Data Governance: We Need It but We Can’t Define It

I opened our conversation with a chair. My daughter had just moved into her apartment at Boston University, and the apartment came with an office chair. It was ugly, and it couldn’t leave. Students who remove their chairs get charged for them. Hers wasn’t the only one. Down in the laundry room, another student had left a chair of their own. That isn’t allowed either, so they were apparently hoping someone would take pity on it. Taped to the seat was a note: I don’t want this, but I need it. Please don’t throw it away.

That sounded a lot like data governance to me. When I asked Scott if it sounded about right, he didn’t disagree. Scott leads strategic solutions at Lumenalta, a technology consultancy. He is also a Databricks MVP, a recognition that Databricks, the data and AI platform company, gives to experts in its community. He has spent years inside organizations that know they need governance, have strong feelings about it, and cannot quite agree on what it is.

A Decade Built Without It

Data governance has a history problem. To explain why it is both universal and undefined, Scott goes back to 2014. The cloud arrived. Investment flooded into data processing, storage, and eventually data science. That money built real capability, and it is what made the current AI moment possible. It was also spent almost entirely without modern governance.

“On-prem traditional data governance existed,” Scott says. “Modern data infrastructure, data architecture, data capabilities and processing was developed, yet the data governance to manage it just didn’t exist.” The order mattered. The infrastructure had to exist before anyone could see the governance problem. Only once the data side matured was there room for the governance conversation, and that conversation has been serious for about three years.

“What happened at the cutting edge of three years of technology doesn’t really filter its way down to data organizations at major companies,” Scott says. “So defining what it is is actually a really, really important first step.”

Most organizations have filled the gap with what they already knew. Master data management (MDM), the practice of keeping one trusted version of core records such as customers and products, has been around for decades. Many companies point to it and say: that is our data governance. Scott counts it as one of roughly eight components of a complete model. Others keep a data dictionary, often an Excel spreadsheet, and call that governance. It is a component too. It is not the whole picture.

“That conversation really goes on and on across the organization,” Scott says, “as different groups take their portion of data governance and apply it forward. What we’re really doing now is saying: you have all of those joined together, and they’re all very functional.” Getting a team to see its piece as part of a larger structure is slow work. Sometimes that team is an MDM group with 40 years behind it. Scott calls it a fairly challenging long-term conversation.

What You Don’t Know Is Hurting You

The most dangerous sign of missing governance is feeling fine. Scott sees two signs. One is obvious. The other is quieter, and worse. “Organizations that don’t have governance don’t know or don’t feel like they don’t have governance,” he says. The absence is invisible to the people living inside it.

The second sign is friction. Failed audits. Audit preparation that eats six months of organizational capacity. New hires who can’t get up to speed because no one can explain how things work. Reports that go out with the wrong data. Each one gets treated as the cost of doing business. The first sign is harder to fix; you cannot convince someone to solve a problem they don’t believe they have. The second is the easier way in. The friction is already visible, and governance is the most direct way to reduce it.

The Mountain and the Tunnel

Governance does not stop rogue AI, meaning AI tools and models built or used outside sanctioned channels. I asked Scott whether it could. He wanted to give a clean answer and found he couldn’t. “The answer I wanted to give is that good data governance stops rogue AI. And I really wanted to be confident in saying that. And I don’t know that I can.”

Instead he offered an analogy. Two towns sit on either side of a mountain and need to trade every day. Some people have built whole jobs around the climb: the switchbacks, the inefficiency, the workarounds. Others have given up on the other town entirely. It is too much effort. Governance builds a tunnel, a direct, efficient, governed connection between the two towns, which in this case are IT and the business unit. Trade that once required a mountain climb now takes a quick trip through the tunnel.

“But what happens is you still have people that are like, ‘Yeah, but I’m the mountain climber. My job was to climb the mountain. I’m really good at that.’” Good governance supplies the technology for the tunnel. Whether the organization builds a process around it, and whether people on both sides use it, are separate questions. Technology can’t answer them. “It doesn’t stop rogue AI,” Scott says. “What it does do is give your organization a new way to think about working together.”

Where he lands: bad governance, which usually means no governance rather than active mismanagement, creates an incentive for rogue behavior. It does not cause it. The missing piece is organizational maturity. “Through that lens, rogue AI points to immaturity.”

Who Owns It, and What That Question Reveals

Governance starts in IT. Scott has not seen a single organization where it begins anywhere else. IT holds the budget, sets the foundation, and owns the technical infrastructure. At maturity, it reaches into the business. Data stewards (the people accountable for a given set of data), subject matter experts, and the business meaning that gives data commercial context all eventually live on the business side. The link between IT and the business is the whole point.

One organization forced that link. Stuck in an unworkable standoff between IT and its business units, the company dissolved its IT organization and rebuilt it under the business units. “The brand new IT organization existed solely to serve the business,” Scott says. “It didn’t exist to lock the data down, to protect it. Yes, those are very important tasks, but serving the business was the number one task.” The company went from holding its data to acting on it.

AI Doesn’t Wait for Governance to Catch Up

Traditional data governance was built for a slower world. Business intelligence (BI) and reporting meant static dashboards, analyst-driven queries, and scheduled outputs. AI asks for more: training data, lineage (a record of where data came from and how it changed), model versioning, drift, and explainability. I asked Scott whether the old model stretches that far. “Most organizations have not built the data governance to manage that process yet,” he says.

He reaches for air traffic control. Governance is the runway. Every plane eventually routes through it. That is how a data platform should work, but none of the legacy systems were built with a runway in mind. So organizations are proving governance out one use case at a time. They trace a specific AI application backward, build the governance it needs, show the value, and expand slowly. The trouble shows up later, in drift.

Scott puts model drift in practical terms: something that works today and won’t work tomorrow. Models get built and deployed, then keep running while the world that produced their training data changes. He regularly meets people who say, “I just built that three years ago. I didn’t know it was still running.” Governance provides the visibility, accountability, and automation to catch drift early, and to keep small gains building instead of decaying.

Scott’s aviation example is precise. “In aviation, seconds matter, so you’re not trying to solve a problem where you shave off three hours. You’re trying to shave off three seconds.” A governed solution that saves three seconds can be monitored, tuned, and improved to save four. Without governance, it saves three seconds once, then quietly degrades. Nobody notices until the audit.

The Airline Version

Airlines carry baggage most industries don’t. They have decades of mergers and acquisitions behind them. They run legacy mainframes. Their systems grew up together in their own peculiar ways and were never designed to talk to each other. I asked Scott whether airline governance means imposing structure on that fragmentation or accepting it and governing around it. His answer was both.

He uses maintenance manuals as the example. The documentation is ultra-specific, addendum after addendum, each one modifying what came before. The information is all there, somewhere. The challenge is access, connection, and consistency. “Airline-specific governance,” Scott says, “is inherently fragmented. That’s the advantage of governance: it’s unifying that fragmentation.” Optical character recognition (OCR) can read the manuals. Governance links the addendums, connects the maintenance logs, and makes the combined context available for future decisions. Consistency, safety, and compliance improve, and no one has to start from scratch.

On rip and replace, Scott doesn’t hedge. “Nobody can afford to rip and replace. And nobody does. There is no airline that is ripping and replacing.” Realistic progress is one use case at a time. Find one where the benefit is already established. Do it. Prove it. Find the next one. Scope follows proof of value, not the other way around. “Before you know it, you’re spending all of your time and money on projects that have definitive, trackable benefit to the business. And you see companies that never had budget suddenly say: for $20 million in benefit, we absolutely have $2 million.”

The Rogue IT Person and the Governance Board

Rogue IT usually has a talented person at its head. Scott closed on a version of the governance question that tends to get overlooked. Can governance stop rogue behavior when the rogue is talented, passionate, and doing things their own way? “At the head of every rogue IT organization is somebody who is incredibly intelligent and empowered to make all of the best decisions for the betterment of the organization. Best intention, best goals, passion, everything.”

Governance tells that person they are no longer the sole decision-maker. The ROI gets tracked. The cost gets documented. The process gets followed. For someone who has run with full autonomy toward what they believed was the right outcome, that is a hard proposition. “That’s a person you really want dedicated to the business and the transition has to be handled very, very sensitively.”

Organizations manage the people side through a data governance board or center of excellence, a structure that brings together IT, the business units, and executive steering. Scott’s read on where that stands: still evolving, and no one has settled what it should look like. “I don’t think this has an answer yet,” he says. “It’s moving very quickly.”

That may be the most precise summary of data governance right now. Organizations know they need it. They are building toward it. The form is still being discovered. A conversation that barely existed a few years ago is now, in Scott’s view, one of the most important happening inside enterprise data organizations. It is the chair in the laundry room, more or less. Nobody wants it. Everybody needs it. Please don’t throw it away.