Data governance is the precondition for…

Classification, access boundaries, retention and auditability are what decide whether an AI rollout can safely grow.

Data governance is what decides whether an AI rollout grows past the pilot. The pilot goes well until someone asks who is allowed to see the answer, where the source documents came from, how long the prompt logs are kept, and what happens if a client asks for their data back. Answer those questions up front and the rollout keeps moving. Let them land after the fact and it stops.

At Jonsen LLC we do a lot of AI enablement work for professional-services firms, and this is where the work almost always starts.

What we mean by data governance

Governance is the small set of rules that decide how information moves through your business. Four pieces matter most for AI work.

Classification. Every meaningful data set is labeled public, internal, confidential, or regulated, and the label lives in the systems that hold the data rather than on a wiki page nobody opens.
Access boundaries. Identity decides who and what can read each class, models and apps included, and it's enforced in the tools instead of described in a policy PDF.
Retention. How long each class is kept, and where it goes when it expires. Prompts and model outputs are data too.
Auditability. Months later, you can still answer who asked what, which sources were used, and which version of which model produced an answer.

Together they are what let a firm say yes to an interesting AI question without holding its breath.

How governance failures become AI failures

Here's what it looks like in practice. A summarization tool ingests a shared drive holding six years of client records nobody remembered were there. A drafting assistant pulls context from a folder that includes a departing partner's personal notes. A general-purpose chatbot indexes an intranet page nobody has reviewed for accuracy, then answers a compliance question with something no partner would put in writing.

The tools worked. They were pointed at data nobody had put boundaries around.

A model behaving correctly on ungoverned data will still hand someone information they shouldn't have.

Practical first steps for a mid-size business

A governance program that looks like a bank's is more than you need. Get enough governance in place to make one AI use case safe, then a repeatable way to add the next one.

1. Write a one-page data classification

Four tiers is plenty: public, internal, confidential, regulated. Give each a plain-English definition, an example or two, and a short list of what is and isn't allowed with it. Get executive sign-off, then post it where the team already reads other short documents.

2. Map the top ten places your data actually lives

You don't have to inventory every system. Pick the ten repositories holding the most sensitive material, plus the ten sources your future AI will want to read, and for each one note the classification of what's stored there and who currently has access. This audit alone catches most of the accidents.

3. Consolidate identity before you consolidate models

Governing what a model sees on someone's behalf means first being able to see, in one place, which humans and which services have access to a given repository. Single sign-on, MFA, and a working leaver process don't sound like AI projects, but AI depends on them.

4. Decide retention for prompts and outputs before you turn anything on

Thirty days, ninety days, a year. Pick something appropriate to the class of data being sent, write it down, and configure the tool to enforce it. Any of those is defensible as long as somebody made the call on purpose.

5. Design for the audit request that hasn't arrived yet

Assume that in eighteen months a client, an insurer, or a regulator will ask a specific question about a specific answer your AI produced. They'll want to know who asked, what data was used, which model answered, and when. If your system can't reconstruct that today, it won't be able to in eighteen months either.

Where AI accelerates the work

Governance is what makes the interesting AI work possible. Classified data can be routed to a private model. Access-controlled sources can feed a retrieval system that never crosses a boundary the business hasn't approved. Prompts you can audit become the raw material for better prompts next quarter. All of it gets easier when the labels and access rules underneath are already true.

Ship governance alongside the first real use case

Treating governance as a phase, a six-month effort that has to finish before any AI work begins, is how the whole thing dies quietly. That project never ships. Pick one AI use case that matters, define the governance that use case requires, and build both at once. The second use case reuses most of the first one's governance, the third reuses almost all of it, and by the fifth the firm has a program.