Practice · Data governance · DG
Data governance, where the chain begins.
Five capabilities that make data discoverable, classified, traceable, fit for use and respectful of the people it describes. Each one is built to feed the AI plane, so the same evidence serves both.
DG-1 to DG-5
Five capabilities, one evidence trail.
DG-1 · Discovery and catalog
See the data estate
Find and inventory the data the organization holds, then attach meaning and ownership to it. A catalog is only useful when someone is accountable for each entry.
- Automated discovery
- Business and technical catalog
- Ownership and stewardship
- Data product registry
DG-2 · Classification and DSPM
Find the sensitive
Locate sensitive data and understand who and what can reach it. Classification drives the policy that AI controls later depend on.
- Sensitive-data classification
- Data security posture management
- Access and exposure review
- Policy tagging
DG-3 · Lineage and metadata
Prove provenance
Trace data from source to consumption, including the features, training sets and models that use it. This is the base layer for data-to-AI lineage.
- End-to-end lineage
- Metadata management
- Data-to-AI provenance
- Impact analysis
DG-4 · Data quality
Prove the inputs
Measure fitness for use and act on the result. For AI, quality thresholds become gates that hold a release when the data behind it falls short.
- Quality rules and scoring
- Profiling and monitoring
- Quality gates for AI
- Remediation workflow
DG-5 · Privacy operations
Honor the subject
Run privacy obligations as operations rather than paperwork. Requests, records and consent are tied to where the data actually lives, including inside AI systems.
- DSAR, RoPA and DPIA
- Consent and purpose
- Data mapping
- Right to be forgotten
DG to AI-G
One practice, both planes
Every data control feeds the AI plane, and the same evidence supports both. One graph and one crosswalk replace two separate programs.
See the chainWhat the work looks like
Operating model first, tooling second.
Data governance programs stall when they begin with a tool purchase. aerais begins with ownership: who is accountable for each domain, which decisions they make, and which controls produce evidence of those decisions. Tooling is then selected or configured to carry the controls, and aerais works with the catalog, quality and lineage tools you already run.
The result is a governance function that business and technical teams can operate, with a clear path from a first diagnostic to managed governance if you want aerais to run it with you.
How it feeds the AI plane
Data controls become AI controls.
Lineage records tell you which datasets shaped which models. Quality results decide whether a model may be released. Classification and consent records decide whether data may be used for training at all, and privacy records show where a subject sits when an erasure request arrives.
These links are the seam described on The Chain. They only work when the data side produces evidence in a form the AI side can read, which is why aerais designs the two together and maps both to one control crosswalk.
Frameworks. Aligned to DAMA-DMBOK and mapped to DCAM and CDMC. aerais maps to those models and does not reproduce EDM Council proprietary content. Alignment is not certification, and nothing here is legal advice.
FAQ
Frequently asked questions
Do we need a catalog or lineage tool first?
Not necessarily. aerais works with the tools you already run and recommends additions only where a control cannot be evidenced without one. The work is the operating model, the controls and the evidence.
How does data governance connect to AI governance?
Lineage, quality gates, classification and privacy records are the inputs to AI controls. The same evidence supports both planes, which is why they are scoped together.
Is this aligned to DAMA-DMBOK, DCAM and CDMC?
The work is aligned to DAMA-DMBOK and mapped to DCAM and CDMC through the control crosswalk. aerais maps to those models and does not reproduce EDM Council proprietary content. Alignment is not certification.
Contact
Make your data and AI provable.
Start with a diagnostic: current-state maturity, risk exposure and a prioritized roadmap. We aim to reply within two business days.