Governing
for Answers
The Proposal
Govern the answer, not just the dataset.
When AI turns data into fluent answers, every weakness in meaning, ownership and quality reaches people as something they believe. This paper proposes a five-pillar model that moves governance from the dataset to the answer, without abandoning the fundamentals that still do the heavy lifting.
What this paper argues
What it gives you
of AI projects unsupported by AI-ready data will be abandoned through 2026, Gartner predicts. The same research found 63% of organisations lack, or are unsure they have, the right data management practices for AI. · Gartner, February 2025
A dashboard gets questioned. An AI answer gets believed.
For twenty years, governance has had a silent partner: the analyst who spots a strange number, asks which definition applies, and checks before a figure reaches a board. AI removes that checkpoint.
Today's typical governance model struggles on all three. It is organised around structured data in a warehouse, enforced through documents and reviews, and brought in after a use case has been built. Each of those habits leaves a gap that AI exposes, and exposes at scale.
That is also the opportunity. The question the business asks is no longer “why does governance matter?” It is “can we trust what the AI just told us?” Only governance can answer that, and answering it well puts data governance at the centre of every AI programme rather than at its edge.
Every AI answer has a supply chain.
An AI answer is assembled from sources, shaped by definitions, filtered by retrieval, generated by a model following a prompt, then acted on by a person or an agent. A failure at any link reaches the user looking exactly like a correct answer.
| Link | What goes wrong | Pillar that closes the gap |
|---|---|---|
| Sources | An unowned, out-of-date document is indexed alongside the current one | Scope |
| Meaning | Three legitimate measures share one name; the model picks one silently | Meaning |
| Data in motion | A feed changes format and bad values flow through for weeks | Automation |
| Retrieval | The index returns content the person asking should not see, or an approved source that isn't the right one for the question | Scope |
| Model + prompt | A prompt is edited in production with no review or version | Scope |
| Answer | It is wrong, and no one knows whose job it is to fix it | Accountability |
| Decision | An agent acts on it, and nobody can later show why | Accountability · Assurance |
This is why the proposal is framed around answers. Each pillar governs a link in the chain; together they make the whole chain trustworthy and provable.
Five pillars on the foundations you already have.
None of the pillars replaces ownership, classification, quality or lineage. Each one takes those fundamentals somewhere AI has made them newly necessary, and each ends with a single test.
Business definitions usually live in glossaries that people rarely open. AI tools need them as working context, because a model will infer meaning from column names and whatever documents it retrieves.
A fund's investor report shows occupancy at 94%; the asset dashboard shows 89% for the same portfolio and date. One counts leases signed but not started; the other only occupied space. Both are legitimate. An AI assistant will pick one and not say which.
The AI estate is wider than the warehouse. Governance has to follow the data wherever AI picks it up: documents, prompts, vector stores and the outputs that get pasted back into reports.
A lease assistant is pointed at a shared drive. Asked about a break date, it quotes “Lease_v3_FINAL”, an unsigned draft. The executed lease sits in a subfolder the index never reached. Nobody owned the folder.
Policies written in documents cannot keep pace with AI. Rules have to run where the data moves, and critical failures have to stop bad data rather than describe it afterwards. Governance defines the rule; engineers make it executable.
A property manager changes its rent roll export and one building's rent arrives monthly instead of annually. It flows into the valuation model and investor pack for six weeks. A range check on rent per square foot would have stopped it on day one.
Data owners are accountable for inputs. Someone must also be accountable for what the AI does with them, or a wrong answer becomes everyone's problem and nobody's job.
An AI-drafted investment committee paper overstates a portfolio's WAULT by 1.4 years. The data team says the data is right, the AI team says the model summarised what it found, and the deal team says it doesn't own the tool.
Regulators, auditors and investors will ask for proof. The cheapest proof is the kind the other four pillars create automatically, as the work happens.
An investor's due diligence questionnaire asks which AI tools touch valuation and reporting data, who approved them and how they are monitored. Answering takes six weeks and four teams. With evidence captured by default, it takes days.
One question sets the risk tier.
What is the worst a wrong answer could do? Governance effort should follow the answer. A team summarising meeting notes should not wait weeks for a review; a model supporting credit or hiring decisions should never skip one.
“Wrong” covers four things: wrong content, a correct answer shown to the wrong person, a correct answer built on data used out of context or on the wrong source, and an action an agent should not have been allowed to take.
| Tier | What a wrong answer could do | Example | Gate before go-live |
|---|---|---|---|
| Low | Cause internal inconvenience that a person would spot | Summarising meeting notes | Self-certify against a short checklist |
| Medium | Mislead a business decision | Portfolio analytics assistant | Review by the domain's governance lead |
| High | Affect customers, investors, employees, financial reporting or a regulated decision | Tenant screening, investor reporting, valuations | Full review, impact assessments and senior sign-off |
If the AI acts on its own, move it up a tier. An agent that sends, changes or approves things without a person checking carries more risk than one that drafts for review. Likely high-risk under the EU AI Act means high. If it can reach restricted or sensitive personal data, it is at least medium. Re-tier when the model, the sources, an agent's permissions or the use of its output change.
Familiar roles, new responsibilities, and two new ones.
Governance should be designed into AI use cases at the start, not reviewed at the end.
| Role | Accountable for | What changes in the AI era |
|---|---|---|
| Data owner | Quality, access and meaning of a data domain | Includes documents and knowledge sources, not just tables |
| Data steward | Definitions, classification and issues | Maintains the definitions AI will use; triages flagged answers |
| AI use-case owner · new | An AI use case: deploying it, its controls and getting failures fixed | Owns the purpose, the prompts and the approved sources; makes sure the right owner fixes a wrong answer |
| Agent owner · new | What an agent is allowed to do, and what it does | Sets its permissions and limits, and can switch it off |
| Data and platform engineers | Pipelines, contracts and platform controls | Build checks, contracts and policies as code |
| Governance office | Framework, standards and assurance | Defines the rules; runs the gate, the inventory and the evidence |
| Risk, legal and compliance | Regulatory interpretation | Confirms tiers; maps controls to regulation |
Every new AI use case follows the same light path:
The deadline moved. The work didn't.
The EU's Digital Omnibus on AI (Regulation (EU) 2026/1744) came into force on 27 July 2026. It deferred the heaviest high-risk obligations and left others on their original dates.
Transparency duties under Article 50 apply by function rather than risk, so chatbots and content generators are in scope now. Annex III covers areas such as employment, credit and insurance, where many firms already use AI. Treating the delay as a reason to pause inventory and classification would be a mistake: that work is slow, and it is squarely governance's job.
This section summarises public sources and is not legal advice. Firms should confirm their position with their own legal and compliance teams.
Twelve months from inventory to evidence.
The first 90 days are about visibility: you cannot govern AI you haven't found. Controls and assurance follow, each unlocked by a simple gate.
— Certify critical definitions
— Owners for AI sources
— Baseline the measures
— Blocking checks in pipelines
— Risk-tiered gate live
— Answer flags routed to owners
— Controls mapped to regulation
— Evidence captured automatically
— Review and refresh the model
Gate one: every live AI use case and agent is in the inventory with a named owner. Gate two: no high-risk use case can reach production without passing the review.
Measure trust, not paperwork.
Each pillar gets one or two measures, baselined in the first 90 days. Set targets locally: a number borrowed from another organisation says little about your own starting point.
| Pillar | Measure | Direction |
|---|---|---|
| Meaning | Critical metrics with one governed meaning linked to source columns | Up |
| Scope | Live AI use cases and agents in the inventory with a named owner | Up, to 100% |
| Scope | AI knowledge sources with an owner, an in-date review and a stated authority | Up |
| Automation | Critical quality rules running automatically in pipelines | Up |
| Automation | Incidents caught by a check before they reach an AI answer | Up |
| Accountability | Median time from a flagged AI answer to a fix at source | Down |
| Assurance | Time to produce evidence for one use case on request | Down |
A proposal is only credible if it names its weak points.
Open questions for the community
Version 1.1 was shaped by challenges from Jess Baker, whose questions on metric identity, source authority, who builds the rules and where accountability sits changed the Meaning, Scope, Automation and Accountability pillars. Contributors are credited in a personal capacity. The views, and any errors, are the author's.
“In practice” examples are illustrative scenarios drawn from commercial real estate and investment management, not accounts of specific organisations.
This is a working draft.
Challenge it.
The most useful feedback is disagreement: where a pillar is missing something, where the maturity levels don't match reality, and where this model would fail in your organisation. Comment on the LinkedIn series or message me directly. Contributors will be credited in the next version if they wish.
Comments
Tell Duncan what you think: what works, what is missing and what you would change.