Responsible AI in 2026: Governance Moves from Principle to Practice

Microsoft's latest article, Responsible AI in 2026: How We Are Adapting for What's Ahead, highlights something many of us working in governance have been seeing for some time: AI governance is no longer a future concern. It is becoming an operational necessity. 

As AI capabilities continue to accelerate, particularly with the rise of agentic AI, the governance challenge is changing. Traditional governance approaches were largely focused on data, systems, and applications. Increasingly, organisations must also govern autonomous actions, agent interactions, tool permissions, and dynamic decision-making processes. Microsoft describes this as a move towards more adaptive governance, where controls evolve alongside the capabilities and risks of AI systems. 

What I found most interesting is that the article places relatively little emphasis on the models themselves and much more emphasis on governance, risk management, monitoring, and assurance. Microsoft explicitly states that model capability alone will not determine AI's impact. Success will depend on whether organisations can govern AI with the rigour and adaptability needed to earn trust. 

This mirrors a trend I am seeing across the market. Many organisations are still focused on AI adoption, Copilot deployments, and proof-of-concepts. However, the harder question is emerging quickly: how do we maintain visibility, accountability, and control once AI becomes embedded in day-to-day operations?

The answer is unlikely to be found in technology alone. Microsoft's report discusses governance frameworks, risk management processes, evaluation capabilities, training, standards, and industry collaboration. These are all governance disciplines rather than purely technical controls. 

For data governance professionals, this should sound familiar. The foundations that organisations have spent years developing around ownership, accountability, quality, security, and compliance are becoming even more important in an AI-enabled world. AI governance is not replacing data governance. It is extending it.

Perhaps the most significant message from the article is that responsible AI cannot be treated as a static policy document. Microsoft describes governance as a continuous lifecycle activity that must evolve as systems learn, interact, and operate in increasingly complex environments.  That is a valuable lesson for every organisation currently exploring AI. The conversation is no longer about whether governance matters. The conversation is about whether governance can keep pace with AI's rapid evolution.

As Microsoft's latest transparency report demonstrates, the organisations most likely to succeed with AI will not simply be those with access to the best technology. They will be the organisations that can combine innovation with trust, control, and effective governance.

References

https://blogs.microsoft.com/on-the-issues/2026/09/01/responsible-ai-in-2026-how-we-are-adapting-for-whats-ahead/

The Hierarchy of AI Oversight

Organisations frequently treat Responsible AI, AI Governance, and Data Governance as synonymous concepts. In practice, they represent three distinct, interdependent structural tiers. Treating them as interchangeable obscures how AI systems are built, verified, and operationalised within an enterprise.

A useful way to conceptualise this structure is through a three-part stack:

•  Responsible AI defines organizational intent and boundaries.
•  AI Governance establishes operational execution and control mechanisms.
•  Data Governance manages the underlying assets and pipeline inputs.

When any single tier is neglected, the entire oversight framework becomes ineffective.

Responsible AI: Establishing Strategic Intent

Responsible AI sits at the top of the stack as an explicit declaration of intent. It articulates an organisation's risk tolerance, core values, and societal commitments regarding automated systems.

This layer does not detail specific technical configurations or workflow steps. Instead, it defines the overarching ethical perimeter, addressing core themes such as non-discrimination, explainability, safety, and accountability.

Key questions addressed at this layer include:

•  What operational boundaries define acceptable versus unacceptable AI deployments?
•  What specific harms must system designs actively prevent?
•  What baseline commitments are required for external stakeholders and regulatory bodies?

While Responsible AI acts as the strategic compass, policy statements alone do not alter system behavior. Without operational enforcement, policy declarations remain purely symbolic. Operationalising these policies requires the secondary layer: AI Governance.

AI Governance: Implementing Operational Control

AI Governance provides the operational apparatus required to enforce Responsible AI policies. It consists of the decision rights, verification protocols, audit trails, and risk taxonomies that manage an AI model across its complete lifecycle.

This tier shifts abstract commitments into concrete engineering and management workflows. It covers model validation standards, change management, automated drift detection, and post-deployment monitoring. Systems like the GRAICE framework operate within this domain to standardise evaluation criteria.

Key questions addressed at this layer include:

• Which roles hold approval authority at distinct stages of model development?
• What quantitative evidence is required prior to production deployment?
• How are performance degradation, bias drift, and unexpected edge cases detected and remediated?
• What specific conditions trigger a mandatory model recall or pause?

AI Governance ensures that models operate within defined parameters over time. However, governance controls cannot ensure model integrity if the underlying inputs are flawed. Control frameworks require verifiable data inputs, which depends entirely on the foundational layer.

Data Governance: Securing the System Inputs

Data Governance manages the quality, legal basis, security, and lineage of the data fed into machine learning pipelines. Because statistical models reflect the characteristics of their training data, AI performance is constrained by the quality of its underlying data architecture.

Without robust data management, model output becomes inherently unpredictable. Issues such as unverified data sources, unrecorded pipeline transformations, or demographic skew directly compromise model outputs regardless of how stringent the AI control checks are.

Key questions addressed at this layer include:

•  What is the precise lineage and chain of custody for training and validation datasets?
•  Do clear usage rights, legal bases, and consent frameworks exist for the ingested data?
•  Is the dataset representative, accurate, and properly versioned?
•  How are data access controls and privacy-preserving techniques maintained through the pipeline?

Strong Data Governance provides the verifiable evidence base that AI Governance relies on. Without it, validation processes lack technical substance

.

Structural Pitfalls of Top-Down Implementation

A common failure mode occurs when organisations implement oversight from the top down. Leadership teams often publish high-level ethical guidelines and establish oversight committees before building the necessary operational controls or securing data infrastructure.

This top-down approach creates several operational vulnerabilities:

•  Oversight committees evaluate systems without reliable technical lineage or performance data.
•  Data quality defects and unverified assumptions are identified late in production rather than during ingestion.
•  Ambiguity surrounds technical accountability when failures occur.
• Defining ethical principles without establishing underlying governance frameworks leads to superficial compliance—where policy commitments exist on paper but cannot be verified or enforced at the engineering level.

Building a Cohesive Oversight Framework

Establishing an effective oversight framework requires starting from foundational technical controls and building upwards:

• Establish Data Integrity: Secure data lineage, document legal rights, enforce validation checks, and maintain clear data stewardship across all pipelines.
• Deploy Control Architectures: Implement repeatable stage-gate approvals, continuous testing protocols, risk logging, and lifecycle monitoring.
• Align Operational Controls with Policy Boundaries: Connect technical metrics and threshold alerts directly to high-level organizational principles and regulatory requirements.

Aligning these three disciplines transforms AI oversight from a collection of isolated policies into an integrated operational capability.

Anthropic training programmes

Over the last week I have completed three Anthropic training programmes to expand my use of AI tools from Copilot and Gemini. While the courses focus on Claude, the value goes far beyond learning a particular AI tool. I completed:

• Claude 101
• AI Fluency Framework & Foundations
• Claude Code in Action

Claude 101 provides a solid grounding in how to work effectively with large language models. It covers prompt design, structuring requests, and understanding where AI can genuinely add value versus where human judgement remains essential.

AI Fluency Framework & Foundations takes a broader view. Rather than concentrating on technology alone, it explores how individuals and organisations can develop the skills, mindset and practices needed to adopt AI successfully. It reinforces an important lesson about becoming AI-enabled is as much about people and ways of working as it is about the tools themselves.

Claude Code in Action was particularly interesting from a practical perspective. It demonstrates how AI can support software development workflows, automate repetitive tasks, assist with code generation and review, and help teams move faster while maintaining quality. Even for those of us who are not full-time developers, it offers valuable insight into how AI is changing the way technical teams work.

The skills I learned on a this tool cover the tool usage but are more about people, skills, governance, and trusted data.

AI Governance is a Hollow Framework Without Data Governance

The Hard Truth: We are trying to govern the outputs of frontier AI without establishing strict control over the inputs.

Imagine a near-future scenario: a frontier AI developer launches its next-generation model family. Within days, researchers uncover a zero-day jailbreak vulnerability that allows the model to map and exploit critical software vulnerabilities with unprecedented autonomy. In a scramble, the federal government issues an unprecedented emergency directive, forcing the developer to suspend global API access under the banner of national security.

While this sounds like a techno-thriller, the current geopolitical trajectory suggests this crisis is an inevitability. When governments eventually panic and react to high-risk algorithmic outputs, they will find that treating commercial AI models like sudden tactical threats is an unsustainable way to regulate technology.

AI models do not generate safety risks out of thin air; they learn them from data. Reactive government bans and real-time output filters are panic buttons. True thought leadership in this space requires looking upstream.

The Missing Link: Why Data Governance is AI Governance

Effective risk management for frontier models cannot rely on real-time safeguards alone. True resilience requires structural data governance built across three distinct operational pillars:

1. Data Provenance and Vulnerability Tracing

If a model can be steered into identifying critical software infrastructure vulnerabilities, we must ask: What specific datasets allowed it to map these exploits? Data governance mandates a transparent, verifiable ledger of training data. Regulators and developers must be able to audit what a model actually "knows" long before it is deployed to the public.

2. Dynamic Data Retention as a Defense Layer

When developers scramble to mitigate active exploits, they rely heavily on short-term telemetry retention policies to analyze user prompt interactions and track malicious behavior. Knowing exactly how user data is ingested, logged, and securely monitored is the only way to detect non-universal, highly sophisticated jailbreaks in real time.

3. Access Control and Data Sovereignty

Enforcing geographical or citizenship-based restrictions on a cloud-native, globally distributed API environment is a logistical nightmare. Without ironclad data access governance—restricting who can query the model and where that telemetry is stored—preventing unauthorized cross-border interaction with advanced reasoning systems is practically impossible.

Four Critical Questions for Tech Sovereignty

As the boundary between commercial technology and national security blurs, organizations and global regulators must confront the deeper systemic questions facing the ecosystem:

• Who defines the threshold? Who determines when an advanced reasoning capability crosses the line from a massive commercial benefit to an existential national security threat?

• What are the standards of validation? What transparent, independent, and technically grounded benchmarks must exist before a governing body can disrupt commercial ecosystems?

• How do we prevent total fragmentation? If strict export controls dictate who can use the best models, how do we avoid a fractured digital world where access to advanced reasoning is determined entirely by geographical alignment?

• What role does international cooperation play? When the regulatory actions of one nation can disable access for businesses worldwide, how do we build international institutions capable of managing global technological externalities?

Moving From Friction to Resilience

If we continue to treat AI safety as a series of sudden regulatory halts and reactive software patches, we will paralyze market innovation without actually making the digital estate any safer.

Responsible AI is the destination, but we cannot get there without two non-negotiable operational tracks:

1. AI Governance: Providing the systemic oversight, legal compliance, and risk frameworks needed to manage model deployment.

2. Data Governance: Securing the upstream integrity, tracing, and access controls of the information that shapes those models in the first place.

Reactive regulations are a sign of a system in deep friction. True leadership demands that we look upstream, securing the data infrastructure today so we can safely innovate the AI capabilities of tomorrow.

Sources & Further Reading (Alternative Options)

• White House Policy: "Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence" — focusing on the mandates for safety testing and red-teaming for frontier models.

• Geopolitical Precedents: Bureau of Industry and Security (BIS) guidelines on advanced computing and semiconductor export controls to showcase how the U.S. government actually restricts technology infrastructure.

• Technical Frameworks: The NIST AI Risk Management Framework (AI RMF), which details the industry-standard pillars for measuring and governing AI risk, mapping beautifully to your data governance argument.

Microsoft Purview Security Tooling Blog Series

The biggest data security risk in Microsoft 365 isn't external attackers. It's the controls you think you've already implemented. Most organisations believe their data is secure because they have Microsoft 365. The reality is often very different. Over the last few weeks, I've written a series exploring the Microsoft Purview data security capabilities that organisations regularly purchase but don't fully implement, configure, or operationalise.

The common assumption is that data security is a technology problem. In practice, it's a visibility, governance, and control problem. Knowing where your sensitive data is, who has access to it, how it moves, and how you respond when something goes wrong requires much more than switching on a licence.

The series explores:

🔹 Information Protection – classifying and protecting what matters
🔹 Data Loss Prevention – turning classifications into enforceable controls
🔹 Insider Risk Management – understanding risky behaviours before they become incidents
🔹 Information Barriers – controlling who can collaborate with whom
🔹 Data Security Investigations – turning alerts into evidence and action
🔹 DSPM for AI and Data – exposing hidden risks and overexposure across your estate

If you're working in data governance, security, compliance, or responsible AI, these capabilities are becoming increasingly important as organisations seek to balance productivity with protection. The challenge isn't buying the technology. It is implementing the controls that make the technology effective.

You can read the full series here:

References

The Reality of Data Security in M365 (Purview Protection)

Microsoft Purview Information Protection: The Control Most Organizations Think They Already Have 

Microsoft Purview Information Barriers: Controlling Who Can Work With What

Microsoft Purview Data Security Investigations: When Alerts Become Evidence

Microsoft Purview DSPM: Unmasking Your True Data Risks

Microsoft Purview Data Loss Prevention: Where Classification Becomes Control

Microsoft Purview Insider Risk Management: When Data Movement Becomes Behaviour

Microsoft Project Solara A New Category: Agent‑First Devices Built for the Enterprise

Project Solara introduces a hardware and software ecosystem where AI agents become the primary interface, not applications. Microsoft demonstrated two reference devices:

• A desk companion that authenticates via facial recognition and acts as a gateway to cloud‑based Windows 365.  
• An AI‑powered corporate badge with a touchscreen, fingerprint sensor, microphone array, and side‑facing camera enabling hands‑free documentation, contextual capture, and workflow automation. 

These devices run on the Microsoft Device Ecosystem Platform (MDEP), an enterprise‑grade OS built on the Android Open Source Project, managed through Intune and secured with Entra ID. 

This is not consumer hardware. It is a deliberate move to support industry‑specific workflows in healthcare, retail, logistics, and field operations with organizations like CVS Health, Levi’s, Target, and AccuWeather already exploring pilots. 

Why Project Solara Matters for Data Governance

Solara is not just a hardware announcement, it is a governance milestone.

1. Identity‑bound, policy driven access

Every Solara device authenticates through Entra ID and Windows Hello for Business, ensuring that AI agents operate within role‑based access controls and enterprise identity boundaries. 

2. Intune‑managed, enterprise grade device compliance

Because Solara devices are managed through Microsoft Intune, organizations can enforce:

• Configuration baselines  
• Conditional access  
• Device compliance policies  
• Remote wipe and lifecycle controls  

This brings agent‑first devices into the same governance perimeter as laptops, mobiles, and IoT endpoints.

3. Cloud centric intelligence, not local models

Solara devices intentionally do not run local AI models. All intelligence lives in Azure, reducing:

• Data residency risk  
• Model drift  
• Shadow AI  
• Unmonitored local inference  

This architecture aligns with enterprise governance expectations for centralised oversight and auditability. 

Responsible AI: Embedded in the Platform’s Design

While Microsoft has not yet published a standalone Responsible AI standard for Solara, the announcement and technical framing clearly align with Microsoft’s broader Responsible AI commitments.

1. Privacy first hardware controls

Solara devices include physical privacy features, such as hardware microphone mute switches. 

2. Context aware, role aligned Agent behaviour

In healthcare demonstrations, agents adapt to the user’s role and workflow supporting documentation, scanning medications, and verifying patient data. This reflects principles of:

• Human‑centred design  
• Transparency  
• Safety in high‑risk environments  

3. Multi‑Agent, Open Ecosystem, not a single black box

Solara is explicitly designed as an open multi‑agent system, allowing organisations to integrate their own agents via:

• Copilot Studio  
• Microsoft 365 Agents SDK  
• Azure Agent Framework  

This reduces vendor lock‑in and supports accountability, traceability, and custom governance controls. 

What This Means for Organisations

Project Solara signals a future where AI is:

• Ambient present in every workflow  
• Contextual aware of environment and role  
• Governed bound by enterprise identity, policy, and compliance  
• Responsible designed with privacy and safety in mind  

For data governance and responsible AI leaders, Solara represents the next frontier: governing AI not just in software, but in physical devices that operate across the enterprise landscape.

This is the beginning of a new category of agent‑first hardware and it will reshape how organisations design, deploy, and govern AI at scale.

Seen but Not Heard: The Age of Data Governance

There’s a phrase I remember being told as a child  “seen but not heard.”

At the time, it meant quiet compliance. Something present, something acknowledged, but not something that shaped the room or influenced what happened next. Strangely, that’s exactly how organizations have treated data governance for years. It has always been there, in the background. Policies exist, frameworks have been written, roles have been defined. If you look hard enough, every organization can point to where governance sits. It is visible. It is documented. It is technically present but it hasn’t truly been heard. It hasn’t influenced how systems are designed, how teams deliver, or how decisions are made in the way it should. Instead, governance has often been something that follows behind delivery as a correction, a control, a necessary inconvenience once the “real work” has already been done. That made sense, once but it doesn’t any longer.

What has changed is not governance itself, it is the world around it. We now operate in organizations where data is not a by-product of activity; it is the thing everything depends on. Strategy is built on it, operations are driven by it, and increasingly, decisions are delegated to systems that rely entirely on it. There is no part of a modern organization that sits outside of data anymore and yet, governance is still too often treated as if it does. That tension is becoming impossible to ignore because when every system depends on data, every issue becomes a governance issue. When numbers do not align between reports, when teams cannot agree on definitions, when ownership is unclear, when trust in outputs begins to erode these are not technical failures in isolation. They are symptoms of something deeper: a lack of embedded governance. You can see this play out repeatedly. Organizations invest in platforms, they modernise architectures, they implement analytics solutions, they adopt AI. Each initiative is presented as progress, and in isolation, it often is. But without governance woven into the fabric of these initiatives, complexity accumulates rather than resolves. Data spreads, inconsistency grows, and the ability to explain or trust what is being produced gradually diminishes. Governance, in those moments, has been seen but it was never allowed to shape the outcome.

The emergence of AI has brought this reality into sharper focus. For years, organizations could tolerate a degree of inconsistency in their data. It caused frustration, inefficiency, and occasionally risk, but it remained manageable. AI does not allow for that tolerance. It amplifies whatever it is given. Good data becomes insight at scale. Poor data becomes risk at scale. There is no neutral outcome. The old saying “garbage in, garbage out” still applies, but it now applies faster, at greater scale, and with far more impact than before. When decisions begin to be influenced or even made by systems fed on ungoverned data, the consequences are no longer contained within individual processes. They affect entire organizations. At that point, governance is no longer a supporting capability. It becomes the condition for whether anything works at all.

This is why the idea that governance can be added later no longer holds. It is not something that can sit alongside delivery or follow it. Governance determines what “good” looks like before anything is built. It defines ownership, establishes meaning, sets expectations, and ensures consistency. Without it, delivery moves forward, but coherence does not and that is the subtle but critical shift that is still being missed. We are not entering a stage where governance becomes more important as a standalone discipline. We are entering a stage where governance becomes inseparable from everything else. It is not another workstream to manage it is part of how every workstream operates. Every technology solution carries assumptions about data. Every integration defines how data flows. Every report reflects decisions about meaning, quality, and trust. Every AI model relies on choices about what data is used and how it is interpreted. In all of these cases, governance is already present. The difference is whether it has been made explicit, intentional, and embedded or whether it remains invisible until it fails.

One of the reasons organizations struggle with this shift is that governance has historically been framed in the wrong way. It has been positioned as a control mechanism, something that restricts or slows progress. It has been documented extensively, but lived infrequently. It has often been assigned to a function rather than understood as a shared organizational responsibility. As a result, it has been treated as optional in practice, even when it is mandatory in principle but when governance is embedded properly, it does not slow organizations down. It removes uncertainty. It allows decisions to be made with confidence because there is clarity around ownership, meaning, and quality. It reduces rework because expectations are clear from the outset. It enables innovation because it provides the guardrails that make experimentation safe. In other words, it makes progress sustainable.

The irony is that most organizations are already feeling the consequences of not doing this, even if they do not describe it in those terms. The questions that surface in meetings about which version of the truth to trust, about who is responsible for a dataset, about whether something can be used safely or compliantly are all governance questions. They just are not recognised as such and because they are not recognised, they are not addressed systematically. Instead, they are solved locally, temporarily, repeatedly. Governance remains visible in theory, but unheard in practice.

We are now at a point where that is no longer viable. If data is the thing that everything depends on, then governance must be the thing that everything contains. Not as an overlay, not as an afterthought, but as a standard, embedded part of how organizations operate. This is the age of data governance — not because governance is new, but because the absence of it is no longer survivable. The organizations that recognise this will not be the ones with the most advanced tools or the largest data estates. They will be the ones that understand their data well enough to trust it, control it, and use it consistently across every part of the business. They will be the ones that stop simply seeing data governance, and finally start listening to what it has been telling them all along.

Microsoft Announces Scout: An Always‑On Autonomous Agent for Work

Microsoft has unveiled Scout, its first Autopilot agent, an always‑on, autonomous digital assistant designed to work across Microsoft 365, proactively coordinating tasks, managing workflows, and keeping work moving even when you’re not in the loop. What makes Scout different is its ability to operate with its own identity, act within organisational policies, and build long‑term context through WorkIQ, learning how you work and what matters most. But beneath the excitement, there’s a deeper story for those of us working in data governance and Responsible AI.

Where Scout Meets Data Governance

Microsoft has been explicit: Scout is built with enterprise‑grade security, policy enforcement, and auditability from day one. Key governance‑aligned capabilities include: Policy‑constrained identity Scout acts only within the permissions and boundaries your organisation sets. Execution containers & OS‑level sandboxing  reducing risk when agents access files, run code, or interact with networks. Continuous policy conformance checks every action is validated against organisational guidelines, producing an audit trail. This is a significant shift: AI agents are no longer “black boxes” running in user sessions, they’re governed, monitored, and contained as first‑class enterprise actors.

Responsible AI: Built Into the Foundation

Microsoft has also published Responsible AI documentation for Scout, reinforcing that it is part of a broader commitment to safe, transparent, and accountable AI systems. 

Highlights include:

• Responsible AI FAQs explaining how Scout works, what data it accesses, and how system owners can shape behaviour.  
• Tiered permission systems for file access, shell commands, and browser automation.  
• Human‑in‑the‑loop expectations and environmental considerations for deployment.  

This aligns Scout with Microsoft’s AI principles of fairness, reliability, safety, privacy, security, inclusiveness, transparency, and accountability.

Why This Matters

For organisations already investing in data governance, AI assurance, and operational Responsible AI, Scout represents a new category of enterprise agent:

• Autonomous enough to reduce coordination overhead  
• Governed enough to meet compliance and risk expectations  
• Context‑aware enough to become a durable part of the digital workforce

This is the moment where AI agents stop being assistants and start becoming accountable digital colleagues  operating within the same governance frameworks as humans and systems.

Microsoft Build 2026: The Moment Governance Became the Bottleneck, Not Innovation

If last year’s narrative was about what AI can do, Microsoft Build 2026 marked a noticeable shift: the conversation has moved firmly to what organizations must control.

Across two days of announcements, Microsoft made one thing clear. The next phase of enterprise AI will not be defined by better models or more copilots. It will be defined by whether organizations can operationalise data readiness, governance, and trust at scale.

And that is where the most important announcements sit.

From “AI Features” to “AI Systems That Act”

The headline innovation at Build wasn’t just new models, it was the emergence of autonomous AI agents as first-class enterprise actors.

Microsoft introduced Scout, an always-on AI agent capable of continuously operating across enterprise systems, taking actions rather than waiting for prompts.
This marks a fundamental shift from assistive AI to operational AI, software that executes tasks, interacts with systems, and makes decisions within workflows. 

But this also introduces a new governance reality.

When AI moves from generating content to acting on behalf of a business, the questions change:

• Who is accountable for the action?
• What data did the agent access?
• What policies constrained its behaviour?

Microsoft’s answer is not a single tool but an emerging governance architecture for agents.

Governance Is Now Part of the Platform (Not an Add-On)

Across the announcements, governance was not positioned as a compliance afterthought. It was embedded into the core platform.

Three developments stand out.

Agent identity, control, and auditability

Agents are now designed with their own identities, permissions, and audit trails that essentially are becoming governed entities within enterprise systems.
This is a critical shift: governance is no longer about users accessing data, but about non-human actors operating within policy boundaries. 

The rise of the agent control plane

With capabilities such as Agent 365 and broader governance frameworks, Microsoft is building what can only be described as a control layer for AI agents covering access control, visibility, monitoring, and compliance. 

This moves governance from static policies to continuous oversight of autonomous systems.

Built-in safety, evaluation, and testing

The introduction of evaluation frameworks like ASSERT (for testing AI behaviour against policy expectations) signals a shift toward engineering governance into the development lifecycle itself. 

This aligns closely with emerging standards (ISO/IEC 42001, EU AI Act), where governance is expected to be designed, evidenced, tested and not assumed.

Data Governance Quietly Took Centre Stage

While the headlines focused on models and agents, the more important story sits underneath: data is now the limiting factor for AI.

Microsoft’s investment in Fabric including a GPU accelerated data warehouse positioned as an execution layer for AI workloads reflects a deeper truth: organisations don’t lack AI capability, they lack AI-ready data environments. 

This reinforces a theme many of us have been seeing on the ground:

The challenge is no longer can we use AI?
It is can we trust the data, control its usage, and scale it responsibly?

Even outside the keynote announcements, updates across Microsoft Purview continue to evolve around:

• data quality management,
• data loss prevention for AI interactions,
• and governance across expanding AI estates. 

Taken together, this signals a more mature positioning that data governance is not supporting AI, it is enabling it.

A New Stack: AI, Data, and Governance as One System

Perhaps the most important architectural shift is how Microsoft is framing the AI stack.

At Build 2026, governance was explicitly treated as a foundational layer alongside compute, models, and tools. 

This is subtle but significant.

Previously, governance sat outside the stack:

• something imposed after deployment,
• owned by risk or compliance functions,
• often disconnected from engineering.

Now, governance is:

• integrated into runtime environments,
• embedded in agent frameworks,
• and enforced through platform capabilities.

This is a move toward operational governance, not theoretical governance.

What This Means for Businesses

For organizations, these announcements are less about new features and more about a change in expectations.

AI adoption will be constrained by governance maturity

The organizations that succeed will not necessarily be those with the most advanced models but those with:

• clear data ownership,
• defined policies for AI usage,
• and the ability to monitor and control AI behaviour continuously.

Governance becomes a cross-functional discipline

AI governance can no longer sit solely with data teams or compliance functions. It now spans:

• data governance,
• security,
• enterprise architecture,
• and operational risk.

Tools alone will not solve the problem

While Microsoft is building an increasingly comprehensive governance ecosystem, the platform assumes something critical:

Organisations already understand their data, risks, and policies.

In reality, many do not.

This is where the gap and the opportunity sits.

The Real Announcement wasn’t a Product

If you step back, the most important announcement at Build 2026 wasn’t a model, a Copilot update, or even an agent.

It was a shift in narrative.

Microsoft is signaling that:

• AI is no longer experimental.
• Agents will become embedded in everyday business operations.
• And governance is now the primary barrier to scale.

In other words, we’ve moved from the innovation phase of AI to the industrialisation phase.

And industrialisation always introduces the same question:

How do you scale safely, consistently, and with accountability?

That is not a tooling question. It is a Data and AI governance question.

References

forbes.com  dqindia.co  theneuron.ai  microsoft.github.io  pulse2.com 

forbes.com  learn.microsoft.com  theneuron.ai

Governing the agents not just the AI

The current wave of agentic AI is not just another iteration of automation, it is a shift from models that advise to systems that act. In the Fortune piece summarised via Yale Insights, the central risk is not capability but placement: where agents are deployed in the business and how close they operate to customers, decisions and trust. The “proximity framework” highlights that the closer an agent gets to irreversible, customer-facing decisions, the greater the governance burden becomes, with failures having disproportionate reputational impact. What is emerging consistently across follow-on work in banking, healthcare, retail and supply chain is that governance is lagging deployment, with organizations actively running agents across operations while still relying on fragmented or incomplete control models. This reinforces a point you often make in governance conversations: the problem is no longer whether AI works, but whether organizations can safely operationalise decision rights at scale. 

When you bring data governance into this, the conversation sharpens significantly. Multiple recent articles move beyond model governance and focus specifically on how agents access and use data, often autonomously and continuously. Agent Access Management reframes governance as a data problem, not just identity, because agents inherit permissions dynamically across APIs, workflows and services, often without visibility into what they can actually reach. Traditional access governance breaks here because it assumes static roles and human review cycles, whereas agents operate continuously and at machine speed, creating access patterns that are technically authorised but contextually inappropriate. This is why newer guidance emphasises data-aware controls, real-time monitoring and understanding not just who the agent is, but what data it is using and why. It aligns strongly with emerging audit expectations, where organizations must evidence which agents exist, what data they access, and how decisions are controlled and explained. 

What is becoming clear across the literature is that governance for agents is not an extension of traditional AI governance, it is a redesign of enterprise control models. Firms like IBM and McKinsey point out that governance needs to move from validating outputs to controlling actions, defining scope, ownership and accountability for autonomous decision-making. At the same time, platform and vendor ecosystems are converging on concepts like control planes, agent registries and data-centric governance layers to ensure visibility and enforce policy at runtime. The consistent thread across all of this is that trust in agentic AI is not built at the model layer, it is built at the data access and execution layer. That is where governance now has to operate, and it is where most organisations are still weakest. 

References

Fortune / Yale source 

• A Guide to Getting Agentic AI Right 
• Agentic AI governance framework

Supporting governance and agentic AI articles

• Anthropic’s most powerful AI model just exposed a crisis in corporate governance (Fortune summary) 
• Agentic AI governance lags deployment across industries (Yale study summary) 
• Agentic AI poses new governance challenges (LinkedIn News)

Agent governance frameworks and operating model shifts

• Agentic AI governance playbook (IBM) 
• Trust in the age of agents (McKinsey) 
• Building agent-first governance and security (MIT Technology Review) 
• Governance and security for AI agents (Microsoft) 

Data access governance and agent-specific governance

• Agent Access Management (AAM) – data-first governance for AI agents (Cloud Security Alliance) 
• AI Agent Data Governance Enterprise Playbook 2026 
• The rise of AI agents is breaking access governance (Security Today) 
• Data governance frameworks for managing AI agent data access (Agentplace) 

Audit, compliance and enterprise deployment considerations

• Your auditor is about to ask about AI agents (Vanta summary) 
• ServiceNow expands AI agent governance control layer (Forbes) 

Operationalising Responsible AI: What Microsoft’s Approach Reveals

Responsible AI has become one of those phrases that organisations like to reference but rarely operationalise. It appears in strategy decks, risk registers, and conference panels, yet the practical mechanisms that make it real are often missing.  

Microsoft’s recent article on its internal responsible‑AI approach is useful not because it offers something radically new, but because it demonstrates what it looks like when a large organisation treats responsible AI as a discipline rather than a marketing narrative.

Below are the core lessons worth thinking about especially if you’re trying to move your organisation from aspiration to implementation.

1. Responsible AI is an organisational discipline, not a technical feature

The most important message is also the simplest: responsible AI only works when it is treated as a governing framework that shapes how AI is designed, deployed, and monitored.   This is not a “nice to have”. It is not a late‑stage review. It is not a compliance tick‑box.  It is a structural commitment that defines how decisions are made, how risks are surfaced, and how accountability is distributed. If organisations are still treating responsible AI as a technical add‑on, you will not scale safely.

2. A central authority is essential for coherence

Microsoft’s Office of Responsible AI functions as a single point of truth. It sets policy, interprets standards, and ensures that teams are aligned.  This matters because without a central authority, governance fragments. Different teams make different assumptions. Risk becomes inconsistent. Decisions become harder to audit. A central function does not need to be large, but it does need to be authoritative. It needs the mandate to say “no”, “not yet”, or “not like this”.

3. Distributed oversight is the only scalable model

A central team cannot carry the entire burden. Microsoft’s model. A senior council supported by a network of responsible‑AI champions is the only realistic way to scale oversight across a complex organisation. This mirrors how other disciplines have matured:  

- data protection officers and privacy champions  

- security teams supported by local security leads  

- governance functions with embedded practitioners  

The pattern is consistent with central clarity and distributed execution. If you want responsible AI to work, you need people embedded in delivery teams who understand the risks and know how to escalate them.

4. A unified workflow is the backbone of responsible AI operations

One of the most practical elements of Microsoft’s approach is its internal workflow tool. Every AI project is logged, assessed, and reviewed through a single structured process. This creates:  

- traceability  

- auditability  

- consistent risk categorisation  

- clear escalation routes  

- visibility across the portfolio  

Most organisations underestimate how much risk comes from fragmentation. If you don’t know what AI systems exist, you can’t govern them. A unified workflow is not optional. It is foundational.

5. Culture and process design matter more than tooling

The article makes a point that resonates strongly with anyone who has worked in governance, the tools support the work, but they do not define it. If you don’t have:  

- clear expectations  

- shared language  

- leadership commitment  

- a culture that values scrutiny  

no tool will save you. Responsible AI succeeds when the organisation behaves as if it matters — not when it installs a dashboard.

Thrre are some actionable steps for organisations to take to build their own responsible AI capability. These are the practical takeaways that any organisation can adopt immediately.

1. Start with a written standard

Define what “good” looks like. Set mandatory requirements. Clarify what triggers deeper review. This becomes your anchor.

2. Build a network of responsible AI practitioners. Identify people with the right instincts, governance‑minded, risk‑aware, delivery‑literate. Train them and Empower them.

3. Design the assessment process before you build tooling. Clarify the workflow:  

- What must every project declare?  

- Who reviews what?  

- How are risks escalated?  

Only then should you build or buy tools.

4. Integrate responsible AI checkpoints into delivery. Move away from late‑stage reviews. Embed assessments into initiation, design, and release readiness.

5. Treat bias detection and data quality as non‑negotiable. Bias is rarely intentional; it is inherited. Build structured checks into your evaluation pipeline.

6. Assign responsibility for monitoring regulatory change. Someone needs to track global AI regulation and translate it into internal practice. This prevents compliance surprises.

7. Use the open resources already available

Microsoft’s Responsible AI Toolbox, Human‑AI Experience guidance, and impact‑assessment templates provide a strong foundation. Use them to accelerate maturity.

Responsible AI is not about slowing innovation. It is about enabling it safely, predictably, and sustainably.  The organisations that will thrive in the next decade are those that treat responsible AI as a discipline with structure, clarity, and accountability, rather than a slogan.

Read more here.

Inside Microsoft’s Responsible AI Framework: What Matters for Data Governance

Microsoft’s updated Responsible AI framework represents a significant evolution in how organisations are expected to approach AI oversight. While the principles themselves, fairness, reliability, safety, privacy, inclusiveness, transparency, and accountability are familiar, the operational expectations behind them have deepened. This isn’t a philosophical document; it’s a practical guide for embedding responsibility into the lifecycle of AI systems.

For data governance leaders, the most important shift is the emphasis on traceability. The framework makes it clear that organisations must be able to explain how data flows into models, how those models behave, and how decisions are made. This requires robust lineage, versioning, and monitoring. Without these, transparency becomes impossible.

Another critical element is human oversight. The framework reinforces that AI should augment, not replace, human judgement. This means governance must ensure that humans remain in the loop for high‑impact decisions, and that they have the context needed to interpret model outputs. Oversight is not a checkbox, it is a design requirement.

The framework also highlights the importance of data quality and representativeness. Poor data leads to poor models, and poor models lead to poor outcomes. Governance must ensure that training data is accurate, relevant, and free from harmful bias. This is where stewardship, classification, and quality controls become essential.

Finally, the framework calls for ongoing monitoring, not one‑time validation. Models evolve, data changes, and risks shift. Governance must be continuous, adaptive, and embedded into operational workflows.

The Microsoft Responsible AI Standard

Microsoft named a Leader in IDC MarketScape for Unified AI Governance Platform

Tracing my career journey though my blog

I was looking at my blog stats this morning and was really interested to see the geographical spread. I started writing my blog in 2011 and it has been read by 1.18m. I wanted to record all the technical tips I found and technology advancements which were useful to me and might be of use to help others. I started writing on SQL Server and the blog has migrated with me throughout my career through architecture, my PhD research and over the last few years I have been mostly writing on Data Governance, Microsoft Purview, AI Governance and Microsoft Fabric. 

I asked Copilot to share some interesting thoughts about my journey for my blog and here is what it thought.

Your blog reveals a journey defined by intellectual curiosity, data‑driven leadership, and a distinctive narrative voice. Here are five evidence‑based, genuinely interesting aspects of that journey.

1. You frame data leadership as a process of unlearning, not just learning

Your post “What data leaders must unlearn to lead in the Age of AI” argues that modern leadership requires shedding outdated assumptions, such as believing governance slows innovation or that documentation equals understanding. This reframing positions you as a thought leader challenging entrenched industry norms. 

2. You consistently connect research, industry practice, and philosophical curiosity

Your blog tagline “Chaos, complexity, curiosity and database systems” captures a rare blend: deep technical expertise paired with a reflective, almost philosophical lens on data systems. This fusion shapes your writing style and differentiates your professional voice. 

3. You document the shift from AI experimentation to AI industrialisation with governance at the centre

In your coverage of the Gartner Data & Analytics Summit, you highlight how governance has moved from a compliance checkbox to the engine of AI ROI. This shows your role as an interpreter of industry change, translating large‑scale trends into practical insights for practitioners. 

4. Your journey is grounded in both academic achievement and community leadership

Across external references, you are consistently described as a Microsoft Data Platform MVP, a PhD researcher recognised with the AOUG Will Swann Award, and a founder/organiser of Data Toboggan. This positions your blog as the narrative thread connecting your academic, professional, and community contributions. 

5. Your posts reveal a long‑standing commitment to making governance practical, accessible, and embedded

Whether discussing AI oversight, lineage, behavioural metadata, or Purview governance models, your writing emphasises practical implementation over theory. You repeatedly advocate for governance that is embedded, automated, and literacy‑driven, showing a consistent philosophy across years of posts. 

GCRAI and the Rise of GRAICE™: A New Global Framework for Responsible AI Governance

The global conversation around responsible AI has been dominated for years by national strategies, corporate principles, and academic frameworks. But the launch of the Global Council for Responsible AI (GCRAI) and its GRAICE™ framework marks a shift toward something far more ambitious: a unified, cross‑sector, cross‑industry operating system for AI governance. Unlike many initiatives that focus on high‑level ethics, GCRAI positions itself as a mechanism for operationalising responsibility at scale. It’s an attempt to move responsible AI from aspiration to enforceable practice.

What makes GCRAI notable is its global footprint. With representation across dozens of countries and a network of ambassadors, it aims to create a governance ecosystem that transcends borders and industries. This matters because AI risk is not localised. Models trained in one region influence decisions in another. Data flows across jurisdictions. And the consequences of AI misuse rarely stay within organisational boundaries. A global framework is not just desirable, it is necessary.

The GRAICE™ framework, unveiled at Davos, is positioned as “humanity’s operating system for AI.” While the branding is bold, the intent is clear: create a standard that is actionable, measurable, and adaptable. GRAICE™ focuses on transparency, security, accountability, and human‑centric design. But what sets it apart is its emphasis on measurable compliance. Many frameworks articulate principles; GRAICE™ attempts to define behaviours. It seeks to bridge the gap between what organisations say about AI and what they actually do.

Running alongside GCRAI is the G.R.A.C.E. Global Council for AI, which articulates a complementary set of principles centred on human‑centred AI. Their pillars emphasise mission, vision, and the balance between technology, ethics, and humanity. While still evolving, the G.R.A.C.E. principles reinforce the idea that responsible AI is not just a technical discipline but it’s a societal one. They highlight the need for AI systems that enhance human capability rather than diminish it, and for governance that protects people as much as it protects organisations.

Together, GCRAI and G.R.A.C.E. represent a growing recognition that responsible AI cannot be solved by isolated efforts. Organisations need frameworks that are interoperable, globally recognised, and grounded in real‑world practice. They need standards that can be implemented, audited, and adapted as technology evolves. And they need governance models that reflect the complexity of modern AI systems and systems that learn continuously, behave unpredictably, and operate across boundaries.

For data and AI leaders, the emergence of GRAICE™ is a signal. The era of voluntary, principle‑only responsible AI is ending. The next phase is about operationalisation, measurement, and accountability. Whether organisations adopt GRAICE™ directly or use it as a benchmark, its influence will shape how responsible AI is defined, governed, and enforced in the years ahead. This is not just another framework but a part of a global shift toward responsible AI as a shared, enforceable standard.

G.R.A.C.E. is

GROUNDED

RESPONSIBLE

AUTHENTIC

COMPASSION

ETHICAL

Every decision involving AI should align with moral truth, respect for life, and integrity of purpose through moral align

https://www.graceglobalcouncil.com/

https://gcrai.ai/

How Responsible AI frameworks shape the future of AI Governance

The responsible AI landscape is shifting fast. Organisations are no longer looking for a single framework to rule them all; they’re looking for interoperability, clarity, and practical pathways to operational maturity. Two frameworks are increasingly shaping that conversation: GRAICE™, the new global framework from the Global Council for Responsible AI (GCRAI), and Microsoft’s Responsible AI Standard, one of the most established engineering‑level governance standards in the industry.

These frameworks are often discussed in the same breath, but they operate at different layers of the governance stack. Understanding that distinction is essential — because it’s precisely what makes them complementary rather than competitive.

GRAICE™: A Global Meta‑Framework for Cross‑Sector Alignment

GRAICE™ is designed as a global, cross‑sector framework. Its purpose is not to replace organisational or vendor standards, but to provide:

- a shared global vocabulary for responsible AI  

- a principles‑level structure that governments, industry, academia, and civil society can align to  

- a meta‑framework that organisations can map their internal standards against  

- a societal‑level lens that sits above implementation detail  

GRAICE™ is intentionally broad. It sets direction, coherence, and expectations at a global level — the “north star” rather than the engineering manual.

Microsoft’s Responsible AI Standard: Operational Discipline for Real Systems

Microsoft’s Responsible AI Standard sits at a different layer: the practical, engineering‑focused layer where teams build, evaluate, deploy, and monitor AI systems.

It provides:

- detailed lifecycle requirements  

- controls for data, evaluation, transparency, and oversight  

- guidance for product teams and engineering functions  

- mechanisms for translating principles into day‑to‑day practice  

Where GRAICE™ is global and principle‑driven, Microsoft’s standard is specific, actionable, and operational.

Complementary by Design

This is the critical point:  

GRAICE™ does not replace Microsoft’s Responsible AI Standard — or any other organisational framework.

Instead, the two frameworks operate in a layered model:

- GRAICE™ → global alignment, societal expectations, cross‑sector coherence  

- Microsoft RAI Standard → engineering discipline, implementation controls, operational maturity  

Together, they create a governance ecosystem that is:

- globally relevant  

- locally actionable  

- technically grounded  

- aligned with societal expectations  

This layered approach reflects where responsible AI is heading: ecosystems of interoperable frameworks, not a single universal standard.

Where They Converge

Despite their different scopes, both frameworks reinforce core responsible AI expectations:

- transparency as a foundation for trust  

- accountability and human oversight  

- continuous monitoring of evolving systems  

- responsible AI as an ongoing operational commitment  

These shared foundations show a field moving toward coherence, even when frameworks serve different purposes.

The Real Opportunity: Use Them Together

For organisations, the value lies in the combination:

- GRAICE™ provides the global direction and cross‑sector alignment.  

- Microsoft’s Responsible AI Standard provides the operational machinery to implement responsible AI in real systems.  

Using both gives organisations a governance model that is both strategically aligned and practically executable — exactly what mature AI governance requires.