AI Governance Is Becoming an Information Governance Problem

What should organizations keep, protect and be able to explain when AI helps shape a business decision?

AI is often described as the great leveller: a tool that enables anyone to write, create or code. Yet access to the same technology does not produce the same results. The information people provide, the questions they ask and the judgment they apply all influence what happens next.

That has an important implication for governance. If we focus only on the AI system, we risk overlooking the information and decisions surrounding it.

In Episode 6 of Risk & Reason, Soniya Bopache explores why AI governance is becoming increasingly difficult to separate from information governance.

Watch Risk & Reason: “AI Governance Is Becoming an Information Governance Problem”

Look beyond the AI tool

Discussions about AI governance often begin with the technology. Is it reliable? Can its outputs be explained? Is it being used responsibly?

Those questions matter. But consider how AI might support an everyday business decision.

An employee enters information into an AI system. The system generates a response. The employee reviews it, makes changes and uses the revised material to inform a recommendation. That recommendation influences a decision, which is then communicated to others.

From a governance perspective, which parts of that process matter?

The original information? The prompt? The generated output? The employee’s changes? The final recommendation or communication?

There is no single answer that fits every situation. A brainstorming exercise and a recommendation supporting a consequential business decision may call for different treatment. The challenge is deciding which information matters in context, and why.

Familiar questions, with another layer of complexity

Organizations already make judgments about information every day:

• What needs to be retained, and for how long?
• Who should have access?
• What constitutes a business record?
• What could become relevant to an investigation?

AI introduces more material into those decisions. Prompts, outputs and revisions can all form part of the path from source information to business action.

A final document may show what an organization decided to communicate. It may reveal much less about the information that informed it, the role AI played or the changes someone made before approving it.

That does not mean every interaction needs to be preserved. It means organizations need a considered approach to identifying the parts that have business value or help explain a consequential decision.

Keeping everything is not a strategy

Retaining every prompt, response and revision may appear to offer completeness. In practice, it can create a growing volume of information without making it easier to understand what happened.

Keeping too little creates a different problem. An organization may retain the final result but lose the context needed to understand how it was reached.

The task is to establish a proportionate approach. That begins with understanding how people use AI, which activities it supports and where its contribution becomes significant.

Useful questions include:

• Purpose: Was AI used to explore ideas, draft content or inform a decision?
• Context: What information was provided, and how sensitive was it?
• Human judgment: How was the output reviewed, challenged or changed?
• Significance: Which records would help someone understand the resulting action?

These questions connect AI use to the information governance judgments organizations already need to make.

Bring the information lifecycle into AI governance

AI governance cannot stop at selecting a tool or setting rules for its use. It also needs to address what happens to information as people submit it, generate new material, revise it, share it and act on it.

This creates a practical reason for AI governance and information governance teams to work together. Decisions about retention, access and business records need to reflect how AI is actually being used. Equally, decisions about AI use need to account for the information responsibilities they create.

As AI becomes embedded in everyday work, the central question expands: which information do we need to govern to understand and support the decisions our organization makes?

That is where AI governance becomes an information governance challenge.

How is your organization deciding which parts of an AI interaction matter? Share your perspective in the comments.

For more on this discussion, watch Risk & Reason. In the next episode, we’ll explore what happens when you need to understand how an AI-influenced decision was actually made.