Skip to main content

The First 3 Steps to Building Data and AI Governance

Sunil Senan
Infosys

In today’s data and AI driven world, enterprises across industries are utilizing AI to invent new business models, reimagine business and achieve efficiency in operations. However, enterprises may face challenges like flawed or biased AI decisions, sensitive data breaches and rising regulatory risks, if not controlled and governed. To mitigate these risks, enterprises must embrace robust principles of responsible AI and embed them across all layers of the AI ecosystem — data, model and usage.

  • Data: Ensure data used for training AI is accurate, representative, and free from biases, with strong privacy and security controls.
  • AI Models: Controls for accuracy, relevance, explainability and fairness along with security measures for trusted reliable AI models.
  • Usage and Consumption: Monitor AI initiatives continuously and apply moderation layers to ensure ethical and compliant outputs, maintaining trust in AI solutions.

Enterprises must establish controls across the three layers based on:

  • Trust: Trust policy and guardrails to make AI explainable, traceable, accurate, reproducible and accountable
  • Ethics: Ethics policy and procedures to ensure AI initiatives are fair, free of biases and are protecting fundamental human rights
  • Privacy: Ensure privacy remains at the center of all initiatives, preserving privacy of individuals
  • Compliance: Ensure lawful and auditable AI initiatives
  • Security: Robust and secure data and AI ecosystems

On these fundamentals, enterprises must take the first three concrete steps to ensure robust governance over AI and data initiatives:

Step 1: Outline an organization-wide AI Governance Strategy

Enterprise's leadership should clearly outline the organization's strategy, vision and mission to ensure that responsible data and AI consumption is the primary focus of all individuals idealizing, developing and consuming data and AI.

Enterprise should define comprehensive policies and procedures at enterprise level around the five principles, actively govern the initiatives and educate its employees.

Step 2: Establish Operating Model

Subsequently, the next area of focus should be the people, processes and technology involved in these initiatives.

  • Enterprises must set up a Governance CoE, identify all the personas responsible along with clear roles and responsibilities assigned to different personas.
  • Enterprises must set up robust framework to govern the data and AI initiatives along with monitoring to ensure governance and compliance with the evolving regulations.
  • Enterprises must modernize their tools and technologies to manage and govern the initiatives. (e.g. tools for assessment, controls implementation, audit and monitoring)

Step 3: Operationalize the data and AI Governance Framework

Enterprises at this stage will be ready to govern each and every data and AI initiative by design.

  • Enterprises should start with documenting the AI use cases with governance related fingerprints.
  • Next, enterprises must prioritize the use cases and assess the risk for each of the use cases to enforce appropriate control for governance.

These three steps help enterprises to ensure responsible and sustainable data and AI initiatives, leading to better brand value and customer satisfaction.

Sunil Senan is Global Head of Data, Analytics and AI at Infosys

Hot Topics

The Latest

For years, production operations teams have treated alert fatigue as a quality-of-life problem: something that makes on-call rotations miserable but isn't considered a direct contributor to outages. That framing doesn't capture how these systems fail, and we now have data to show why. More importantly, it's now clear alert fatigue is a symptom of a deeper issue: production systems have outgrown the current operational approaches ...

I was on a customer call last fall when an enterprise architect said something I haven't been able to shake. Her team had just spent four months trying to swap one AI vendor for another. The original plan said three weeks. "We didn't switch vendors," she told me. "We rebuilt half our integrations and discovered what we'd actually been depending on." Most enterprise leaders don't expect that to be the experience ...

Ask any senior SRE or platform engineer what keeps them up at night, and the answer probably isn't the monitoring tool — it's the data feeding it. The proliferation of APM, observability, and AIOps platforms has created a telemetry sprawl problem that most teams manage reactively rather than architect proactively. Metrics are going to one platform. Traces routed somewhere else. Logs duplicated across multiple backends because nobody wants to be caught without them when something breaks. Every redundant stream costs money ...

80% of respondents agree that the IT role is shifting from operators to orchestrators, according to the 2026 IT Trends Report: The Human Side of Autonomous IT from SolarWinds ...

40% of organizations deploying AI will implement dedicated AI observability tools by 2028 to monitor model performance, bias and outputs, according to Gartner ...

Until AI-powered engineering tools have live visibility of how code behaves at runtime, they cannot be trusted to autonomously ensure reliable systems, according to the State of AI-Powered Engineering Report 2026 report from Lightrun. The report reveals that a major volume of manual work is required when AI-generated code is deployed: 43% of AI-generated code requires manual debugging in production, even after passing QA or staging tests. Furthermore, an average of three manual redeploy cycles are required to verify a single AI-suggested code fix in production ...

Many organizations describe AI as strategic, but they do not manage it strategically. When AI plans are disconnected from strategy, detached from organizational learning, and protected from serious assumptions testing, the problem is no longer technical immaturity; it is a failure of management discipline ... Executives too often tell organizations to "use AI" before they define what AI is supposed to change. The problem deepens in organizations where strategy isn't well articulated in the first place ...

Across the enterprise technology landscape, a quiet crisis is playing out. Organizations have run hundreds, sometimes thousands, of generative AI pilots. Leadership has celebrated the proof of concept (POCs) ... Industry experience points to a sobering reality: only 5-10% of AI POCs that progress to the pilot stage successfully reach scaled production. The remaining 90% fail because the enterprise environment around them was never ready to absorb them, not the AI models ...

Today's modern systems are not what they once were. Organizations now rely on distributed systems, event-driven workflows, hybrid and multi-cloud environments and continuous delivery pipelines. While each adds flexibility, it also introduces new, often invisible failures. Development speed is no longer the primary bottleneck of innovation. Reliability is ...

Seeing is believing, or in this case, seeing is understanding, according to New Relic's 2025 Observability Forecast for Retail and eCommerce report. Retailers who want to provide exceptional customer experiences while improving IT operations efficiency are leaning on observability ... Here are five key takeaways from the report ...

The First 3 Steps to Building Data and AI Governance

Sunil Senan
Infosys

In today’s data and AI driven world, enterprises across industries are utilizing AI to invent new business models, reimagine business and achieve efficiency in operations. However, enterprises may face challenges like flawed or biased AI decisions, sensitive data breaches and rising regulatory risks, if not controlled and governed. To mitigate these risks, enterprises must embrace robust principles of responsible AI and embed them across all layers of the AI ecosystem — data, model and usage.

  • Data: Ensure data used for training AI is accurate, representative, and free from biases, with strong privacy and security controls.
  • AI Models: Controls for accuracy, relevance, explainability and fairness along with security measures for trusted reliable AI models.
  • Usage and Consumption: Monitor AI initiatives continuously and apply moderation layers to ensure ethical and compliant outputs, maintaining trust in AI solutions.

Enterprises must establish controls across the three layers based on:

  • Trust: Trust policy and guardrails to make AI explainable, traceable, accurate, reproducible and accountable
  • Ethics: Ethics policy and procedures to ensure AI initiatives are fair, free of biases and are protecting fundamental human rights
  • Privacy: Ensure privacy remains at the center of all initiatives, preserving privacy of individuals
  • Compliance: Ensure lawful and auditable AI initiatives
  • Security: Robust and secure data and AI ecosystems

On these fundamentals, enterprises must take the first three concrete steps to ensure robust governance over AI and data initiatives:

Step 1: Outline an organization-wide AI Governance Strategy

Enterprise's leadership should clearly outline the organization's strategy, vision and mission to ensure that responsible data and AI consumption is the primary focus of all individuals idealizing, developing and consuming data and AI.

Enterprise should define comprehensive policies and procedures at enterprise level around the five principles, actively govern the initiatives and educate its employees.

Step 2: Establish Operating Model

Subsequently, the next area of focus should be the people, processes and technology involved in these initiatives.

  • Enterprises must set up a Governance CoE, identify all the personas responsible along with clear roles and responsibilities assigned to different personas.
  • Enterprises must set up robust framework to govern the data and AI initiatives along with monitoring to ensure governance and compliance with the evolving regulations.
  • Enterprises must modernize their tools and technologies to manage and govern the initiatives. (e.g. tools for assessment, controls implementation, audit and monitoring)

Step 3: Operationalize the data and AI Governance Framework

Enterprises at this stage will be ready to govern each and every data and AI initiative by design.

  • Enterprises should start with documenting the AI use cases with governance related fingerprints.
  • Next, enterprises must prioritize the use cases and assess the risk for each of the use cases to enforce appropriate control for governance.

These three steps help enterprises to ensure responsible and sustainable data and AI initiatives, leading to better brand value and customer satisfaction.

Sunil Senan is Global Head of Data, Analytics and AI at Infosys

Hot Topics

The Latest

For years, production operations teams have treated alert fatigue as a quality-of-life problem: something that makes on-call rotations miserable but isn't considered a direct contributor to outages. That framing doesn't capture how these systems fail, and we now have data to show why. More importantly, it's now clear alert fatigue is a symptom of a deeper issue: production systems have outgrown the current operational approaches ...

I was on a customer call last fall when an enterprise architect said something I haven't been able to shake. Her team had just spent four months trying to swap one AI vendor for another. The original plan said three weeks. "We didn't switch vendors," she told me. "We rebuilt half our integrations and discovered what we'd actually been depending on." Most enterprise leaders don't expect that to be the experience ...

Ask any senior SRE or platform engineer what keeps them up at night, and the answer probably isn't the monitoring tool — it's the data feeding it. The proliferation of APM, observability, and AIOps platforms has created a telemetry sprawl problem that most teams manage reactively rather than architect proactively. Metrics are going to one platform. Traces routed somewhere else. Logs duplicated across multiple backends because nobody wants to be caught without them when something breaks. Every redundant stream costs money ...

80% of respondents agree that the IT role is shifting from operators to orchestrators, according to the 2026 IT Trends Report: The Human Side of Autonomous IT from SolarWinds ...

40% of organizations deploying AI will implement dedicated AI observability tools by 2028 to monitor model performance, bias and outputs, according to Gartner ...

Until AI-powered engineering tools have live visibility of how code behaves at runtime, they cannot be trusted to autonomously ensure reliable systems, according to the State of AI-Powered Engineering Report 2026 report from Lightrun. The report reveals that a major volume of manual work is required when AI-generated code is deployed: 43% of AI-generated code requires manual debugging in production, even after passing QA or staging tests. Furthermore, an average of three manual redeploy cycles are required to verify a single AI-suggested code fix in production ...

Many organizations describe AI as strategic, but they do not manage it strategically. When AI plans are disconnected from strategy, detached from organizational learning, and protected from serious assumptions testing, the problem is no longer technical immaturity; it is a failure of management discipline ... Executives too often tell organizations to "use AI" before they define what AI is supposed to change. The problem deepens in organizations where strategy isn't well articulated in the first place ...

Across the enterprise technology landscape, a quiet crisis is playing out. Organizations have run hundreds, sometimes thousands, of generative AI pilots. Leadership has celebrated the proof of concept (POCs) ... Industry experience points to a sobering reality: only 5-10% of AI POCs that progress to the pilot stage successfully reach scaled production. The remaining 90% fail because the enterprise environment around them was never ready to absorb them, not the AI models ...

Today's modern systems are not what they once were. Organizations now rely on distributed systems, event-driven workflows, hybrid and multi-cloud environments and continuous delivery pipelines. While each adds flexibility, it also introduces new, often invisible failures. Development speed is no longer the primary bottleneck of innovation. Reliability is ...

Seeing is believing, or in this case, seeing is understanding, according to New Relic's 2025 Observability Forecast for Retail and eCommerce report. Retailers who want to provide exceptional customer experiences while improving IT operations efficiency are leaning on observability ... Here are five key takeaways from the report ...