Here’s a pattern I’ve started seeing in boardrooms: the board asks management whether the company has an AI policy, management says yes, everyone moves to the next agenda item, and the actual decisions that create AI liability keep getting made three levels down, by default, by whoever happens to be assembling training data that week. The policy exists. The governance doesn’t.
A quick word on my vantage point: I lead go-to-market and strategic partnerships at Digital Divide Data, and the change I’ve noticed across this market over the past two years is who shows up to our conversations. It used to be data science leaders.
Increasingly, the people in those conversations carry legal, risk, and audit responsibility, sometimes one person wearing all three hats, and the questions they bring reflect board priorities trickling down into the programs we work on. The numbers explain why that pressure is only now reaching the working level: in Deloitte’s Global Boardroom Program survey, 45 percent of directors and executives said AI wasn’t on the board agenda at all, and 79 percent said their boards had limited, minimal, or no knowledge or experience with AI. The 2025 follow-up showed the agenda gap narrowing to 31 percent, which means the priorities are starting to cascade, but they’re cascading from boards that mostly can’t yet interrogate the topic.
Here’s the thesis of this piece: when boards do engage with AI, they tend to govern the models and the use cases, because that’s where the demos are. But the least governed liability lives in the data decisions. The board oversight trackers make the point almost by accident: EY’s review of Fortune 100 disclosures and NACD’s annual board survey measure AI committee assignments, agenda time, and risk factor disclosure in detail, and neither contains a category for training data provenance or the data supply chain at all. Gartner’s analysis of why GenAI projects get abandoned after proof of concept lists poor data quality first among the causes, ahead of risk controls and cost, and the EU AI Act writes data governance obligations directly into law for high-risk systems.
Failures against those obligations carry fines of up to 15 million euros or 3 percent of worldwide annual turnover under Article 99; the Act’s outer ceiling of 35 million euros or 7 percent is reserved for prohibited practices such as social scoring. This blog lays out the five data decisions that belong at the board and C-suite level, what owning them actually looks like in practice, and how the major frameworks map onto them.
Key Takeaways
- The governance gap is a data gap. Boards that engage with AI tend to govern models and use cases; the liability concentrates in data decisions about provenance, rights, quality, and regulated content, which are currently being made by default at the engineering level.
- Five data decisions belong at the top: what data the company may train on, what data may never enter AI systems, who owns the quality metric, what flows through the vendor chain, and what evidence trail exists when a regulator or plaintiff asks.
- Owning a decision means owning its evidence. A board that cannot see data provenance, quality metrics, and vendor attestations in its reporting pack has delegated the decision whether it intended to or not.
- The frameworks agree more than they differ. The NIST AI Risk Management Framework, the EU AI Act, and ISO/IEC 42001 all converge on the same requirement: documented, accountable, auditable data decisions with named owners.
Why Data Decisions Are Where the Liability Lives
Think about what actually goes wrong in the AI failures that reach boards. A model trained on data the company didn’t have rights to use invites litigation that no deployment safeguard can cure. A model trained on data that underrepresents a customer population produces discriminatory outcomes that no post-hoc filter reliably catches. Customer data that entered a training set without the right consent basis creates a privacy violation that is close to irreversible, because you can’t cleanly subtract one person’s data from a trained model. In each case, the harm was locked in at the data decision, months before anyone saw an output.
The pattern is no longer hypothetical. The largest AI legal outcome to date is a training data case: the $1.5 billion copyright settlement between Anthropic and a class of book authors, granted final approval in July 2026, turned entirely on an upstream sourcing decision. The court found that training on lawfully acquired books was transformative fair use; assembling a corpus from pirate libraries was not. The US Federal Trade Commission has drawn the same line from the enforcement side, repeatedly ordering companies to delete not only improperly obtained data but the models trained on it. A provenance failure doesn’t just risk a fine. It can require destruction of the asset.
That’s why the regulatory architecture targets data directly. Article 10 of the EU AI Act requires that training, validation, and testing datasets for high-risk systems be subject to documented governance practices. Those practices cover design choices, data collection, preparation, and examination for possible biases. The commercial failure data points in the same direction.
Gartner predicted in mid-2024 that at least 30 percent of GenAI projects would be abandoned after proof of concept by the end of 2025, listing poor data quality first among the causes. Its 2026 follow-up analysis reported the outcome was worse: at least half were abandoned after proof of concept. The legal exposure and the business-case failure share a root, and it isn’t the model.
The Five Data Decisions Boards and C-Suites Must Own
Decision 1: What Data the Company May Train On
This is the provenance and rights decision, and it’s the one with the longest liability tail. Every training dataset has a chain of custody: where it came from, under what license or consent, with what restrictions. A board doesn’t need to review datasets. It needs to know that a policy exists specifying which sourcing categories are approved (licensed, first-party with consent, commissioned collection, public domain) and which require escalation, and that someone is accountable for the provenance record on every model the company ships. In my experience, when I ask executive teams who signed off on the sourcing of their flagship model’s training data, the most common honest answer is that nobody did. It was assembled, not approved.
Decision 2: What Data May Never Enter AI Systems
The inverse decision matters as much: the categories of data that are off-limits for training, fine-tuning, or prompting regardless of business case. Health information governed by HIPAA (the US Health Insurance Portability and Accountability Act), personal data without a lawful basis under GDPR (the EU’s General Data Protection Regulation), material non-public information, privileged legal content, and customer data whose contracts exclude AI use. This boundary has to be set centrally and enforced technically, because the alternative is that it gets set implicitly by whoever is under the most delivery pressure. The test of whether this decision is owned: can management state the prohibited categories from memory, and can they show the control that enforces them?
Ownership here now extends past prevention into remediation. When prohibited data is discovered in a system after the fact, regulators have ordered deletion of the models built on it, and recent settlements have required destruction of the underlying datasets. The policy should say in advance what happens on discovery, because unwinding a trained model is expensive at best and impossible at worst.
Decision 3: Who Owns the Data Quality Metric
Data quality is the strongest single predictor of AI program failure in the published analyses, and yet in most organizations it has no executive owner: model accuracy has an owner, uptime has an owner, and the quality of the data feeding both is everyone’s job and therefore no one’s. Owning this decision means naming an accountable executive, defining the metrics (coverage, label accuracy, representativeness, freshness), and putting them in a reporting cadence that reaches the C-suite before models retrain, not after outcomes degrade. Boards should ask to see the data quality dashboard with the same expectation they’d bring to financial controls: not because directors will read every number, but because the existence and ownership of the number is the governance.
Decision 4: What Flows Through the Vendor Chain
Most enterprise AI is built on a data supply chain: annotation partners, data licensors, model providers, cloud platforms. Your compliance perimeter includes all of them. A vendor’s sourcing practices, security posture, and workforce model become your exposure the moment their output enters your training pipeline. The governance requirement is flow-down. That means contractual provenance warranties; security certifications verified rather than assumed, including ISO 27001, SOC 2, and sector-specific regimes where relevant; audit rights; and clarity about where your data physically goes and who touches it. The board-level question is simple: do we hold the same evidence about our data vendors that our customers would demand from us?
Decision 5: What Evidence Exists When Someone Asks
The last decision is about the audit trail, and it’s the one regulation has made explicit. When a regulator, plaintiff, enterprise customer, or acquirer asks how a model was trained, the answer has to exist as documentation: dataset composition, sourcing records, quality measurements, bias examinations, and the decision log of who approved what. Under the EU AI Act, this documentation is an obligation for high-risk systems; in litigation and M&A diligence, it’s rapidly becoming the default expectation for everyone else. The uncomfortable property of evidence is that it can’t be created retroactively with any credibility. The board either mandated the trail before the model shipped, or it explains the gap afterward.
What Owning These Decisions Looks Like in Practice
Ownership isn’t the board making data decisions. It’s the board ensuring the decisions have named owners, defined escalation paths, and evidence that reaches the top. In practice, that means four structures. A charter amendment placing AI data governance explicitly with a committee, typically audit or risk, so it stops being homeless on the agenda. A decision-rights matrix specifying who may approve new training data sources, who may approve exceptions to prohibited categories, and what requires escalation to the C-suite or board. A reporting pack that includes data provenance status, quality metrics, and vendor attestation status alongside the financial and cyber metrics directors already see. And a management-level review gate, so that no model ships without its data documentation complete, the same way no financial statement ships without its controls executed.
The frameworks give this structure a shared vocabulary. The NIST AI Risk Management Framework organizes it as Govern, Map, Measure, and Manage functions, with data provenance and quality sitting across all four. The EU AI Act converts the same substance into legal obligation for high-risk systems. ISO/IEC 42001, the international management-system standard for AI, packages it as an auditable management system that certification bodies can assess. A board doesn’t need to pick a winner. A practical sequence: adopt NIST as the internal organizing structure, map it to the AI Act obligations that apply to your systems, and treat ISO/IEC 42001 certification as an option when customers start asking for third-party assurance.
How Digital Divide Data Can Help
Frameworks assign the accountability; the evidence still has to be produced. Whether that layer gets built internally or with a partner, it needs to contain the same four things, and producing them is the work we do.
Provenance a regulator can read: training data with documented sourcing, licensing, and consent records, so the answer to ‘where did this data come from’ is a file rather than a reconstruction. This is what data collection and curation programs deliver.
Quality metrics an audit committee can read: measured, sampled QA with accuracy and representativeness reported continuously, the artifact Decision 3 requires an owner to produce. That reporting discipline is built into AI data preparation.
Bias examinations and evaluation evidence on a cadence: maintained, labeled evaluation sets and subgroup analyses, which is what Article 10’s examination requirement and your own board pack both draw on. Model evaluation services keep that evidence current.
And a supply chain you can flow requirements down: ISO 27001 and SOC 2 Type 2 certifications, GDPR-aligned data handling and support for HIPAA-regulated workflows where applicable, audit support, and clear answers on data residency and access, so Decision 4 holds beyond your own walls.
If your next board pack has an AI section and it contains use cases and spend but no data provenance, quality, or vendor evidence, that’s the gap this piece is describing. Talk to an expert.
Conclusion
AI governance is arriving in boardrooms as a technology topic, and the boards that handle it well will be the ones that recognize it as a data topic, because that is where the least governed liability lives. The models will keep changing quarterly. The five decisions won’t: what we may train on, what may never enter, who owns quality, what flows through vendors, and what evidence exists when someone asks. Those decisions are being made in your organization right now, with or without governance, and the only question is whether they’re being made by the people who’ll answer for them.
The practical starting point costs one agenda item: ask management to bring the current answers to the five decisions to the next meeting, in writing, with names attached. In my experience, the value of that exercise isn’t the document. It’s the two or three blanks that nobody can fill in, because those blanks are your actual AI risk register. Delaware’s oversight doctrine gives the exercise legal weight: directors who make no good faith effort to implement reporting systems for mission-critical risks can face personal exposure, and governance counsel have begun applying that standard to AI data decisions. The blanks aren’t just a risk register. They’re the start of a defense, or the absence of one.
References
Deloitte Global Boardroom Program. (2024). Governance of AI: A critical imperative for today’s boards. https://www.deloitte.com/nz/en/services/consulting/analysis/governance-of-ai.html
Deloitte Global Boardroom Program. (2025). Progress on AI in the boardroom, but room to accelerate. https://www.deloitte.com/global/en/issues/trust/progress-on-ai-in-the-boardroom-but-room-to-accelerate.html
European Union. (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
National Institute of Standards and Technology. (2023). AI Risk Management Framework. https://www.nist.gov/itl/ai-risk-management-framework
Gartner. (2024, July 29). Gartner predicts 30% of generative AI projects will be abandoned after proof of concept by end of 2025. https://www.gartner.com/en/newsroom/press-releases/2024-07-29-gartner-predicts-30-percent-of-generative-ai-projects-will-be-abandoned-after-proof-of-concept-by-end-of-2025
Gartner. (2026). Why half of GenAI projects fail: Avoid these 5 common mistakes. https://www.gartner.com/en/articles/genai-project-failure
EY Center for Board Matters. (2025). Cyber and AI oversight disclosures in 2025. https://www.ey.com/en_us/board-matters/cyber-disclosure-trends
National Association of Corporate Directors. (2025). 2025 Public Company Board Practices and Oversight Survey. https://www.nacdonline.org/all-governance/governance-resources/governance-surveys/surveys-benchmarking/2025-public-company-board-practices–oversight-survey/
The Authors Guild. (2026, July 21). Court grants final approval of $1.5 billion Anthropic copyright settlement. https://authorsguild.org/news/court-grants-final-approval-anthropic-copyright-settlement/
Mintz. (2024, January 23). Algorithmic disgorgement: An increasingly important part of the FTC’s remedial arsenal. https://www.mintz.com/insights-center/viewpoints/54731/2024-01-23-algorithmic-disgorgement-increasingly-important-part
Frequently Asked Questions
Q1. Our board isn’t technical. How can directors credibly own decisions about training data?
The same way they own financial controls without being accountants. The board’s job isn’t to evaluate datasets; it’s to verify that the decisions have named owners, documented policies, and evidence in the reporting pack. Every one of the five decisions reduces to questions a non-technical director can ask and evaluate: who approved this data source, what categories are prohibited and what enforces them, whose name is on the quality metric, what attestations do we hold from vendors, and where is the documentation. Deloitte’s finding that 79 percent of boards report limited or no AI knowledge is a case for structured questions and expert briefings, not a case for delegation by default.
Q2. We already have privacy, security, and compliance functions. Isn’t this covered?
Partially, and the gaps between the functions are exactly where AI data risk lives. Privacy governs personal data but typically has no view into whether a licensed dataset’s terms permit model training. Security governs access but not whether the data being accessed is representative or rights-cleared. Compliance tracks regulations but often maps AI obligations to no existing control owner. The five decisions are cross-functional by nature, which is why they escalate: someone with authority over all three functions has to assign the ownership, and that’s a C-suite and board-level act. A useful diagnostic is to ask each function who owns training data provenance; if you get three different answers or three referrals, it’s unowned.
Q3. Which framework should we adopt: NIST AI RMF, ISO/IEC 42001, or the EU AI Act?
They’re not competitors, and the practical answer is a sequence rather than a selection. The EU AI Act isn’t optional if your systems fall in its scope; it’s law, and its data governance article defines obligations, not suggestions. The NIST AI Risk Management Framework is voluntary and works well as the internal organizing structure because it’s function-based and framework-agnostic. ISO/IEC 42001 matters when you need third-party assurance, because it’s the one a certification body can audit against, and enterprise customers are beginning to ask for it in procurement the way they ask for ISO 27001 today. The pattern most organizations land on: NIST for structure, the AI Act for legal floor, and 42001 certification when the market demands the certificate.
Q4. What should actually appear in the board reporting pack for AI data governance?
Five artifacts, one per decision, each fitting on a page. A provenance summary: models in production, data sources per model, approval status, and any sources under remediation. A prohibited-data attestation: the categories, the enforcing controls, and any exceptions granted with their approvers. The quality dashboard: the owned metrics with trend lines and threshold breaches. A vendor status table: data supply chain partners, certifications verified, attestations current or expired. And a documentation readiness indicator: which production models have complete data documentation and which have gaps. The pack’s purpose isn’t detail; it’s that a director can see in five pages whether the five decisions are owned and evidenced, and can ask about anything red.
Q5. We don’t operate in Europe. Does the EU AI Act really matter to us?
Quite possibly, and the determination belongs with counsel rather than a blog, but two facts are worth knowing before that conversation. The Act’s reach extends beyond companies established in the EU: providers placing systems on the EU market and situations where system outputs are used in the EU can fall in scope regardless of where the company sits. And even for companies genuinely outside its reach, the Act is functioning as the reference standard: enterprise customers, investors, and other regulators are borrowing its categories and its documentation expectations, which means its data governance requirements describe the evidence sophisticated counterparties will ask for irrespective of jurisdiction. Building the documentation trail only for the markets that legally require it usually costs more than building it once.
Kevin Sahotsky leads strategic partnerships and go-to-market strategy at Digital Divide Data, with deep experience in AI data services and annotation for physical AI, autonomy programs, and Generative AI use cases. He works with enterprise teams navigating the operational complexity of production AI, helping them connect the right data strategy to real model performance. At DDD, Kevin focuses on bridging what organizations need from their AI data operations with the delivery capability, domain expertise, and quality infrastructure to make it happen.
