On Thursday 22 October 2026 I spent the day at the Royal Armouries Museum in Leeds. I delivered 3 training workshops in The Bury Lecture Theatre which is a purpose-built, self-contained, air-conditioned lecture theatre over two tiers. It accommodates between 70 to 250 delegates in cinema style seating.
Chaos, complexity, curiosity and database systems. A place where research meets industry
Welcome
"The important thing is not to stop questioning. Curiosity has its own reason for existing" Einstein
Saturday, 24 October 2026
Data and AI governance in real life
Tuesday, 6 October 2026
Data Analytics Monthly Forum
- Why AI success depends on trusted and high-quality data.
- The growing importance of AI governance and emerging standards such as the EU AI Act.
- How data quality impacts AI performance, reliability and outcomes.
- How Microsoft Purview can help bring governance, security and compliance capabilities together.
- Practical approaches to identifying and managing AI related risks.
Thursday, 17 September 2026
Responsible AI in 2026: Governance Moves from Principle to Practice
Microsoft's latest article, Responsible AI in 2026: How We Are Adapting for What's Ahead, highlights something many of us working in governance have been seeing for some time: AI governance is no longer a future concern. It is becoming an operational necessity.
As AI capabilities continue to accelerate, particularly with the rise of agentic AI, the governance challenge is changing. Traditional governance approaches were largely focused on data, systems, and applications. Increasingly, organisations must also govern autonomous actions, agent interactions, tool permissions, and dynamic decision-making processes. Microsoft describes this as a move towards more adaptive governance, where controls evolve alongside the capabilities and risks of AI systems.
What I found most interesting is that the article places relatively little emphasis on the models themselves and much more emphasis on governance, risk management, monitoring, and assurance. Microsoft explicitly states that model capability alone will not determine AI's impact. Success will depend on whether organisations can govern AI with the rigour and adaptability needed to earn trust.
This mirrors a trend I am seeing across the market. Many organisations are still focused on AI adoption, Copilot deployments, and proof-of-concepts. However, the harder question is emerging quickly: how do we maintain visibility, accountability, and control once AI becomes embedded in day-to-day operations?
The answer is unlikely to be found in technology alone. Microsoft's report discusses governance frameworks, risk management processes, evaluation capabilities, training, standards, and industry collaboration. These are all governance disciplines rather than purely technical controls.
For data governance professionals, this should sound familiar. The foundations that organisations have spent years developing around ownership, accountability, quality, security, and compliance are becoming even more important in an AI-enabled world. AI governance is not replacing data governance. It is extending it.
Perhaps the most significant message from the article is that responsible AI cannot be treated as a static policy document. Microsoft describes governance as a continuous lifecycle activity that must evolve as systems learn, interact, and operate in increasingly complex environments. That is a valuable lesson for every organisation currently exploring AI. The conversation is no longer about whether governance matters. The conversation is about whether governance can keep pace with AI's rapid evolution.
As Microsoft's latest transparency report demonstrates, the organisations most likely to succeed with AI will not simply be those with access to the best technology. They will be the organisations that can combine innovation with trust, control, and effective governance.
References
https://blogs.microsoft.com/on-the-issues/2026/09/01/responsible-ai-in-2026-how-we-are-adapting-for-whats-ahead/
Tuesday, 15 September 2026
Governance must keep pace with AI and be embedded in every stage
Over the last few weeks, the conversation around artificial intelligence has taken an increasingly dramatic turn. Following Dario Amodei's essay, We Must Pace the Frontier, and widespread media coverage of warnings from researchers and technology leaders, discussions about AI have become dominated by questions of existential risk, cyber warfare, loss of control and the possibility that advanced systems could outpace human oversight. Amodei's central argument is that the rate of AI capability development may be accelerating faster than our ability to understand, govern and safely manage those capabilities, creating a situation where precaution needs to catch up with progress.
These AI fears made me think of pushing beyond design limits where Donald Campbell’s final attempt in 1967 on Coniston Water pushed Bluebird K7 past 300 mph far beyond its original design rating of 250 mph. This pushing technological boundaries to shatter another world record, demonstrated that accelerating past design limits without evolving the safety framework exposes fatal vulnerabilities.
While these concerns deserve serious consideration, I have
been struck by how many of the proposed solutions focus on slowing AI itself.
The assumption seems to be that if technology advances too quickly, the safest
response is to reduce the speed of innovation until regulators, policymakers
and society have time to react. However, I am not convinced that slowing AI
addresses the underlying issue. The problem is not that artificial intelligence
exists or that organisations are finding new ways to apply it. The problem is
that governance continues to lag behind technological change, despite decades
of evidence showing that this always creates unnecessary risk.
Every major technological shift follows a remarkably similar
pattern. Organisations become excited by new capabilities, investment
accelerates, adoption grows rapidly and governance is treated as something that
can be addressed later. Eventually the consequences of that approach become
visible, whether through security incidents, compliance failures, poorly
understood risks or loss of trust. The discussion then turns towards
regulation, controls and accountability. What is often forgotten is that governance
could have been embedded from the beginning.
The current debate around AI increasingly focuses on the
possibility that advanced systems may one day become difficult to control. Yet
many organisations are already struggling with far more immediate challenges.
They do not know who owns critical datasets. They cannot consistently identify
authoritative information. They have limited visibility of the quality of the
data entering analytical platforms. They have duplicated reports, conflicting
definitions and inconsistent security controls. These are not theoretical
future concerns. They are today's governance problems, and AI simply amplifies
them.
This is one of the reasons I find the current distinction
between data governance and AI governance increasingly key. AI
governance is undoubtedly important, particularly as organisations begin
deploying copilots, autonomous agents and decision-support systems. However,
the majority of the risks associated with AI are ultimately rooted in issues
that data governance has been trying to solve for years. Questions about
ownership, accountability, transparency, lineage, quality, security and trust
do not suddenly appear because an organisation deploys an AI model. Those
questions already existed. AI merely exposes them more quickly and at greater
scale.
Consider the current wave of Microsoft Copilot deployments
taking place across both public and private sector organisations. There is
understandable excitement about productivity gains and new ways of working, but
Copilot does not create knowledge. It surfaces what already exists inside the
organisation. The challenge is the state of the information environment that AI is consuming.
What concerns me most is that governance is still frequently discussed as if it were a specialist discipline owned by a single team. The reality is that the next generation of technology will make that approach increasingly difficult to sustain. As organisations move towards more autonomous forms of AI, governance decisions will need to be incorporated directly into project delivery, operational processes, architecture reviews, software development lifecycles and technology investment decisions. It will not be sufficient to maintain a separate governance workstream running alongside change initiatives. Governance will need to become a fundamental characteristic of how change is delivered.
This becomes particularly important when considering the
rise of agentic AI. Much of today's governance discussion focuses on whether an
AI model is accurate, fair or explainable. Those questions remain important,
but autonomous systems introduce an entirely new set of concerns. Organisations
will need to understand who is accountable for actions taken by an agent, what
permissions it possesses, how its behaviour is monitored, when human
intervention is required and how decisions are audited. These challenges cannot
be resolved through model governance alone. They require broader governance
frameworks that connect business ownership, risk management, security and
information management.
For this reason, I believe the debate about whether we
should slow AI down is asking the wrong question. The more important question
is whether governance can evolve quickly enough to keep pace with innovation.
History suggests that organisations are capable of managing significant
technological change when appropriate governance structures are embedded from
the outset. We have done this with financial controls, health and safety,
privacy, cyber security and regulatory compliance. None of these disciplines emerged
because organisations stopped innovating. They emerged because innovation
required new forms of oversight and accountability.
If the concerns raised by Dario Amodei prove justified, then
the answer is unlikely to be found solely through reducing the pace of
technological development. The more sustainable response is to ensure that
governance develops at the same speed as the technologies it is intended to
support. Data governance, AI governance, security governance and risk
management should not be viewed as separate initiatives competing with
innovation. They should be recognised as the mechanisms that make innovation
sustainable.
The future of AI will undoubtedly introduce challenges that
we have not yet anticipated. However, organisations do not need to wait for
hypothetical existential threats before they strengthen governance. The
foundations are already well understood. Ownership, accountability,
transparency, stewardship, good data quality, security and trust remain as relevant today as they
were before the first large language model entered the public consciousness.
The difference is that AI has transformed these disciplines from desirable good
practice into essential business capabilities.
The organisations that succeed over the next decade will not
necessarily be those that adopt AI first or deploy the greatest number of
models. They will be the organisations that recognise governance as an enabler
of innovation rather than a constraint upon it. In a world where AI is becoming
embedded into every platform, every process and every decision, governance must
become equally pervasive. The challenge is not slowing AI down. The challenge
is ensuring that governance finally catches up.
References
We Must Pace the
Frontier https://darioamodei.com/post/we-must-pace-the-frontier
The Guardian — “‘We must slow the pace’: CEO of Anthropic
calls for an AI slowdown
TechRepublic — “Altman, Musk Back Amodei’s AI Warning: The
Frontier May Be Moving Too Fast” https://www.techrepublic.com/article/news-amodei-altman-musk-slow-frontier-ai/
BBC Why are there concerns AI could threaten humanity,
and how real are they? https://www.bbc.co.uk/news/articles/c790xvnzgnno
BBC AI 'kill switch' may need to be mandatory,
Anthropic co-founder tells
BBC https://www.bbc.co.uk/news/articles/cqgk5e2j0gg8o
BBC Anthropic researcher believes more than 10% chance AI 'could kill all humans' https://www.bbc.co.uk/news/articles/ckgwy1k42w4o
Building AI for Human Flourishing: Inside Microsoft’s Humanist AI Code of Conduct
- Human Control & Safety — AI must remain subordinate to humanity, never resisting shutdown, redirection, or oversight. Safety constraints cannot be overridden by users or operators.
- Clear Boundaries — Models will not assist with weapons, mass harm, offensive cyberattacks, manipulation at scale, or any content that violates human dignity or child safety.
- Human Flourishing — AI should enhance learning, creativity, collaboration, and wellbeing, helping people make better decisions without replacing personal growth or human relationships.
- Pluralism & Inclusion — AI should support diverse cultures, values, and perspectives while upholding universal human rights and avoiding harmful bias.
- Transparency & Public Input — Microsoft is inviting global feedback to refine the Code before it becomes the governing blueprint for model development in 2027 and beyond.
Tuesday, 8 September 2026
The Hierarchy of AI Oversight
- Responsible AI defines organizational intent and boundaries.
- AI Governance establishes operational execution and control mechanisms.
- Data Governance manages the underlying assets and pipeline inputs.
- What operational boundaries define acceptable versus unacceptable AI deployments?
- What specific harms must system designs actively prevent?
- What baseline commitments are required for external stakeholders and regulatory bodies?
- Which roles hold approval authority at distinct stages of model development?
- What quantitative evidence is required prior to production deployment?
- How are performance degradation, bias drift, and unexpected edge cases detected and remediated?
- What specific conditions trigger a mandatory model recall or pause?
- What is the precise lineage and chain of custody for training and validation datasets?
- Do clear usage rights, legal bases, and consent frameworks exist for the ingested data?
- Is the dataset representative, accurate, and properly versioned?
- How are data access controls and privacy-preserving techniques maintained through the pipeline?
- Oversight committees evaluate systems without reliable technical lineage or performance data.
- Data quality defects and unverified assumptions are identified late in production rather than during ingestion.
- Ambiguity surrounds technical accountability when failures occur.
- Defining ethical principles without establishing underlying governance frameworks leads to superficial compliance—where policy commitments exist on paper but cannot be verified or enforced at the engineering level.
- Establish Data Integrity: Secure data lineage, document legal rights, enforce validation checks, and maintain clear data stewardship across all pipelines.
- Deploy Control Architectures: Implement repeatable stage-gate approvals, continuous testing protocols, risk logging, and lifecycle monitoring.
- Align Operational Controls with Policy Boundaries: Connect technical metrics and threshold alerts directly to high-level organizational principles and regulatory requirements.
Thursday, 3 September 2026
Governance Capabilities for High-Risk AI in the EU AI Act
This becomes particularly clear when looking at Articles 8-15. Rather than a collection of disconnected requirements, these articles describe a connected operating model. They bring together governance, risk management, data quality, transparency, human oversight, documentation, and security into a framework that supports trustworthy AI throughout its lifecycle.
The infographic accompanying this article visualises those capabilities as a connected system rather than a sequence of isolated controls. Before exploring each capability, it is worth understanding where Articles 8-15 sit within the broader structure of the AI Act.
This becomes particularly clear when looking at Articles 8-15. Rather than a collection of disconnected requirements, these articles describe a connected operating model. They bring together governance, risk management, data quality, transparency, human oversight, documentation, and security into a framework that supports trustworthy AI throughout its lifecycle.
The infographic accompanying this article visualises those capabilities as a connected system rather than a sequence of isolated controls. Before exploring each capability, it is worth understanding where Articles 8-15 sit within the broader structure of the AI Act.
The Risk-Based Foundation of the EU AI Act
The EU AI Act adopts a risk-based approach to regulation. Rather than treating every AI system equally, it classifies systems according to the level of risk they present.
At the top of the pyramid are applications considered to represent an unacceptable risk. These uses are prohibited because they are considered incompatible with European values and fundamental rights. Below this sit High-Risk AI Systems, which are subject to the most extensive governance requirements. Beneath these are Limited Risk and Minimal Risk systems, where obligations are significantly lighter.
This distinction is important because Articles 8-15 are primarily concerned with the governance capabilities required for High-Risk AI Systems. They define what organisations must have in place to demonstrate that these systems are designed, operated, and monitored appropriately.
The EU AI Act adopts a risk-based approach to regulation. Rather than treating every AI system equally, it classifies systems according to the level of risk they present.
At the top of the pyramid are applications considered to represent an unacceptable risk. These uses are prohibited because they are considered incompatible with European values and fundamental rights. Below this sit High-Risk AI Systems, which are subject to the most extensive governance requirements. Beneath these are Limited Risk and Minimal Risk systems, where obligations are significantly lighter.
This distinction is important because Articles 8-15 are primarily concerned with the governance capabilities required for High-Risk AI Systems. They define what organisations must have in place to demonstrate that these systems are designed, operated, and monitored appropriately.
Governance and Accountability
Effective AI governance starts with accountability.
Although Article 8 focuses on compliance with the requirements applicable to high-risk systems, this is closely linked to the Quality Management System requirements described later in Article 17. Together, they establish the expectation that organisations must have clear governance structures, defined responsibilities, documented processes, and mechanisms for continuous improvement.
This is often where governance discussions become overly procedural. In practice, what matters is whether accountability exists. Who owns decisions? Who approves risk acceptance? Who monitors outcomes? Who intervenes when issues arise?
Organisations that treat governance as a collection of policies frequently struggle to answer these questions. Those that build governance into their operating model tend to have far greater confidence in how AI is being used and controlled.
Effective AI governance starts with accountability.
Although Article 8 focuses on compliance with the requirements applicable to high-risk systems, this is closely linked to the Quality Management System requirements described later in Article 17. Together, they establish the expectation that organisations must have clear governance structures, defined responsibilities, documented processes, and mechanisms for continuous improvement.
This is often where governance discussions become overly procedural. In practice, what matters is whether accountability exists. Who owns decisions? Who approves risk acceptance? Who monitors outcomes? Who intervenes when issues arise?
Organisations that treat governance as a collection of policies frequently struggle to answer these questions. Those that build governance into their operating model tend to have far greater confidence in how AI is being used and controlled.
Risk Management
One of the most significant requirements within the AI Act is the expectation that risk management is continuous.
Article 9 requires organisations to establish, implement, document, and maintain a risk management system throughout the entire lifecycle of a high-risk AI system. This is not a one-off assessment performed during development. Risks must be identified, evaluated, mitigated, monitored, and reassessed over time.
This reflects a broader reality of AI. Models evolve, data changes, user behaviour shifts, and operating environments become more complex. The risks associated with an AI system today may not be identical to those that emerge six months from now.
A mature governance programme therefore treats risk management as an ongoing capability rather than a project activity.
One of the most significant requirements within the AI Act is the expectation that risk management is continuous.
Article 9 requires organisations to establish, implement, document, and maintain a risk management system throughout the entire lifecycle of a high-risk AI system. This is not a one-off assessment performed during development. Risks must be identified, evaluated, mitigated, monitored, and reassessed over time.
This reflects a broader reality of AI. Models evolve, data changes, user behaviour shifts, and operating environments become more complex. The risks associated with an AI system today may not be identical to those that emerge six months from now.
A mature governance programme therefore treats risk management as an ongoing capability rather than a project activity.
Data Governance
No governance framework can compensate for poor-quality data.
Article 10 recognises this by placing significant emphasis on the quality and governance of training, validation, and testing datasets. Organisations must consider data provenance, representativeness, relevance, completeness, and bias mitigation.
Many AI governance conversations focus heavily on models while paying less attention to the data that underpins them. Yet data remains one of the strongest determinants of whether an AI system will behave as intended.
This requirement is also one of the clearest areas where tools such as Microsoft Purview can support governance objectives. Data lineage, metadata management, business glossaries, and data quality capabilities provide organisations with the visibility needed to understand where data originates, how it moves, and whether it can be trusted for AI use cases.
Data governance is not a separate discipline sitting alongside AI governance. It is one of its foundational components.
No governance framework can compensate for poor-quality data.
Article 10 recognises this by placing significant emphasis on the quality and governance of training, validation, and testing datasets. Organisations must consider data provenance, representativeness, relevance, completeness, and bias mitigation.
Many AI governance conversations focus heavily on models while paying less attention to the data that underpins them. Yet data remains one of the strongest determinants of whether an AI system will behave as intended.
This requirement is also one of the clearest areas where tools such as Microsoft Purview can support governance objectives. Data lineage, metadata management, business glossaries, and data quality capabilities provide organisations with the visibility needed to understand where data originates, how it moves, and whether it can be trusted for AI use cases.
Data governance is not a separate discipline sitting alongside AI governance. It is one of its foundational components.
Documentation and Evidence
Good governance depends upon evidence.
Articles 11 and 12 establish the requirements for technical documentation and record keeping. Organisations must maintain sufficient documentation to demonstrate conformity with regulatory obligations and provide evidence regarding how the system operates.
Technical documentation includes information such as system design, intended purpose, performance characteristics, testing activities, and risk assessments. Record keeping focuses on logs, traceability, and the ability to reconstruct events when needed.
This may appear administrative at first glance, but it plays a critical role in building accountability. When questions arise about an AI system's behaviour, organisations need more than assumptions or recollections. They need evidence. Documentation transforms governance from intention into demonstration.
Good governance depends upon evidence.
Articles 11 and 12 establish the requirements for technical documentation and record keeping. Organisations must maintain sufficient documentation to demonstrate conformity with regulatory obligations and provide evidence regarding how the system operates.
Technical documentation includes information such as system design, intended purpose, performance characteristics, testing activities, and risk assessments. Record keeping focuses on logs, traceability, and the ability to reconstruct events when needed.
This may appear administrative at first glance, but it plays a critical role in building accountability. When questions arise about an AI system's behaviour, organisations need more than assumptions or recollections. They need evidence. Documentation transforms governance from intention into demonstration.
Transparency and Explainability
A system cannot be governed effectively if nobody understands how it should be used.
Article 13 requires high-risk AI systems to be sufficiently transparent so that deployers can interpret outputs and use the system appropriately. Users must be provided with information about intended use, limitations, and operational considerations.
Transparency is often reduced to explainability discussions, but it extends beyond technical explanations of model behaviour. It also encompasses user guidance, operational context, and clarity regarding what the system should and should not be used for.
Many governance failures occur not because the AI was technically flawed but because people misunderstood its outputs or relied upon it in inappropriate ways. Transparency helps prevent those misunderstandings.
A system cannot be governed effectively if nobody understands how it should be used.
Article 13 requires high-risk AI systems to be sufficiently transparent so that deployers can interpret outputs and use the system appropriately. Users must be provided with information about intended use, limitations, and operational considerations.
Transparency is often reduced to explainability discussions, but it extends beyond technical explanations of model behaviour. It also encompasses user guidance, operational context, and clarity regarding what the system should and should not be used for.
Many governance failures occur not because the AI was technically flawed but because people misunderstood its outputs or relied upon it in inappropriate ways. Transparency helps prevent those misunderstandings.
Human Oversight
One of the most important themes within the AI Act is the continuing role of human judgement.
Article 14 requires organisations to design systems that enable appropriate human oversight. This includes mechanisms for review, escalation, intervention, and, where necessary, stopping or overriding the system.
The phrase "human in the loop" is often used when discussing AI oversight, but the Act's expectations are broader than that. Effective oversight requires authority, competence, and accountability, not merely human presence. People need to be able to challenge outcomes, recognise anomalies, and take action when circumstances demand it. Governance remains a human responsibility, even when decisions are increasingly supported by AI.
One of the most important themes within the AI Act is the continuing role of human judgement.
Article 14 requires organisations to design systems that enable appropriate human oversight. This includes mechanisms for review, escalation, intervention, and, where necessary, stopping or overriding the system.
The phrase "human in the loop" is often used when discussing AI oversight, but the Act's expectations are broader than that. Effective oversight requires authority, competence, and accountability, not merely human presence. People need to be able to challenge outcomes, recognise anomalies, and take action when circumstances demand it. Governance remains a human responsibility, even when decisions are increasingly supported by AI.
Accuracy, Robustness and Security
The final capability area focuses on operational resilience.
Article 15 requires high-risk AI systems to achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their operational life. Organisations must consider not only normal operating conditions but also errors, failures, misuse, and malicious attacks.
This reflects an important shift in thinking. Governance is not solely about policies and controls. It is also about operational performance.
An AI system that cannot remain reliable, secure, and resilient under real-world conditions cannot ultimately be considered trustworthy.
The final capability area focuses on operational resilience.
Article 15 requires high-risk AI systems to achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their operational life. Organisations must consider not only normal operating conditions but also errors, failures, misuse, and malicious attacks.
This reflects an important shift in thinking. Governance is not solely about policies and controls. It is also about operational performance.
An AI system that cannot remain reliable, secure, and resilient under real-world conditions cannot ultimately be considered trustworthy.
Governance is more than Compliance
When viewed together, Articles 8-15 reveal something that is often missed in discussions about the EU AI Act. The regulation is not describing a set of independent controls. It is describing a connected governance system.
Risk management relies on trustworthy data. Transparency depends on documentation. Oversight requires accountability. Security depends upon effective governance. Each capability supports the others.
This is why organisations should resist the temptation to approach the AI Act as a compliance exercise alone. The most successful governance programmes will be those that use these requirements to establish sustainable operating models that support responsible AI adoption at scale.
Ultimately, the organisations that thrive in the AI era are unlikely to be those with the longest policy documents. They will be those that can demonstrate consistent, repeatable, and accountable governance across their AI estate. That is the broader message embedded within Articles 8-15, and it is arguably far more significant than compliance alone.
When viewed together, Articles 8-15 reveal something that is often missed in discussions about the EU AI Act. The regulation is not describing a set of independent controls. It is describing a connected governance system.
Risk management relies on trustworthy data. Transparency depends on documentation. Oversight requires accountability. Security depends upon effective governance. Each capability supports the others.
This is why organisations should resist the temptation to approach the AI Act as a compliance exercise alone. The most successful governance programmes will be those that use these requirements to establish sustainable operating models that support responsible AI adoption at scale.
Ultimately, the organisations that thrive in the AI era are unlikely to be those with the longest policy documents. They will be those that can demonstrate consistent, repeatable, and accountable governance across their AI estate. That is the broader message embedded within Articles 8-15, and it is arguably far more significant than compliance alone.
Tuesday, 18 August 2026
Why Trust Matters more than Discovery: Microsoft Purview Unified Catalog
In the first article in this series, I explored the challenge of visibility and how Microsoft Purview Unified Catalog helps organisations answer a simple but surprisingly difficult question: what data do we actually have?
For many organisations, solving this problem represents a significant milestone. Years of system growth, acquisitions, departmental solutions and technology change often create an environment where information exists but remains difficult to locate. Valuable datasets sit within platforms that few people know about, reports are recreated because earlier versions cannot be found, and knowledge about key information assets becomes concentrated within small groups of specialists.
Improving discovery removes many of those barriers, but it also introduces a new challenge. Once users can locate information more easily, their attention naturally shifts away from finding data and towards understanding it. Very rarely does somebody discover a dataset and immediately begin using it without asking further questions. Instead, they want to know whether the dataset is trusted, who owns it, how it is being maintained and whether it is suitable for the decision, analysis or report they are working on.
In practice, this is the point at which governance becomes far more interesting.
Most organisations do not struggle because they lack information. They struggle because they lack confidence in the information they have. Discovery helps people locate data, but trust determines whether that data is actually used.
Why Data Discovery is only the beginning
Many of the frustrations people experience with data are not caused by technology. They arise because the information lacks sufficient context.
Imagine an analyst searching a catalogue and finding three datasets that appear to contain customer information. All three are current. All three appear relevant. All three contain similar attributes and similar record counts. Discovery has succeeded because the analyst can see that the data exists. Unfortunately, discovery alone does not help determine which dataset should be used.
The questions that follow are usually business questions rather than technical questions.
Which dataset represents the approved source?
Which business area owns it?
What does "customer" actually mean within this context?
How frequently is it updated?
What transformations have been applied since the data was first collected?
Without those answers, users often fall back on familiar behaviour. They email colleagues, consult subject matter experts or continue using whichever data source they trusted previously. The catalogue exists, but confidence has not yet been established.
This is why governance programmes that focus exclusively on discovery often struggle to deliver their full value. Visibility is important, but visibility without context rarely creates trust.
Where Data Curation fits
One of the less discussed aspects of governance is curation. The term itself sounds administrative, which probably explains why it receives less attention than topics such as AI, analytics or compliance. In reality, curation sits at the heart of helping organisations bridge the gap between technical information and business understanding.
Most data assets are created within technology environments. Their names reflect system requirements, integration patterns or development conventions. To the engineers who build and maintain them, those names often make perfect sense. To everyone else, they can be cryptic, ambiguous or completely meaningless.
A curated asset looks different because it includes the information people actually need in order to understand it. Business descriptions explain what the asset represents. Ownership information identifies accountability. Classifications provide context about sensitivity and usage. Associated business terms explain how the asset fits within the language of the organisation.
This process transforms a technical asset into something that can be interpreted and trusted by a much wider audience.
The objective is not simply to document data. It is to create enough context that somebody encountering a dataset for the first time can understand its purpose and relevance without needing to find the person who created it.
The Business Glossary: Creating a Common Language
One of the most valuable governance capabilities within Microsoft Purview is the Business Glossary.
At first glance, a glossary sounds relatively straightforward. Many organisations assume it is simply a dictionary of approved business terms. In practice, its role is significantly more important than that.
Every organisation has terminology that appears obvious until people are asked to define it. Terms such as customer, employee, supplier, resident, contract or revenue are often assumed to have a consistent meaning. Governance workshops frequently reveal the opposite. Different teams use the same words while referring to slightly different concepts. Those differences may be perfectly reasonable within local contexts, but they become problematic when information is shared across departments, reports or analytical models.
A customer services team may define an active customer differently from the sales function. Finance may calculate revenue differently from operational reporting. Legal, risk and compliance teams may use terminology that reflects regulatory requirements rather than business reporting needs.
These are not necessarily disagreements. More often they are examples of organisational complexity becoming visible.
The Business Glossary provides a mechanism for governing this complexity. Within Microsoft Purview, glossary terms can be organised into domains, assigned owners and stewards, enriched with definitions and related terms, and connected directly to assets within the Unified Catalog. This relationship is particularly important because it links business language to the datasets, reports and information products that rely upon it.
When users search the catalogue, they are not simply looking at technical metadata. They can also see the business terminology associated with assets and understand how those assets relate to agreed organisational definitions. Rather than existing as a separate governance artefact that few people reference, the glossary becomes embedded within the discovery experience itself.
This is often where trust begins. People are far more likely to use information when they understand both what it contains and how the organisation expects it to be interpreted.
Why Lineage builds confidence
Even when terminology is clear and ownership is established, there is usually another question users want answered.
How did this data get here?
Most people consume information at the end of a process. They see a dashboard, a report, a model or, increasingly, an AI-generated response. What they do not see is the journey that information has taken through source systems, integrations, transformation processes and analytical platforms before reaching its final destination.
Understanding that journey is the role of data lineage.
Lineage provides visibility into how information moves through an organisation. Rather than viewing a dataset as an isolated asset, users can see its relationship to upstream systems, transformation processes and downstream consumers. This creates a much richer understanding of where information originated and what happened to it along the way.
The significance of lineage becomes particularly obvious when trust is challenged. If a figure changes unexpectedly, lineage helps explain why. If an upstream source system is modified, lineage can help identify which reports, dashboards and analytical processes may be affected. If two datasets appear similar, lineage may reveal that they originate from different systems and have undergone different transformations.
In other words, lineage provides evidence rather than assumption.
Within Microsoft Purview, lineage is captured automatically through integration with supported technologies and services. Data movement, transformation and processing activities within platforms such as Azure Data Factory, Microsoft Fabric, SQL environments and other supported services can be visualised as connected information flows. Instead of relying on manually maintained diagrams that quickly become outdated, organisations gain a dynamic view of how information actually moves through the estate.
For governance teams this increases visibility. For business users it often increases trust because they can see how a reported value is connected to its source.
Trust is what turns Data into value
Discovery remains a critical part of data governance. Organisations cannot govern information that they cannot find, which is why visibility, cataloguing and discovery capabilities provide such an important foundation.
However, discovery alone does not solve the larger challenge.
People create value from data when they are willing to use it. They use it when they understand it. They trust it when they have confidence in its meaning, ownership and provenance.
Business glossaries help establish shared language. Curation provides business context. Lineage explains how information was created and how it moves across the organisation. Together, these capabilities transform a catalogue from a searchable inventory into a trusted source of organisational knowledge.
Finding data is important. Being confident enough to use it is what ultimately matters.
Friday, 14 August 2026
AI is Forcing Organisations to ask Data Governance questions they have avoided for years
When organisations begin exploring generative AI, the early conversations are usually focused on technology. Attention naturally turns towards copilots, agents, large language models, prompt engineering and how existing processes might be automated. The assumption is often that success will depend on choosing the right tools and identifying the right use cases.
Those discussions are important, but they rarely remain the centre of attention for long.
As AI initiatives move beyond experimentation and into real business scenarios, the conversation often shifts in an unexpected direction. Questions begin to emerge about ownership, trust, definitions and accountability. Teams discover that information which appeared well understood within individual departments becomes considerably more difficult to explain when it is surfaced across the organisation through a single AI-powered experience.
This is creating an interesting situation. Many organisations believe they are encountering AI challenges when, in reality, they are encountering long-standing governance challenges that have remained largely hidden until now.
For years it has been possible for businesses to operate successfully despite inconsistencies in the way data is managed. Different departments develop their own reporting processes, terminology and working practices. Over time these approaches become embedded into everyday operations. Finance may calculate a measure one way, while another business unit calculates it differently. Multiple systems may contain records relating to the same customer, product or asset. Ownership may be understood informally without being clearly defined.
None of these situations are unusual. In fact, they are common in organisations of every size and sector.
What has changed is that generative AI is exposing these inconsistencies in ways that traditional reporting platforms rarely did. Information that once remained within the boundaries of a specific application, report or team is increasingly being brought together and presented through a single interface. As soon as that happens, differences in meaning, ownership and interpretation become much more visible.
One of the more striking developments over the past year has been how quickly discussions about AI become discussions about data governance. An organisation may start by exploring how employees can use Copilot more effectively, only to find itself debating which definition of a business term should be treated as authoritative. A workshop intended to focus on automation can quickly become a conversation about data ownership. Questions about whether users can trust AI-generated responses often lead directly to questions about where underlying information originated and how it is managed.
These are not new concerns. Governance professionals have been dealing with them for decades. The difference is that they are no longer confined to governance programmes.
AI is bringing them into boardrooms, project teams and business conversations that might previously never have engaged with governance at all.
The issue is not that AI is creating poor governance. Rather, it is making gaps in governance more difficult to ignore.
A useful parallel can be found in the idea of technical debt. Most organisations understand that technology decisions made years ago can create future complexity. Shortcuts that seem reasonable at the time often require greater effort to address later. Data governance follows a similar pattern. Business definitions are left undocumented because everyone believes they share the same understanding. Ownership remains informal because responsibilities appear obvious. Metadata is treated as a technical concern rather than a business asset. Lineage documentation is postponed because delivery deadlines take priority.
Individually, these decisions rarely feel significant. Collectively, they create an environment where information becomes harder to understand, trust and govern over time.
Historically, organisations could continue operating with this ambiguity because people compensated for it. Experienced employees knew which reports to trust and who to contact when figures did not align. Unwritten knowledge often filled the gaps that formal governance processes had not addressed.
Generative AI changes that dynamic because it lacks this organisational context. It relies on information being discoverable, understandable and consistent. When definitions vary between teams, when ownership is unclear or when information carries little context, those weaknesses become more apparent. The technology is simply revealing what has always been there.
This is one reason metadata has suddenly become a much more strategic conversation. Business glossaries, catalogues, classifications, stewardship models and lineage are often viewed as traditional governance disciplines. Increasingly, they are becoming recognised as fundamental enablers for AI adoption. Organisations are realising that it is difficult to scale AI responsibly when basic questions about information cannot be answered consistently.
The organisations making the strongest progress with AI are not always the ones investing the most heavily in AI technology itself. More often, they are organisations that have a reasonable understanding of their information landscape. They know which data matters to the business, who is accountable for it, how it is defined and where it comes from. They have established enough structure and context to create confidence in the information being consumed.
That confidence matters because successful AI adoption is ultimately a trust exercise. Users need confidence that information is accurate, that responses can be explained and that decisions can be justified. Without trust, adoption slows regardless of how capable the underlying technology may be.
Perhaps the most interesting outcome of the current AI wave is that it is forcing organisations to revisit some of the fundamentals of information management. After years of being viewed as a compliance activity or a specialist discipline, data governance is finding itself at the centre of conversations about innovation, productivity and business transformation.
The irony is that many organisations began their AI journey expecting to focus primarily on technology. Instead, they are being asked to confront questions about data that have existed for years. They have questions about ownership, meaning, accountability, and trust. Those are governance questions, and they are becoming increasingly difficult to avoid.
AI may not have been designed to improve data governance, but it is proving remarkably effective at showing organisations where governance needs attention. In many cases, the most valuable insight generated by AI is not contained within a response or recommendation. It is the realisation that understanding data remains one of the most important prerequisites for using it effectively.
When organisations begin exploring generative AI, the early conversations are usually focused on technology. Attention naturally turns towards copilots, agents, large language models, prompt engineering and how existing processes might be automated. The assumption is often that success will depend on choosing the right tools and identifying the right use cases.
Those discussions are important, but they rarely remain the centre of attention for long.
As AI initiatives move beyond experimentation and into real business scenarios, the conversation often shifts in an unexpected direction. Questions begin to emerge about ownership, trust, definitions and accountability. Teams discover that information which appeared well understood within individual departments becomes considerably more difficult to explain when it is surfaced across the organisation through a single AI-powered experience.
This is creating an interesting situation. Many organisations believe they are encountering AI challenges when, in reality, they are encountering long-standing governance challenges that have remained largely hidden until now.
For years it has been possible for businesses to operate successfully despite inconsistencies in the way data is managed. Different departments develop their own reporting processes, terminology and working practices. Over time these approaches become embedded into everyday operations. Finance may calculate a measure one way, while another business unit calculates it differently. Multiple systems may contain records relating to the same customer, product or asset. Ownership may be understood informally without being clearly defined.
None of these situations are unusual. In fact, they are common in organisations of every size and sector.
What has changed is that generative AI is exposing these inconsistencies in ways that traditional reporting platforms rarely did. Information that once remained within the boundaries of a specific application, report or team is increasingly being brought together and presented through a single interface. As soon as that happens, differences in meaning, ownership and interpretation become much more visible.
One of the more striking developments over the past year has been how quickly discussions about AI become discussions about data governance. An organisation may start by exploring how employees can use Copilot more effectively, only to find itself debating which definition of a business term should be treated as authoritative. A workshop intended to focus on automation can quickly become a conversation about data ownership. Questions about whether users can trust AI-generated responses often lead directly to questions about where underlying information originated and how it is managed.
These are not new concerns. Governance professionals have been dealing with them for decades. The difference is that they are no longer confined to governance programmes.
AI is bringing them into boardrooms, project teams and business conversations that might previously never have engaged with governance at all.
The issue is not that AI is creating poor governance. Rather, it is making gaps in governance more difficult to ignore.
A useful parallel can be found in the idea of technical debt. Most organisations understand that technology decisions made years ago can create future complexity. Shortcuts that seem reasonable at the time often require greater effort to address later. Data governance follows a similar pattern. Business definitions are left undocumented because everyone believes they share the same understanding. Ownership remains informal because responsibilities appear obvious. Metadata is treated as a technical concern rather than a business asset. Lineage documentation is postponed because delivery deadlines take priority.
Individually, these decisions rarely feel significant. Collectively, they create an environment where information becomes harder to understand, trust and govern over time.
Historically, organisations could continue operating with this ambiguity because people compensated for it. Experienced employees knew which reports to trust and who to contact when figures did not align. Unwritten knowledge often filled the gaps that formal governance processes had not addressed.
Generative AI changes that dynamic because it lacks this organisational context. It relies on information being discoverable, understandable and consistent. When definitions vary between teams, when ownership is unclear or when information carries little context, those weaknesses become more apparent. The technology is simply revealing what has always been there.
This is one reason metadata has suddenly become a much more strategic conversation. Business glossaries, catalogues, classifications, stewardship models and lineage are often viewed as traditional governance disciplines. Increasingly, they are becoming recognised as fundamental enablers for AI adoption. Organisations are realising that it is difficult to scale AI responsibly when basic questions about information cannot be answered consistently.
The organisations making the strongest progress with AI are not always the ones investing the most heavily in AI technology itself. More often, they are organisations that have a reasonable understanding of their information landscape. They know which data matters to the business, who is accountable for it, how it is defined and where it comes from. They have established enough structure and context to create confidence in the information being consumed.
That confidence matters because successful AI adoption is ultimately a trust exercise. Users need confidence that information is accurate, that responses can be explained and that decisions can be justified. Without trust, adoption slows regardless of how capable the underlying technology may be.
Perhaps the most interesting outcome of the current AI wave is that it is forcing organisations to revisit some of the fundamentals of information management. After years of being viewed as a compliance activity or a specialist discipline, data governance is finding itself at the centre of conversations about innovation, productivity and business transformation.
The irony is that many organisations began their AI journey expecting to focus primarily on technology. Instead, they are being asked to confront questions about data that have existed for years. They have questions about ownership, meaning, accountability, and trust. Those are governance questions, and they are becoming increasingly difficult to avoid.
AI may not have been designed to improve data governance, but it is proving remarkably effective at showing organisations where governance needs attention. In many cases, the most valuable insight generated by AI is not contained within a response or recommendation. It is the realisation that understanding data remains one of the most important prerequisites for using it effectively.
Thursday, 6 August 2026
Governance should travel with the Data: Microsoft Purview Data Sharing
One of the more frustrating characteristics of traditional data governance is that it often becomes less effective at the exact moment information starts to create value. Organisations invest significant effort in cataloguing information, defining business terminology, assigning ownership, improving quality and establishing governance controls. Within a governed environment, confidence begins to grow because people understand what data exists, how it should be used and who is responsible for it. The challenge emerges when that information needs to be shared.
Historically, sharing data has often created a new copy of the problem alongside a new copy of the data. Information is extracted from a source system, copied into another platform and then distributed to a different department, partner or project team. While the immediate requirement has been satisfied, something important is frequently lost along the way. The governance context associated with that information does not always travel with it.
Definitions become disconnected from the business glossary. Ownership becomes less obvious. Security controls may differ between environments. Lineage becomes harder to follow. Before long, multiple versions of the same information exist across different locations, each carrying slightly different assumptions about how it should be managed.
Many organisations have spent years attempting to reduce the number of data silos within the business, only to discover that sharing data can be one of the fastest ways to create new ones.
This creates an important governance challenge.
Data only delivers value when people can access and use it. Restricting access to everything is rarely a practical solution. At the same time, uncontrolled sharing introduces risk, duplication and inconsistency. Effective governance requires a balance between enabling access and maintaining control.
This is where Microsoft Purview Data Sharing becomes particularly valuable.
Rethinking what it means to Share Data
When people hear the phrase "data sharing", they often assume it means moving data from one place to another.
Modern governance increasingly takes a different approach.
Rather than distributing copies of information throughout the organisation, the goal is to provide controlled access to trusted datasets while keeping the information where it already resides. Instead of sharing the asset itself, organisations increasingly focus on sharing access to the asset.
The distinction is more significant than it first appears.
A copied dataset immediately begins diverging from its source. Updates may occur in one location but not another. Governance controls may evolve independently. Users consuming the copied data may no longer have visibility of ownership, quality metrics or policy controls that existed within the original environment.
Providing access to the governed source avoids many of these problems because users remain connected to the same underlying asset.
The data and governance remains in one place. The organisation maintains a single version of the truth.
Why Data Sharing depends on Discovery and Trust
By the time an organisation begins sharing information more broadly, much of the work described in the previous articles has already become important.
Sharing trusted data assumes that trusted data has first been identified.
The Unified Catalog helps users discover available datasets. Business Glossary terms ensure there is a common understanding of what those datasets represent. Lineage helps explain where information originated and how it has been transformed. Data Quality provides confidence that the information meets expected standards.
Without those foundations, sharing simply distributes uncertainty more widely.
In many respects, governance capabilities become more valuable as data sharing increases because a larger audience needs confidence in the information being consumed. Users receiving access to data rarely have the benefit of local knowledge from the teams that originally created it. Governance provides the context that helps those users understand what they are accessing.
For this reason, sharing should not be viewed as a standalone capability. It is the outcome of many governance disciplines working together.
Governance should not end at the department boundary
One of the more common challenges within large organisations is that governance maturity often varies significantly between business areas.
Some domains have established ownership, clear definitions and strong stewardship practices. Others remain heavily dependent on local knowledge and informal processes. Sharing information across those boundaries can expose differences that were previously invisible.
A finance team may confidently share information with another department, only to discover that business definitions are interpreted differently elsewhere. Regulatory requirements understood within one team may not be obvious to another. Information classified as sensitive in one context may be treated differently in another.
These situations are rarely caused by poor intentions. More often they reflect the complexity of modern organisations.
A well-governed sharing model helps address this challenge because governance travels alongside the data. Users receiving access are not simply obtaining rows and columns. They are gaining access to ownership information, classification context, business definitions and other governance artefacts that help explain how the information should be interpreted and managed.
This creates a more consistent experience for both providers and consumers of data.
The Role of Data Policy
Sharing information safely ultimately depends on policy.
In the previous article, I explored how Data Policy moves governance from documentation into operational control. Data Sharing builds on the same principle.
Not everybody should have access to every dataset. Access decisions should reflect business need, sensitivity, ownership and organisational policy. As governance programmes mature, manually managing these decisions becomes increasingly difficult, particularly when information needs to be shared across departments, projects or external organisations.
Microsoft Purview helps organisations apply governance controls consistently through integrated policy management. Data can be shared according to rules that reflect the classifications, ownership structures and governance requirements already established elsewhere within the platform.
The important point is that governance is not being recreated at the point of sharing. It is being reused.
The policies that protect information within the organisation continue to provide value when that information is shared more broadly.
Supporting collaboration without creating new silos
The tension between collaboration and control has existed for as long as organisations have managed information.
Too much restriction reduces value because people struggle to access the information they need. Too little control increases risk and often leads to duplication, inconsistency and fragmented data landscapes.
Successful governance programmes recognise that the objective is not to prevent sharing. The objective is to make sharing safe, consistent and transparent.
This is particularly important as organisations invest in data products, cross-functional analytics and AI-driven initiatives. These capabilities depend on information flowing between teams, domains and systems. Value is increasingly created through reuse rather than isolation.
Data Sharing supports this by helping organisations move away from copying information and towards sharing governed access to trusted assets.
The Final Step in the Governance Journey
The earlier articles in this series focused on establishing visibility, building trust, operationalising governance and understanding how governance performance can be measured. Data Sharing brings those capabilities together by allowing governance to support one of the most important objectives of any data programme: enabling people to use information confidently across organisational boundaries.
This is an important distinction because governance is often perceived as something that restricts access to data. In reality, good governance should achieve the opposite. By creating trust, clarity and accountability, it becomes easier for organisations to share information safely rather than harder.
Ultimately, the success of a governance programme should not be measured by how effectively it controls data. It should be measured by how effectively it enables trusted use of data across the organisation.
Because the real value of governance is not found in catalogues, glossaries, dashboards or policies.
It is found in the confidence that allows people to use information, collaborate with others and make better decisions without creating new risks or new silos along the way.
Tuesday, 21 July 2026
Cabinet Level AI and How Britain’s Strategic Shift Changes the Data & AI Governance Landscape
- Infrastructural Investment: Delivering state of the art AI requires significant physical infrastructure from data centre capacity and grid access to supercomputing networks. Centralized ministerial authority helps unblock planning hurdles and lower energy-access barriers for compute providers.
- Public Sector Transformation: AI deployment is moving beyond private-sector start ups. Direct ministerial drive allows the government to integrate AI solutions across healthcare, transportation, and public administration, turning the state into an early anchor client for domestic innovation.
- Global Influence: As international debates rage over technological sovereignty, safety standards, and intellectual property, having a high level AI Minister ensures Britain has a direct, unified voice in shaping cross-border regulations.
References & Further Reading
GOV.UK Official Announcement: Minister of State (Minister for Artificial Intelligence) Role & Profile — Official ministerial appointment details for Kanishka Narayan MP across the Cabinet Office and the Department for Business, Innovation, Science and Trade.
Bloomberg / The Straits Times: Burnham Picks Narayan as First British AI Minister to Attend Cabinet (July 2026) — Coverage on the elevation of the AI portfolio to Cabinet level, the restructuring of UK tech departments, and national AI infrastructure strategy.
ETIH EdTech Innovation Hub: Kanishka Narayan Named UK AI Minister Under Andy Burnham (July 2026) — Analysis of the UK government's strategic focus on AI innovation, industrial policy, and global competitiveness.
Department for Science, Innovation and Technology (DSIT): AI Safety Institute & Sovereign AI Strategy Frameworks — Policy documentation outlining UK guidelines for AI safety standards, regulatory sandboxes, and enterprise data governance.
Monday, 20 July 2026
Why Fellowship Matters when Championing Data, AI, and Community Leadership
Reaching a milestone in one’s career is always an opportunity for reflection. Looking back on my journey as a Fellow of the British Computer Society (FBCS), I am reminded of why I joined this community in the first place and what driving tech leadership truly means.
Building professional communities since 2019, my focus has consistently been on the critical intersection where innovation meets responsibility. Over the years, championing robust Data and AI Governance has moved from a niche technical necessity to an urgent strategic priority. As models become more complex and integrated into everyday business and societal decisions, ensuring our data foundations are solid, ethical, and trustworthy is essential.
Sharing knowledge and mentoring others through these shifts isn't just a professional duty. It is at the core of real leadership.
To me, Fellowship is about using expertise to create impact that lasts. It’s about building resilient frameworks, empowering the next generation of technologists, and ensuring that as technology advances rapidly, it does so on a foundation of integrity and public trust.
Thank you to everyone who has been part of this community-building journey so far. Here’s to continuing the work, pushing boundaries in AI governance, and fostering spaces where impactful ideas can thrive.
Thursday, 16 July 2026
Governing the Governance programme: Microsoft Purview Data Estate Insights
One of the oddities of data governance is that organisations often spend considerable time measuring the things they are governing and very little time measuring governance itself.
Governance teams are regularly asked for evidence that data quality has improved, that ownership is becoming clearer, that sensitive information is being identified correctly or that users are finding the information they need more easily. These are entirely reasonable questions. The challenge is that most governance programmes are built around activities rather than outcomes. Assets are catalogued, business terms are defined, stewardship models are introduced and policies are agreed, but understanding whether those efforts are changing organisational behaviour can be much harder than expected.
At the outset of a governance programme this is rarely a significant concern. The early focus tends to be on establishing foundations. Organisations need visibility into their information landscape, which is why discovery and cataloguing become priorities. They need shared business language and greater confidence in the information they consume, making glossary management, curation and lineage important investments. Eventually attention turns towards quality, access management and policy enforcement as governance moves from documentation into operational practice.
As programmes mature, however, a different conversation starts to emerge. The question is no longer whether governance activities are taking place. The question becomes whether those activities are making a measurable difference.
This is where Microsoft Purview Data Estate Insights occupies a distinctive place within the wider governance platform.
Unlike Unified Catalog, Data Map, Business Glossary or Data Policy, Data Estate Insights is not primarily concerned with helping users discover or manage individual assets. Its purpose is to provide visibility into the governance capability itself. In many ways it serves as the executive view of governance, bringing together information that allows governance leaders, data owners and steering committees to understand how the programme is evolving over time.
One of the first areas this reveals is the health and coverage of the governance estate. Earlier articles in this series discussed how Purview uses Data Map to discover and scan information across connected systems. Once those capabilities are established, leadership teams inevitably become interested in the broader picture. As governance programmes mature, attention tends to move away from individual datasets and towards broader questions of coverage, adoption and visibility. Governance leaders want to understand whether the organisation has a comprehensive view of its information landscape, whether discovery processes are operating successfully and where gaps still exist. They are also interested in how the estate is changing over time, particularly as new technologies, business domains and information assets are brought into scope.
These questions are often more valuable than the underlying asset count because they provide insight into adoption. A catalogue containing thousands of assets may sound impressive, but its value is limited if significant parts of the organisation remain disconnected from governance processes. Visibility into coverage helps organisations understand not only the scale of their estate but also the extent to which governance has reached different parts of the business.
The same principle applies to business understanding.
Many governance programmes invest heavily in business glossaries and curation. Definitions are agreed, business terms are documented and stewardship responsibilities are established. The real challenge is understanding whether that effort is changing the way information is managed. Data Estate Insights provides visibility into how technical assets are being connected to business terminology, showing where business context is being applied and where gaps remain.
This is particularly useful because it highlights a common mistake within governance programmes. It is relatively easy to measure the number of glossary terms created. It is much harder to assess whether those terms are being adopted consistently across the organisation. A glossary only delivers value when it becomes connected to the information people actually use. Looking at curation coverage often reveals far more about governance maturity than simply counting definitions.
Another important perspective comes from classification and sensitivity analysis.
Governance teams rarely have the capacity to focus on every dataset equally. Some information carries greater operational value, greater regulatory significance or greater risk than others. Understanding where sensitive information exists across the estate helps governance leaders concentrate effort where it is most needed. The discussion stops being about individual assets and starts becoming a broader consideration of organisational risk, accountability and prioritisation.
For many leadership teams, this is where governance begins to intersect with wider business concerns. Discussions about metadata and stewardship gradually evolve into conversations about compliance exposure, information handling and operational resilience. Having visibility into classification trends provides context that is difficult to obtain through traditional governance reporting alone.
Data quality introduces a similar challenge.
Most organisations focus considerable effort on improving the quality of critical data. Rules are implemented, measurements are established and remediation activities are undertaken. While individual quality scores can be useful, executive audiences are rarely interested in isolated measurements. What matters is whether quality is improving across business-critical domains and whether governance interventions are producing sustained results.
Data Estate Insights helps provide that perspective by surfacing quality trends across the estate. Rather than treating quality as a series of isolated issues, governance leaders can observe patterns, identify areas where improvements are being sustained and recognise where challenges continue to emerge. This makes it easier to prioritise investment and demonstrate progress using evidence rather than anecdotal feedback.
Perhaps the most valuable aspect of Data Estate Insights is that it changes the nature of governance conversations. Instead of focusing exclusively on governance activities, organisations gain a clearer view of governance outcomes. Discovery coverage, glossary adoption, stewardship engagement, classification visibility and quality trends all contribute to a broader understanding of governance maturity.
This is important because mature governance programmes are rarely judged by the number of policies they create or the number of assets they catalogue. They are judged by whether trust in data is increasing, whether accountability is becoming clearer and whether the organisation is becoming more confident in the way it uses information.
Throughout this series, the focus has gradually moved from discovering data to understanding it, governing it and operationalising standards around it. Data Estate Insights represents the next logical step because it provides a way of understanding whether those efforts are producing tangible results. Rather than simply governing information assets, organisations gain the ability to measure, manage and continually improve the governance programme itself.
For many governance leaders, that is the point at which governance stops being a project and starts becoming a capability.



