How we work / Governance
Data and AI governance
Governance means knowing exactly who and what can reach your data, and being able to show what happened to it. When AI comes in, it becomes urgent. Governance closes the gaps that data leaks through.
Governance, in one picture
Every time data moves, it is recorded.
Each time data moves, the record shows who moved it, what was done, where, when, how, and with which account or tool. Approved moves go through. A move that is not approved is blocked and recorded.
Illustrative only: the teams and systems are made up, and one blocked request is shown. Governance closes the gaps that data leaks through; it cannot promise that nothing will ever leak.
What governance really is
Without the jargon, data governance comes down to two things.
Protection: your data can be reached only by the people, and the systems, that should reach it.
Accountability, from end to end: for every piece of data that matters, you can answer six questions.
- 1
Who
Which person reached it, or which system acting for a person.
- 2
What
What was done: read, changed, copied, shared or deleted.
- 3
Where
In which system, on which device, in which country.
- 4
When
The date and time, kept long enough to look back.
- 5
How
Through which app, connection or route.
- 6
With what
With which account, key, tool or AI service.
Systems count as much as people. Integrations, automations, service accounts and now AI agents read and move data all day, often with more access than any one person. IBM's 2026 research found fewer than half of organisations are actively securing these non-human identities (IBM, 2026 Cost of a Data Breach findings, read 04/10/2026).
To answer those six questions you need an audit trail on the data that matters, and controls and policies on who and what may reach it and where it may go. Together they show what normal use looks like, so misuse is easy to see.
Then AI arrives
AI comes into an organisation three ways at once:
- Tools staff sign up for, often on their own cards, so nobody else knows they exist.
- AI features switched on inside software you already pay for, with no purchase, no approval and new paths for your data.
- Usage bills from AI providers that grow with every request.
Shadow AI is AI used without approval. People paste customer details, contracts, source code and plans into tools nobody approved, usually to get a job done faster and with no real sense of where that data goes next. It is rarely malicious, which is exactly why it gets missed. Nobody keeps a list of these tools, so nobody can say where the data went.
IBM and Verizon both sell security products and services. The average breach cost is across the organisations studied, mostly larger ones; a small business's cost will be different.
The risks, now and later
Immediate risks
- Personal data pasted into a tool you do not control can be a data breach under data protection law, with the duty to report it that follows.
- Client data sent to an unapproved tool can breach your contract and your confidentiality agreement with that client.
- Company knowledge, source code, prices and plans leave the organisation, and there is no record of where they went.
- When a client or a regulator asks what happened, there is no audit trail to answer from.
Over time
- Data handed over under terms nobody read may be kept by the provider and, depending on those terms, used to improve its service. It cannot be called back.
- AI agents and automations collect access that nobody reviews, and use it day and night.
- Habits become fixed. The longer AI is used without governance, the harder it is to control without stopping the work it supports.
- Trust is slow to rebuild. Clients who learn that their data went into a tool nobody approved may stop trusting you, whatever a regulator decides.
Regulators have already set the maximum fines. Under Europe's data protection law (GDPR), fines reach EUR 20 million or 4% of worldwide yearly turnover, whichever is higher (GDPR, Article 83, read 04/10/2026). Europe's AI Act sets fines of up to EUR 15 million or 3% of worldwide turnover for breaking the obligations on those who provide and use AI systems, and up to EUR 35 million or 7% for banned practices; for smaller businesses the lower of the two figures applies (EU AI Act, Article 99, read 04/10/2026). Rules differ by country, and which ones apply to you is a question for your legal advisers.
Start simply: first steps for any size
Governance does not have to start with a large project. These seven steps work for one person and for a global company; what changes is how much there is to list and who does it.
- 1
List where your data lives, and the AI in use
Every system, shared drive, app and AI tool, with what it holds and who owns it. On your own: one page and half an hour. A team: one shared sheet. A large organisation: start with one business unit, and use sign-in and network records to find what nobody listed.
- 2
Write the one-page AI rule
What never goes into AI (for example personal data, client confidential data, passwords and keys, unreleased source code), and which approved tools may be used for what.
- 3
Move AI use onto business accounts
Use approved tools through company accounts whose data terms you have read, not personal free accounts that nobody can see into.
- 4
Secure how people sign in
Everyone signs in with their own account, multi-factor sign-in is on for email and anything holding personal or client data, and access is removed the day someone leaves.
- 5
Check systems as carefully as people
List connected apps, service accounts, API keys and AI agents. Remove anything nobody owns, and give the rest only the access they need.
- 6
Switch on the audit trail
Most business software already records who did what. Turn it on, keep it long enough to look back, and look at it.
- 7
Name an owner and review
One person owns the list and the rule, and reviews them: monthly at first, then quarterly. On your own, that person is you.
For the bigger picture, the US National Institute of Standards and Technology's AI Risk Management Framework is free and voluntary, built around four functions (Govern, Map, Measure and Manage), with a profile for generative AI published in July 2024 (NIST, read 04/10/2026).
ISO/IEC 42001: where these steps lead
ISO/IEC 42001 is the international standard for managing AI in an organisation, published in December 2023. It sets out the policies, roles, risk and impact assessments, controls and reviews an organisation uses to run AI responsibly, whether it builds AI, sells it or only uses it.
The seven steps above are its groundwork: a list of every AI use, an owner for each, a written rule, controlled access, a record of what happened, and a regular review. The standard then asks for more: an assessment of each AI system's effect on people, a reasoned choice of controls, internal audits and a review by management.
Certification against it is optional, and only an accredited certification body can grant it; ISO itself certifies no one. Our governance work helps you understand what the standard asks and lay this groundwork. We are not a certification body, and we do not audit or certify.
Why governance is the foundation of good spend management
The list governance needs is the same list spend management needs: every system, every AI use, who owns it, and who and what can reach it. You cannot put a cost on a system nobody knows exists, or hold anyone to a budget for a tool nobody owns. Shadow AI is a data risk and an unplanned cost at the same time.
That is why all our work starts with governance. See how spend observability and optimisation build on it, and how tokenomics traces each token of AI use to the team that owns it.
Check your own setup
A free self-check you can run on your own setup in about 20 minutes: 22 plain questions, each answered yes, partly or no. Your score is calculated for you, and every gap comes with what to look at first. It works for any size, from one person to a global company; questions that only matter above a certain size are marked, and you can skip them.
No sign-up and no email address. Download it and keep it.
How we help
The AI and technology cost review builds the register of every system and AI use, and scores your governance on the FinOps Crawl, Walk, Run scale. AI spend management keeps it up to date every month. Data governance for AI, setting the rules for putting your own data into AI, is scoped with each client: talk to us.
Start with a conversation.
In one call, tell us what you spend on and what worries you. If we can help, you get a written scope and price.
Book a first call