AI governance: Data governance gone wild

I have wasted my life. Having started the data governance program at a large technology company nearly 10 years ago, I spent countless hours, enormous effort and most of my political capital begging people to tighten up their metadata. 

Enter data into catalogs. Label it. All in a sincere but misguided effort to apply governance rules and policies at scale. With the advent of artificial intelligence, none of that matters anymore. 

AI doesn't completely erase that past governance work, but it removes any tolerance for inconsistency. Worse, AI doesn't forgive governance debt. It amplifies it.

While governance and compliance teams have refined policies, the business has moved on. Part of this is an intense aversion to anything that sounds like slowing down. Our job as governance practitioners is to listen empathetically first — to the policy wonks with their lists of regulations, to the product engineers in their T-shirts and shorts and to the executives who passionately defend their positions. Once I listened, I was able to synthesize the complexity and see clearly.

AI governance is not uniquely challenging. It's exposing the governance gaps that were always there. 

The paradox is that the key to governing AI isn't in the tools or the frameworks — it's in people and personalities, proximity and persuasion. AI governance isn't about slowing AI adoption down. It's about speeding it up within a defined channel.

People, proximity and persuasion

Governance lives or dies on people. Not governance people, but those the governance must reach. The product manager who thinks compliance is a future problem. The data engineer who labeled a dataset "asdf" at 11 p.m. on a Friday because the pipeline wouldn't wait and his kid was crying. The vice president who greenlit a generative AI feature because the competitor already shipped one. 

These aren't bad or malicious actors. They are busy people trying to provide for their families and good governance isn't part of their incentive structure. If your governance program isn't designed around human behavior and meeting people where they are, it will fail, regardless of how elegant the framework is.

Proximity is the one that took me longest to learn and the most ambiguous. For years, I sat in my ivory home office and operated at arm's length from the people building things, churning out deck after deck of "governance playbooks." 

Policies and playbooks went out. Compliance went sideways. The turning point came when I stopped sending documents and started making friends in places I didn't naturally belong. I showed up in sprint reviews, in architecture discussions, in the rooms where product decisions actually get made before they're announced. 

Something shifts when governance is present at the inception rather than wagging my finger and arriving after the fact. Engineers start asking governance questions themselves. Not because they're required to, but because a trusted colleague is standing next to them who makes it easier to do the right thing than to skip it. Proximity turns governance from a tax into a resource.

Persuasion is where most governance practitioners underinvest because they assume the regulations will do the work for them. They won't. Telling an engineering team that they need to comply with some regulation lands about as well as telling my teenager to make his bed because it's the right thing to do. 

What actually works is connecting governance requirements to outcomes the other person already cares about. Engineers care about systems that don't break in production, so governance becomes reliability. Product managers care about shipping without getting pulled back, so governance becomes risk clearance. Executives care about not ending up in a Senate hearing, so governance becomes insurance. Same requirement, three different conversations. All of them true. All of them governance.

Governance as accelerant

Governance is not a control function. It is a product. It accelerates innovation by channeling efforts with guardrails. I like to spray my kids with a hose and they like to run away from it.  When they run away, I press my thumb over the opening and it sprays farther so I can still reach them with minimal physical output.  

Governance is the thumb on the hose, creating that channel to speed up the flow. The water — and, metaphorically, data — moving through that channel moves faster, farther and with purpose. AI without governance is the first scenario. Lots of water pouring out, but all falling onto the ground and getting my shoes muddy. AI with governance is the second, powerful force with targeted flow and increased speed.

What does that actually look like in practice? It looks like an engineering team continuing their revenue generating development without stopping to ask legal whether they can use a dataset. Governance already classified it, cleared it and made it discoverable in 30 seconds. It looks like a product launch that doesn't get delayed six weeks by a last-minute privacy review. Governance was in the room when the feature was designed, not when it was ready to ship. It looks like a compliance audit that takes days instead of months. Governance already ensured that documentation exists, maintained as a byproduct of how the team works, not assembled in a panic afterward. 

Good governance creates the conditions under which smart people can move fast without breaking things that matter.

None of this is easy. It requires governance practitioners to give up the comfort of the ivory office. The warm embrace of policy documents, quarterly committee meetings and frameworks that look comprehensive on paper, but have no operational presence in the places where decisions actually get made. It requires organizations to resource governance as a function that enables the business, not one that audits it after the fact.

What happens if we don't

Here's the uncomfortable truth: AI doesn't slow down while this is figured out. Models are being trained on ungoverned data at organizations literally right now. Decisions are being made by systems nobody fully understands, with accountability structures that exist on paper and nowhere else. The gap between the governance program an organization has and the one it needs is being measured by regulators, customers and eventually courts.

I started out by saying I wasted my life. That's not necessarily true. The decade I spent trying to get people to label their data correctly taught me everything I needed to know about how organizations actually behave around governance. Nobody says no to governance until you ask them to do something. When their rubber met my road, they had no reason to comply. AI is that reason. Not because it's a new problem, but because it makes the old problems impossible to ignore.

The practitioners who figure out how to govern AI without killing it will be the most valuable people in any technology organization over the next decade. Learn to listen before legislating; embed before auditing; persuade before mandating. Robots are, ironically, teaching us that we need to focus on people to be effective. That's not a prediction. It's already happening right now. 

In another 10 years I hope to look back and realize that it wasn't the governance that was the reward, it was the friends I made along the way. Don't spend a decade finding that out the hard way. Build the program now. The business, its customers and regulators will not wait.