Data governance versus AI governance: when managing data well is not enough

By Antonio Tejeda Encinas, President of the Euro-American Committee of Digital Law - CEA Digital Law, and Meta Channel Corp

It comes as no surprise that the term ‘artificial intelligence governance’ now crops up in almost every 2025 steering committee and strategy paper. What is worrying is that, for all its ubiquity, it is too often mistaken for something it is not: a futuristic extension of data governance. This conceptual error — seemingly minor — is preventing many organisations from properly addressing the real risks of AI.

Managing data is one thing; governing autonomous systems capable of taking decisions with structural impact is quite another. And that means accepting that AI has brought with it an additional layer of complexity, one that cannot be resolved by applying traditional data governance frameworks.

First misconception: ‘We already have data policies, and they cover AI’

In far too many organisations, especially in the financial and healthcare sectors, the starting assumption is that if the data is well governed, then everything the AI does will be too. But the problem is not just what data the AI uses; it is what it does with it.

A bank, for example, may have excellent control over its customers’ data, from credit profiles to payment histories. But if an AI system automates mortgage approvals and ends up systematically rejecting certain socio-economic profiles — without anyone knowing why — the problem is not one of data, but of algorithmic governance. And at that point, the answer is no longer technological: it is legal, ethical and organisational.

Second misconception: ‘Thinking it only affects IT’

AI governance is not a technical matter to be locked away in the IT department. It directly affects areas such as human resources, marketing, compliance and senior management, and even boards and other collective decision-making bodies.

Imagine an HR department that uses AI to screen CVs automatically. Even if the data is encrypted and stored in compliance with the GDPR, if the model systematically excludes women over 50, we are looking at structural bias. Who detects it? Who corrects it? Who is accountable? This is not a question for the IT team. It is a question for the whole organisation.

Third misconception: ‘Governing AI means supervising data’

Data governance frameworks, as we well know, are designed to answer key questions: who owns the data? How is it stored? What rules govern how it is shared? Is it reliable and compliant with regulation?

All of this is essential.

But AI calls for a different kind of question:

* How is the model trained, and on what criteria?
* Who validates the results?
* How is its behaviour audited?
* What mechanisms are there to correct an automated failure in real time?

When an insurer uses AI to set differentiated premiums and not even the chief executive knows how it does so, we are not dealing with a data governance problem.

We are dealing with a delegation of power without control.

The AI Act: Europe’s turning point

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689), in force since August 2024, is built on precisely this distinction. It does not confuse AI governance with data protection; instead, it creates a specific framework of obligations for the design, deployment and oversight of AI systems, particularly in high-risk contexts.

The EU has understood that AI does not merely work with data: it acts upon people, rights, decisions and structures. It must therefore be subject to principles such as transparency, explainability, accountability and meaningful human intervention.

In short: managing data well is not enough.

It is like saying that because a car has good tyres, there is no need to regulate the driver.

AI does not just process information: it acts.

That is why AI governance cannot be reduced to good data practice. It requires a new framework. A change of mindset.

Above all, it requires institutional leadership willing to accept that governing AI means governing the invisible power that now takes decisions without a face or a signature.