John Wernfeldt

It's so easy to start from the top, with the fancy shiny stuff around agentic AI and generative AI. And that's also how most people define AI nowadays.

However, there are other things underneath that need to work.

I think it's super important to really understand the bottom thing here, the data foundation, because that's what everything is built on.

If you don't have that in place, the ownership, the definitions, the data quality, the lineage, then everything above it will break. It will start to hallucinate, and you will make decisions based on unsolid information.

A great way to test if your governance is working is just to ask: which are the decisions that have been made in the past 90 days, and where are those documented?

If those are not documented anywhere, and you can't trace back who made them and why, then you don't really have a clear operating model around data governance.

Decision authority is the most important part here, because without that everything else will fail.

And if you're not making decisions then you will never be able to derive the tangible outcomes that you would like to.

This map of agentic AI is probably one of the best ones I've seen.

But have a look at where the arrow starts.

AI and ML, then deep learning, then gen AI, then agents, then full automation.

Five rings, around sixty labels, and none of them say who owns the data going into the first one.

Governance turns up twice, on two small stickies out near rollback mechanisms and retention policies.

That's more or less how it looks inside the organisations I walk into as well.

This is the version I now print and walk into AI strategy meetings with.

Last week, forty minutes into a diagnostic call, a CDO stopped me.

She told me her entire customer analytics pipeline depended on one Excel file maintained by one person.

This kind of happens on almost every call I have run this year.

The team always wants to start at the AI layer. I keep pulling the conversation down the stack, and we usually do not make it past Operational Reality.

Excel files, Slack threads, one person who knows how it works.

That is where AI in production fails, not at the model layer.

Most companies I work with have one of these four quadrants and call it data governance.

The most common version has artifacts. A catalog, a few metric cards, a policy document somewhere on SharePoint. Other companies build out roles instead. A CDO with no peer at her level, a Gov Council that meets quarterly, a DPO who is mostly there for the regulator. A few do concepts well, with decision rights on a slide and named ownership on another, both signed off by someone who left the company. Almost everyone has use cases queued up: AI pilots running on data the team does not trust.

Most governance business cases die in the rewrite, before the meeting even happens.

The pitch gets softened in the 48 hours before the meeting, the meeting happens anyway, and the funding question gets pushed to next quarter.

I have watched €2.4M in concrete GDPR exposure get rewritten as "significant regulatory risk" in that window. The pitch did not get worse exactly, but the teeth got pulled.

The image has five rows that decide whether a governance program gets funded or filed. Every row needs a number and a name attached.

I’ve sat in enough AI pitch meetings to know what the left-hand picture looks like in the deck. Model on top, data on the bottom, an arrow between them, a target date in the bottom right.

The project starts, and the team finds the right-hand picture.

Each of those layers is real work that has been deferred for years, because there was never a reason to fund it that the board cared about. Now there is one, complete with a deadline and a sponsor who built the timeline by counting to two.

Most data leaders I work with are convinced their board doesn’t get governance. The board gets it. They’re being sold the wrong thing.

When you walk in with “we need better metadata, our lineage is weak, our maturity score is low,” you’re describing your work. The CFO hears operational hygiene, the same kind of ask they get from every function with a tooling shortlist. It’s going to be funded last, if at all.

The version that gets funded sounds different. You walk in with a quantified risk in money, a value lever tied to a real business number, and a 90-day outcome you can be held to.

Governance exists to protect decisions, not data.

That line changes the whole conversation with the board. The moment you stop talking about data quality and start talking about decision quality, the room leans in.

I drew this framework after getting the same question from three different CDOs in the same month: “We have governance on our roadmap but nobody agrees on what it actually includes.”

So here are the layers, bottom to top:

Layer 1: Foundational data management. Data modelling, master data, integration, storage, security. Without foundations, every layer above is unstable.

I asked a client last month how many decisions their AI agent makes per day.

They said “maybe a few.”

We counted. It was over 600.

Which data source to query. How to interpret the metric. What context to include in the answer. Whether the output was confident enough to show a customer.

Every one of those is a decision. Every one of them had zero governance around it.

Nobody owned any of them. No documentation, no named reviewer, no exception process.

So I drew the levels of decision rights an AI agent actually has, and what humans need to own at each level.

Every governance program needs data owners. Almost nobody writes down what a data owner actually does.
 
So you end up with a name on a slide and no real change.
 
I've been pulled into too many governance reviews where the data owner role exists in theory and disappears in practice. Nobody knows what they're accountable for. Nobody knows what they decide. Nobody knows when to call them.
 
Here's the job description that actually works:
 
Accountable for:
 
→ One named metric
→ Its written definition
→ Its calculation logic
 
Decisions they make:
 
→ Approves definition changes
→ Signs off…