AI Governance
AI data governance: deciding what data your AI may use, and proving it
Every AI system is only as trustworthy as the data it reads. Kriv AI helps regulated organisations decide which data AI may use, trace where it came from and show reviewers the evidence, on the data platforms they already run.
AI data governance is the set of rules and controls for the data AI systems use: which data each system may access, where that data came from, whether it is accurate and current, who approved its use and how long anything the AI produces is kept. It extends ordinary data governance to cover training data, retrieval sources, prompts and outputs, so an organisation can show what its AI was working from.
what it is
What is AI data governance?
Ordinary data governance answers who owns a dataset, who may see it and whether it is accurate. AI data governance asks the same questions about every piece of data an AI system touches: the documents it retrieves to answer a question, the records an agent reads, the data used to tune or evaluate a model, and the prompts and outputs it generates.
The reason it matters is simple. When an AI answer is challenged, the first question is what the AI was working from. Without lineage and access records for its data, nobody can answer that, and the AI system cannot pass a serious review. Our AI governance framework page covers the wider structure this sits within.
why different
Data governance for AI: what changes
Four things make data governance for AI harder than for reports and dashboards.
| Change | Why it matters | What to put in place |
|---|---|---|
| New data flows | Assistants and agents pull documents into prompts that were never part of a reporting pipeline. | Decide which sources each AI system may retrieve from, and record it. |
| Unstructured data | Contracts, emails and notes carry sensitive content that column-level controls do not catch. | Classify documents before they become retrieval sources, and exclude what should not be read. |
| Generated data | Prompts and outputs are new records with their own retention and access questions. | A retention rule and an owner for AI inputs and outputs. |
| Access inheritance | An AI system can surface data a user could technically reach but was never meant to see. | Fix over-broad permissions before connecting AI, not after. |
framework
An AI data governance framework in six parts
This is the structure Kriv AI works through with clients. It is our own practice, not an external standard.
1. Approved sources
A list of the data sources each AI system may use, with an owner for each.
2. Classification
Labels on sensitive data so that AI systems, and the people configuring them, can tell what may not be used.
3. Access
AI systems read data under rules at least as strict as the people they serve, with over-broad permissions fixed first.
4. Lineage
A record of which data fed which AI system and output, so any answer can be traced back.
5. Quality
Checks that retrieval sources are current and correct, with an owner who updates or retires stale content.
6. Retention
Rules for how long prompts, outputs and logs are kept, aligned with your existing records policy.
platforms
Running AI data governance on the platforms you already have
You do not need a separate product to start. The major data platforms include governance layers built for this: Unity Catalog is Databricks' governance layer for data and AI assets, Microsoft Purview is Microsoft's family of data governance and compliance tools, and OneLake gives Microsoft Fabric a single data lake with shared governance. The work is configuring them to your rules.
Kriv AI is a Databricks partner and a Microsoft Solutions Partner for Cloud & AI Platforms · Partner ID 7036589. Our Databricks consulting and Microsoft Fabric consulting pages cover the platform builds; our page on AI governance on Azure and Microsoft 365 covers Purview configuration for assistant use.
AI in data governance
AI also helps run data governance itself: classifying documents, suggesting labels, spotting likely sensitive content and drafting data descriptions for owners to approve. As with any AI step, a person confirms the result; we build these with an owner approving classifications rather than applying them blindly.
warning signs
Signs your AI data governance has a gap
Nobody can say which sources a given AI assistant or agent retrieves from. An AI answer quoted a document that should have been restricted. A retrieval source still contains last year's policy, and the AI keeps citing it. Prompts and outputs are stored somewhere, but nobody has decided for how long or who may read them.
Any one of these means an AI system cannot yet show what it was working from. Each maps to one of the six parts above, so the fix is specific: list the sources, tighten the access, retire the stale content or set the retention rule, and give each an owner who keeps it current.
regulated
AI data governance in regulated organisations
Our focus includes healthcare, life sciences, financial services and insurance, where the data AI might read carries legal and contractual obligations. We write the data rules for each AI system to the policy and frameworks you already answer to, such as the NIST AI RMF, ISO/IEC 42001 or the EU AI Act, and to your existing data classification and records policies. Your privacy, risk and compliance functions keep the final judgement.
The first gap we look for is access: AI systems connected to file shares and mailboxes where permissions grew over years. Fixing those permissions before AI can read them is the step we put first. Staff connecting AI tools to data on their own is the other gap; our shadow AI risk management page covers it.
how an engagement runs
How an AI data governance engagement runs
1. Discovery call
We learn which AI systems you run or plan, what data they touch and which platforms hold it. Work is scoped and priced after this short discovery call.
2. Data map
We list each AI system's sources, their owners and their sensitivity, and find over-broad access.
3. Rules and configuration
We write the six parts for each system and configure them on your platforms.
4. Evidence and handover
We hand over the data map, the rules and the records your reviewers will ask for, and train the owners who keep them current.
Related resources
Continue exploring
Straight answers
Frequently asked questions about AI data governance: deciding what data your AI may use, and proving it
What is AI data governance?
It is the set of rules and controls for the data AI systems use: approved sources, classification, access, lineage, quality and retention. It extends ordinary data governance to retrieval sources, prompts and outputs, so an organisation can show what each AI system was working from when its answers are questioned.
How is AI data governance different from data governance?
The principles are the same, but AI adds new data flows, such as documents pulled into prompts, unstructured content that column-level controls miss, generated prompts and outputs that need retention rules, and the risk of AI surfacing data a user could reach but was never meant to see.
What is an AI data governance framework?
A structured set of controls for AI's data. Ours has six parts: approved sources, classification, access, lineage, quality and retention, each with an owner. It is our own practice, written to the policy and frameworks your organisation already answers to.
Do we need new software for AI data governance?
Not to start. Data platforms such as Databricks, with Unity Catalog, and Microsoft, with Purview and Fabric's OneLake, include governance layers that can be configured for AI. Dedicated AI governance tools help later with inventories and approvals across many systems.
What should we fix first?
Access. If AI systems are connected to file shares, sites or mailboxes where permissions have grown over the years, they can surface data people were never meant to see. Tighten those permissions before connecting AI, then build the source list and classification around it.
How do we govern prompts and outputs?
Treat them as records. Decide who may see them, how long they are kept and where they are stored, aligned with your existing records policy. Log them where reviewers can find them, and exclude sensitive categories from what AI systems may retain.
How much does AI data governance work cost?
Our work is scoped and priced after a short discovery call, once we know which AI systems, data sources and platforms are involved and what your reviewers require.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call