a council was sufficient. When they number in the thousands per week and increasingly per hour, adjudication centralization is a physical impossibility. Third, the assumption that policy is a document. Written policy in Word or SharePoint was fit for a world where humans applied it. In a world where agents act on data, policy that is not machine-readable is policy that is not applied. Fourth, the assumption that governance is a compliance function that mediates between the business and its regulators. In the AI era, governance is a competitive function that mediates between the business and its ambitions. Organizations that treat it as the former will lose ground to those that treat it as the latter. There is a fifth assumption worth naming, though it is more subtle: the assumption that data governance and AI governance are separate disciplines. They are not. They are the same discipline observed at different points in the data lifecycle, and the organizations that keep them separate will produce two councils, two policy stacks, and twice the friction instead of reducing what's there.

Legacy governance did what its era asked of it, but four of its foundational assumptions no longer describe the world it operates in today.

2. The Break Point

The obvious argument is that AI has made data move too fast for quarterly review cycles. That argument is correct but there's more. The more precise diagnosis is that AI has revealed a structural mismatch between where decisions need to be made and where authority to make them has been vested. Legacy governance concentrated decision authority in a central council that met on a periodic cadence and adjudicated exceptions and policy changes. That worked because the volume of consequential decisions was low enough to fit the cadence. What AI has done is not merely accelerate the volume, it reveals the characters of the decisions being made.

Consider the shift in decision character. A legacy governance council adjudicated questions like "can Marketing access the customer master data set for a segmentation project," and the question stayed adjudicated for months or quarters. An AI-era decision looks like "can this specific prompt to this specific model include this specific customer's data in this specific context at this specific moment." The decision is scoped to an event, not a project. The right authority to make it is close to the event, not close to the council. And the volume of such decisions in a mid-size enterprise runs into the tens of thousands per week once Copilot, agents, and internal AI workflows are broadly deployed.

The break point, then, is not speed alone. It is the mismatch between decision character and authority location. Legacy governance is centralized because the decisions were consequential and infrequent. AI-era decisions are consequential and frequent, which requires federation with earned autonomy, not centralization with periodic adjudication.

The empirical evidence supports this diagnosis. Gartner has been publishing since 2023 that data and analytics leaders identify governance as the top barrier to AI adoption, and that percentage has risen year over year. IBM's Institute for Business Value produced survey data in 2024 indicating that fewer than a quarter of enterprises had governance frameworks they considered fit for generative AI. The Cloud Security Alliance's 2024 State of AI and Security Survey reported that shadow AI usage in enterprises significantly exceeds sanctioned AI usage, which is itself a governance signal: when the sanctioned path is too slow, employees route around it. The EU AI Act, entering force in phases through 2025 and 2026, introduces obligations on data governance for high-risk AI systems that assume documented, current, machine-verifiable data provenance and quality, which no legacy governance program actually produces at that fidelity. The Colorado AI Act, effective February 2026, imposes similar duties at the state level in the United States. Multiple 2024 enforcement actions by state attorneys general and the FTC involving AI-driven consumer harms cited failures of data governance as contributing factors.

The contrarian framing worth taking seriously is this: the break point is not primarily about AI. AI is the accelerant, but the structural weakness in legacy governance was already visible in the failure of most Fortune 500 programs to demonstrate durable value between 2010 and 2020. Sorry, not sorry. A significant portion of enterprise data governance programs, by industry estimate, were either abandoned, re-scoped to compliance-only, or delegated to individual business units within five years of launch. AI has forced the reckoning, but the reckoning was already coming so we shouldn't act so suprised. We also mustn't implement "a AI governance layer to the existing program." The solution is to reform the operating model the AI moment has exposed as inadequate, and to do so in a way that serves the underlying business need governance was always supposed to serve. And yes, while reducing risk for the organization at the same time.

The corollary is that organizations treating this as an AI problem will produce an AI governance committee bolted onto the side of a broken data governance program, doubling the friction without solving the structural issue. Organizations treating this as a governance reform problem, with AI as the forcing function, will emerge with a single operating model that serves both.

The break point is not that AI is fast. It is that AI has exposed a decision-authority topology that was already misaligned with the work.

Next in this series: Part two describes the reformed operating model across eight dimensions, the roles it requires, and the rhythm it runs on.