AI and data governance: an illustrative scenario

The situation

A growing fintech has adopted AI features, new data sources and several cloud services quickly. Risk, compliance and technology teams each keep their own registers, policies reference different standards, and nobody can easily say which models are in use or who owns them.

Partners, auditors and regulators are asking sharper questions, and the answers are scattered across documents.

What the organization wants to achieve

• Maintain one inventory of data assets, models and vendors.
• Set clear ownership, approval and monitoring for AI use cases.
• Align policies with the standards the organization chooses to follow.
• Make evidence easy to produce for audits and partner reviews.

Approach

ARCHR would typically run this through its four phases: Discovery and Strategy, Pilot and Validation, Build and Scale, then Optimize and Evolve. In this scenario that could look like:

• Discovery: assess current policies, inventories and controls, and map gaps against chosen frameworks and regulator expectations.
• Discovery: define the data governance operating model, including ownership, stewardship and decision rights across risk, compliance, security and engineering.
• Pilot: apply a lightweight process to two or three real AI use cases, using a model inventory and risk tiers, and observe where it helps or slows teams.
• Build: implement tooling for a data catalog, lineage, policy and access control, a model registry, monitoring and evidence collection, integrated into continuous integration and delivery (CI/CD) pipelines with policy as code.
• Build: agree data contracts between producing and consuming teams so quality expectations are explicit.
• Optimize: review the framework regularly, simplify steps teams find heavy, and follow references such as the ISO/IEC 42001 AI management system standard, from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), and the U.S. National Institute of Standards and Technology (NIST) AI Risk Management Framework.

Technology and governance considerations

Governance tooling and monitoring can sit on AWS, Microsoft Azure or Google Cloud, using native security and policy services where they fit and infrastructure as code so controls apply consistently across accounts and subscriptions. Data residency, vendor risk, access control and incident response would be part of the same framework as model oversight.

Prudential supervisors' guidance on technology, third-party and model risk, for example the Office of the Superintendent of Financial Institutions (OSFI) in Canada, the Office of the Comptroller of the Currency (OCC) in the United States or European Union (EU) supervisors, would be a central reference, alongside ISO standards the organization may adopt, privacy obligations under laws such as Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) or the European Union's General Data Protection Regulation (GDPR) and securities regulator expectations where relevant. These shape the design; adopting a framework does not mean any organization is certified or compliant. Legal counsel should confirm obligations.

What success could look like

A pilot would agree measures and a baseline before any work starts. Qualitative signals the team could track include:

• Teams can answer who owns each model and what controls apply.
• New AI use cases move through a clear, proportionate approval path.
• Audit and partner requests are answered from maintained evidence.
• Risk and engineering leaders agree the process helps rather than blocks.

Actual results depend on an organization's data, systems and objectives. This page is not legal, financial or investment advice.