AI Unearths Forgotten Data: Asset or Risk?

AI: A Productivity Lever with Unexpected Consequences

Artificial intelligence, particularly in its generative form, has opened new avenues for businesses by facilitating access to valuable information. However, this technological advancement is not without its challenges. At a recent conference, AI deployment experts warned about the potential risks associated with a hasty adoption of these technologies.

Companies that have integrated AI into their processes have sometimes had to temporarily halt these deployments. The reason? A necessary reevaluation of sensitive information that could be exposed. During a panel at the Veeam conference in New York, executives emphasized that the issue does not lie with the AI itself, but rather with the management of the enormous volumes of data accumulated by organizations. One of the proposed solutions is the establishment of a new data governance structure.

The Challenges of Managing Legacy Data

Steve MacIntyre, Senior Vice President at Fidelity Investments, shared his company's experience, which employs 400,000 people. Thanks to AI prompts, long-forgotten data stored on platforms like SharePoint or storage networks has resurfaced. "It wasn't an AI problem," he clarified. "It was related to productivity and the AI's ability to quickly retrieve information."

For his part, Wim Geurden, Chief Architect at EY, described the challenge of determining data ownership within its global network of affiliates. AI has enabled data to emerge from unexpected places, raising questions about its management. "EY Global does not own any of the data," he explained. "Each member firm holds its own data, which has raised questions about how to manage that information."

At EY, the challenge was compounded by the discovery of several petabytes of data scattered without lifecycle management. Geurden described this situation as a true "Wild West," with many SharePoint sites lacking identified owners. The absence of structured management complicated the task of knowing when this data had last been accessed.

Establishing Effective Safeguards

At EY, opening vast data reserves to AI required a rigorous approach to identify data holders. "The first step was to stop everything," Geurden stated. Only licensed users could access the Copilot tool.

The verification process involved labeling data with categories such as "confidential" or "financial services." AI assisted in this task, although the staff turnover rate reached 25% per year, making human labeling difficult. Geurden emphasized the need to go beyond high-level labels to include geographical restrictions and business line tagging, in connection with client contracts.

Another priority was to have a historical view of the data and its versions at the time the AI was operational. This would allow for understanding data evolution and ensuring proper management.

Governance: An Essential Pillar

Data governance is crucial for the success of AI deployments, according to executives. "We need to know what is being used," MacIntyre asserted. This involves managing shadow AI and shadow IT, ensuring that the asset inventory is accurate and aligned with approved use cases.

MacIntyre also highlighted the importance of defining a secure environment for AI agents to operate. "We need to establish an architecture that provides the right visibility and telemetry," he added, to monitor the behavior of AI agents.

Another major challenge is identifying AI agents. "How do you give an agent an identity?" MacIntyre wondered. "They then become like employees, but what happens if an agent only exists for a few seconds?" This complex issue remains without a clear solution, illustrating the ongoing challenges posed by the integration of AI into businesses.