Data governance used to mean documented rules and audit trails that can tell us what happened when. But that is no longer enough when organisations give decision-making capabilities to
AI agents.
To roll out AI with confidence, organisations must be able to trace, explain and – crucially – prevent AI from taking undesirable decisions. That means adding decision governance on top of data governance.
Here's what that looks like and how your organisation can start turning data governance into decision governance.
What happens when AI moves from recommending to acting
According to our recent
CIO Compass report, fewer than 25% of AI-driven decisions in production can be traced, audited and replayed from start to finish to the standard expected of critical IT transactions. And fewer than 20% of AI-driven decisions have a named business owner, explicit decision rules and formal accountability.
In other words: AI is already running, approving, flagging, ranking and routing decisions, often without anyone being clearly “in charge” or able to explain why a certain decision was taken.
This gap increases as AI moves from recommending to acting. When a person makes a mistake, the impact tends not to spread too far. But with agents now able to plan, call up tools and take actions across systems at machine speed, any error spreads further and faster. Our report estimates that automated decision failures can affect 10 to 100 times more operations, customers or revenues than traditional IT incidents.
Shadow AI is exposing the limits of data governance
Most “old-school” data governance comprises documents, catalogues, quality rules and access rights that have been designed to meet regulators’ and auditors' requirements. But a rule in a manual only guides an AI agent if it’s built into the systems the agent works in. If outdated guidelines are among the documents an agent is trained on, it may follow them to the letter.
This challenge is made worse by the rise of “shadow AI” in organisations. This is where enthusiastic employees bundle together unproven tools, do-it-yourself prompts and unofficial data, and fine-tune models that IT doesn’t know about and risk teams therefore cannot assess. It can also find its way in through new features in tools your organisation already uses, such as HR platforms.
When shadow AI creeps in, the organisation starts using AI without knowing about it, and by the time it comes to light, traceability, cost control and sovereignty have been lost.
The effect is to redefine the role of governance, from having a policy on AI to whether you can trace what the system is doing and stop it in its tracks. The latter is the acid test, because if you can't trace or stop your AI in real time, you have no control over it. This is where decision governance comes in.
From data governance to decision governance
Decision governance starts by sorting the decisions AI handles into three groups:
- Those that can be automated end to end
- Those that must stay under human supervision
- Those that should never be handed to a machine
Each of these decisions also needs a named business owner who is responsible for it.
Those companies that are leading decision governance do several things differently, including focusing governance on outcomes, not assets, governing what matters for measurable business performance, and employing exception-based controls.
Decision governance by design
Their starting premise is that they build control directly into how processes work rather than bolting it on afterwards, around a process. In concrete terms, they:
- Build governance into how they design their data and AI systems from the beginning
- Translate rules into automated controls
- Reject AI systems that are not traceable, observable or lack access/action control
- Use AI to accelerate governance through, among other things, automation and anomaly detection
- Treat important datasets like products, complete with owners, clear definitions of what they contain, and an agreed standard for quality and availability, so that the AI systems using them always get the data in the format they expect
- Don’t assume that performing a single large data clean-up will be enough to ensure control
Focus on measurable outcomes
Finally, organisations with successful decision governance models also measure progress:
- The share of AI models trained on certified data
- The share of automated decisions that can be audited from end to end
- The number of AI incidents caused by data problems
- How long it takes to document a model during an external audit
Where to start with decision governance
The key thing to remember is that data governance and decision governance must operate hand-in-hand. The former makes data usable while the latter gives owners and rules to the decisions AI makes so they can be traced and stopped. Decision governance makes AI pay off by creating systems that can be trusted, validated and scaled safely.
Here are some steps you can take to start turning data governance into decision governance.
- Focus governance efforts firstly on tasks that directly support business priorities.
- Fuse data and AI governance, because the latter is the extension of the former. It is especially important to avoid silos, as an AI agent is only as good as the data it draws on.
- Name data product owners who will be accountable for quality and fitness-for-use, because bad data captured today becomes a failed automated decision tomorrow.
- Focus less on locking down data, and more on making reliable data easy to access for the right people, so innovation can happen without excess risk.
- Ensure every AI decision can be traced back to its original data sources for auditability.
- Prove the approach with a small pilot: deploy one agent on a narrow but fully governed task to show that control and speed can go together.
Get support to govern AI with confidence
Our experts help organisations assess where their data and AI governance stands today, map the decisions AI already makes and the risks they carry, and build controls into processes and platforms by design.
Explore extensive insights from our experts in our CIO Compass series.
Want to know where your organisation stands? Talk to us.