Every AI Outcome Begins With Data and Models
When an AI system produces an unexpected recommendation, a biased decision, an inaccurate prediction or an inappropriate response, attention often focuses on the output. But outputs are merely symptoms. The real causes almost always lie deeper within the AI value chain: in the data used to train, ground and operate the system, and in the models that transform that data into decisions and actions.
While discussions around AI governance often gravitate toward regulation, ethics and accountability, effective governance begins much earlier. Before organisations can govern AI outcomes, they must first govern the foundations on which those outcomes are built. Those foundations are data and models.
This is the third article in our series, following Why the AI Governance Gap Exists and Why Regulators Are Closing In.
Why Foundations Matter
Building AI without governing data and models is like constructing a skyscraper on unstable ground. Everything may appear sound initially. The system launches. The outputs seem reasonable. The benefits begin to materialise. Yet hidden weaknesses beneath the surface can eventually undermine trust, performance and compliance.
The challenge is that AI systems are highly dependent on the quality of the information they consume and the integrity of the models that process it. Poor data produces poor outcomes, and poorly governed models amplify those outcomes at scale.
As organisations increasingly rely on AI to support critical decisions, foundational governance becomes not just good practice but a business necessity.
The Data Challenge
Data has always been important. In the era of AI, it has become strategic.
Modern AI systems depend on vast amounts of information sourced from internal systems, external providers, public datasets, knowledge bases, documents and increasingly real-time data feeds. The question therefore revolves around how we can trust the data informing our AI systems. In many organisations, the answer is uncertain.
There are many challenges, including inconsistent definitions, data quality, poor metadata, limited lineage, unclear ownership and a lack of governance over unstructured data. These issues may have existed for years within traditional reporting environments. AI simply exposes them more quickly, and often with greater consequences.
When data quality deteriorates, AI systems do not become less confident. They often continue operating and producing outputs, potentially creating a false sense of accuracy. This is why effective AI governance starts with effective data governance.
What Good Data Governance Looks Like
For AI-enabled organisations, data governance extends beyond traditional quality controls. Leaders need confidence that they can answer fundamental questions:
- Where did the data come from?
- Who owns it?
- How has it been transformed, and can the lineage be traced?
- Is it fit for purpose?
- Is its use compliant with policy and regulation?
Strong data governance creates transparency and trust. It allows organisations to understand not only what data exists, but also whether it should be used to inform AI-driven outcomes. Without this foundation, every downstream governance mechanism becomes significantly less effective.
The Model Challenge
If data is the fuel, models are the engines. Models determine how information is interpreted, prioritised and transformed into outputs.
As AI adoption accelerates, organisations are finding themselves responsible for an increasingly diverse landscape of models — traditional machine learning models, large language models and third-party foundation models — each introducing unique risks.
Unlike traditional applications that follow predefined rules, models can change over time. Their performance may degrade, behaviour may drift, and outputs may vary depending on context, prompts or changing data conditions. This dynamic nature is precisely why models require governance.
What Good Model Governance Looks Like
Strong model governance provides confidence that AI systems operate within acceptable boundaries. It establishes controls around:
- Model development — ensuring models are built using approved methodologies, governed data sources and documented assumptions
- Model validation — independent assessment of performance, robustness, reliability and intended use
- Explainability — providing sufficient transparency to understand how decisions and outputs are generated
- Bias and fairness — identifying and mitigating unintended outcomes that may unfairly affect specific groups
- Performance monitoring — tracking effectiveness over time and detecting degradation before it creates material risk
- Model lifecycle management — managing updates, retraining, retirement and change control processes
The objective is not to eliminate risk, but to understand, monitor and manage it.
The Growing Importance of Third-Party Models
Historically, organisations largely governed models they developed internally. Today, many rely on externally supplied AI capabilities, including foundation models from major technology providers.
This introduces a new governance challenge. Boards and executives remain accountable for outcomes, even when models are sourced externally. It becomes important to know how these models were trained, what their limitations and controls are, how they are updated, and how performance changes over time.
The growing dependence on third-party AI means governance can no longer stop at organisational boundaries.
Data and Models Must Be Governed Together
One of the most common mistakes organisations make is treating data governance and model governance as separate disciplines. They are deeply interconnected. Data influences model behaviour. Models influence how data is interpreted. Weaknesses in either create risk across the entire AI ecosystem.
High-quality data cannot compensate for poorly governed models. Equally, sophisticated models cannot compensate for poor-quality data. Safe and trustworthy AI requires both.
The Executive Imperative
As AI becomes increasingly embedded in decision-making and operations, executives should be asking:
- Do we understand the data informing our AI systems?
- Can we trace the origin and lineage of critical information?
- Do we know which models are operating across the organisation?
- How are those models governed, validated and monitored?
- Where do our greatest data and model risks reside?
These are rapidly becoming core governance questions rather than purely technical ones.
Closing Thought
Every AI decision, recommendation, prediction and action can ultimately be traced back to two things: the data that informed it and the model that generated it.
Organisations seeking to govern AI effectively should therefore start with a simple principle: trustworthy AI is built on trustworthy foundations.
The next article in this series is Agentic AI and Observability: Governing Autonomous Behaviour, on why organisations must learn not only to build AI systems, but also to continuously understand what those systems are doing.
About the authors
Albert VenterChief Executive Officer, NovoFinity
Albert Venter is a Data & AI Governance leader and Chief Executive Officer at NovoFinity, specialising in financial services and regulated industries. He helps organisations turn complex data, AI and regulatory challenges into practical, measurable business value. His expertise spans data and AI governance, strategy, BCBS239, automation, cloud transformation and process optimisation, with experience delivering major initiatives across Australia, Africa and Europe.