Recommendations
Industry experts say a strong, effective governance framework—backed up by appropriate technology—is essential for today’s data security practices. This requires a shift toward facilitating active, trusted data ecosystems. “The future of data management is about finding and then using your data, both structured and unstructured, into a fully converged data management platform,” said Shah. The following are ways to accomplish this:
Make data governance a top enterprise priority. The key is to “treat data governance the way we treat other critical infrastructure: with real-time, AI-augmented controls with humans in the loop built on top of a standardized data substrate,” Tsai urged. Avoid static policies “layered on top of a patchwork of systems, as in the days of old.”
Build a living data inventory and classification system. Do this “before you write a single line of policy,” advised Gorman. “Make sure that classification, covering things like PII [personally identifiable information], PCI [payment card industry], and intellectual property, spans relational systems, lake environments, and application embedded data uniformly.” In addition, Gorman added, “push identity and access control down to the data layer itself instead of leaving it stuck at the application layer, so entitlements follow the data through a catalog-enforced policy.”
Proactively keep shadow AI in check. “Invest in training people and not just systems,” Gorman advocated. “Most shadow AI use isn’t malicious at all. It’s usually just a knowledge worker trying to get their job done without fully understanding what they’re pasting into a chat window.”
Embed data governance deeply into the platforms and tools teams use. The key is to be able to “automatically and quickly control agent and language model interactions. AI can only operate with the data provided to it,” said Tsai. “Since humans are held accountable for the actions of AI for the foreseeable future, governance of the organization’s data estate needs to be front and center in a data strategy.”
Build a governance model to change, not to stay static. Governance models need to evolve. “AI introduces probabilistic outcomes, which means organizations need to move beyond static controls,” said Shah. Instead, develop “toward continuous monitoring, clear escalation paths, and alignment across IT, security, and the business—all reinforced by a disciplined feedback loop that turns real-world outcomes, incidents, and performance signals into regular updates to policies, controls, and risk thresholds.”
Too much governance may even throttle innovation. “Governance is an ongoing process, so make sure to get feedback about your AI policy from employees and see whether it’s clamping down on any tools that they find useful,” said Simpson. “Finding a middle balance between harsh protection and letting employees use these tools is the right way forward. If you’re too strict, then you’ll find that people use these tools anyway as shadow IT, creating another visibility issue. It’s a difficult line to walk on, but communication across your organization and clarity about why your AI policy is the way it will help people use these tools securely.”
The bottom line is that protecting data should not be viewed simply as a “compliance obligation,” said Herold. “Rather, it is a responsibility to customers, employees, patients, business partners, and others whose information an organization collects and controls.”