Data Governance for AI

When data flows into a prompt, a retrieval index, or a training set, classification decisions made years ago stop being sufficient. The same record can be acceptable in a database and prohibited in a third-party model's context window.

This engagement extends your existing classification, lineage, access, and retention practices to AI data flows, with explicit handling rules for what may reach a model, what must be logged, and what must never leave your boundary.

What you receive

AI data inventory: sources feeding prompts, retrieval indexes, fine-tuning, and evaluation sets
Data classification standard extended with LLM handling rules per classification level
Lineage and data-flow maps for in-scope AI systems
Data-use approval workflow for new AI use cases
Retention and deletion rules, including model-provider data terms
Monitoring requirements and key risk indicators for AI data exposure

How the engagement runs

Discover

Identify AI systems and the data sources feeding each, with data owners and stewards.

Classify and set rules

Extend the classification scheme with AI handling rules and resolve edge cases.

Map lineage and controls

Document data flows end to end and assess access, retention, and monitoring controls.

Operationalize

Approval workflow, key risk indicators, and a remediation plan with owners.

Frameworks and standards

DAMA-DMBOKEDM Council DCAM / CDMCNIST Privacy FrameworkISO/IEC 5259 (data quality for ML)NIST AI RMF (Map)GLBACCPA/CPRAGDPR

Questions

We already have a data classification policy. Why change it?

We extend it rather than replace it. Most policies define storage and transmission rules but not whether data may be sent to a model, logged in prompts, or used for training.

Do you implement DLP or DSPM tools?

We define the requirements and policies those tools enforce, and can evaluate tool fit. Tool deployment is handled by your team or integrator.

Govern the data that feeds your models, prompts, and retrieval