By Antonio Tejeda Encinas , president Comite Euro Americano Digital Law , and Meta Channel Corp
It is not unusual for the term “artificial intelligence governance” to appear by now in any steering committee or strategic document in 2025. What is indeed worrying is that, despite its omnipresence, it is all too often confused with something it is not: a futuristic extension of data governance. This conceptual error—which may seem minor—is preventing many organizations from properly addressing the real risks of AI.
Because managing data is one thing, and governing autonomous systems capable of making decisions with structural impact is quite another. And that requires accepting that AI has brought with it an additional layer of complexity, one that cannot be resolved by applying the traditional frameworks of data governance.
First misconception: “we already have data policies, that covers AI”
In too many organizations, especially in the financial and healthcare sectors, the starting assumption is that if data is well governed, then everything AI does will be as well. But the problem is not only what data AI uses, but what it does with it.
For example, a bank may have excellent control over its customers’ data, from credit profiles to payment history. But if an AI system automates mortgage approvals and ends up systematically rejecting certain socioeconomic profiles—without anyone knowing why—we are not facing a data problem, but a problem of algorithmic governance. And there, the answer is no longer technological: it is legal, ethical and organizational.
Second misconception: “thinking it only affects IT”
AI governance is not a technical matter locked away in an IT department. It directly affects areas such as human resources, marketing, regulatory compliance, general management, and even collegiate governing bodies.
Imagine an HR department that uses AI to perform automated CV screening. Even if the data is encrypted and stored in accordance with the GDPR, if the model systematically excludes women over 50, we are facing structural bias. Who detects it? Who corrects it? Who is accountable? This is not a question for the IT specialist. It is a question for the entire organization.
Third misconception: “governing AI means overseeing data”
Data governance frameworks, as we well know, are designed to answer key questions: who owns the data? how is it stored? what rules apply to sharing it? is it reliable and compliant with regulation?
All of this is essential.
But AI demands a different kind of question:
* How is the model trained, and according to what criteria?
* Who validates the results?
* How is its behavior audited?
* What mechanisms exist to correct an automated failure in real time?
When an insurance company uses AI to set differentiated premiums without even the chief executive knowing how it does so, we are not facing a data governance problem.
We are facing an uncontrolled delegation of power.
RIA: the European turning point
The European Union’s Artificial Intelligence Regulation (RIA), in force since August 2024, is based precisely on this distinction. It does not confuse AI governance with data protection; rather, it creates a specific framework of obligations for the design, deployment and oversight of AI systems, especially in high-risk contexts.
The EU has understood that AI does not merely operate with data: it operates on people, rights, decisions and structures. And it must therefore be subject to principles such as transparency, explainability, accountability and meaningful human intervention.
In short: Managing data well is not enough.
It is like saying that because a car has good tires, there is no need to regulate the driver.
AI does not just process information: it acts.
And that is why AI governance cannot be reduced to good data practices. It demands a new framework. A change of mindset.
And, above all, it demands institutional leadership to accept that governing AI means governing the invisible power that today makes decisions without a face or a signature.
