AI in Business: 95% of Projects Hindered by Data Governance

The widespread adoption of AI agents and applications reveals privacy flaws well before the model stage. With regulatory requirements, access control, data retention management, and continuous oversight, data governance emerges as the foundation of AI initiatives—while nearly all companies face obstacles and very few consider themselves ready.

Expected Safeguards for Decision-Making Uses of AI

Clear regulations are increasingly deemed necessary as AI takes on a more significant role in everyday activities. When AI is involved in decisions that involve personal data, explicit privacy rules serve as safeguards to enable innovation while protecting individuals' information. The adoption of responsible practices allows organizations to benefit from AI advancements while preserving fundamental rights and enhancing trust in outcomes.

Limiting Access Rights, Including AI Agents

Companies must regularly verify who has access to sensitive information and ensure that such access remains justified. Comparing access permissions with human resources records during onboarding, departures, or position changes helps identify unjustified rights. AI systems and agents should be granted only the access necessary for each task, without general visibility over the entire company’s data.

Reducing Retention to Minimize Potential Exposure

Regularly identifying personal or client data that has become unnecessary and flagging it for deletion according to retention rules is part of the recommendations. Reducing the presence of unnecessary sensitive data decreases the amount of exposable information and helps maintain customer trust.

Scaling Up: Automating Quality and Traceability

The industrialization of AI requires integrating controls into data processing: automating transformations, continuously monitoring quality, and automatically recording the provenance, modifications, and AI applications that use the data. These practices allow for prioritizing high-risk datasets and quickly investigating anomalies or quality issues. Training data should be regularly reviewed for inaccuracies or biases, ensuring that personal data is used appropriately and respecting individuals' rights. Applying these principles during the design and deployment of AI fosters a more secure framework and reliable services. Even though 97% of organizations have ongoing AI projects, only 5% believe their data is fully ready, with privacy, compliance, and quality still representing major challenges.

Tracking Sensitive Data Movements within the Company

It is essential to track the movement of sensitive data, particularly when copying from production systems to less secure test or development environments. Personally identifiable information, such as names, addresses, or financial information, should be distinctly marked for identification before any transfer. Whenever possible, this data should remain confined to the systems where it is required; if use in other environments is necessary, removing or masking identifiable elements limits the risk of exposure. During migrations to the cloud or while preparing for AI, maintaining accurate metadata and a history of data movements and modifications allows for better identification and monitoring of privacy-related risks.

Why Privacy Issues Arise Before Agents and Models

Opening internal systems to AI applications and agents complicates privacy management beyond just the risk of disclosure by models. The challenge begins with mapping access, origins, and uses of data, which is a prerequisite for any deployment. 95% of companies report having delayed or canceled AI projects due to infrastructure and data governance issues. It is crucial to establish solid foundations before risks become unmanageable. Data protection is not solely a matter of compliance: anyone handling data is involved, as poor management can expose sensitive information and harm trust and reputation. Risks emerge upstream, with poorly classified, duplicated, or outdated data, while more autonomous agents, by aggregating multiple sources, make any incident harder to contain.