WEBVTT
00:00:00.400 --> 00:00:01.600
Chapter 5.
00:00:01.840 --> 00:00:11.279
Data Governance The Foundation of Trusted Enterprise AI Before AI can think, it must trust the information it's built on.
00:00:11.519 --> 00:00:13.759
Governance is what makes that possible.
00:00:14.000 --> 00:00:20.640
It's the discipline that turns scattered content into a coherent, compliant, and usable asset.
00:00:20.879 --> 00:00:26.239
One that can safely feed intelligent systems without compromising security or integrity.
00:00:26.480 --> 00:00:32.640
Enterprise information management treats governance as an operating principle, not a checklist.
00:00:32.799 --> 00:00:43.119
It rests on four interlocking pillars metadata, permissions and access control, retention and lifecycle management, and auditability.
00:00:43.520 --> 00:00:51.840
Each one defines how data behaves across its lifespan, and together, they form the backbone of trusted intelligence.
00:00:52.079 --> 00:00:59.119
In this chapter, we'll examine each of these pillars and their relationship to optimized, compliant, and secure AI.
00:00:59.439 --> 00:01:05.200
Forrester forecasts that AI governance software spending will quadruple by 2030.
00:01:05.519 --> 00:01:08.400
Good governance is good business.
00:01:08.799 --> 00:01:21.200
Information governance is the practice of implementing policies, processes, and controls to manage information in support of regulatory, legal, risk, environmental, and operational requirements.
00:01:21.439 --> 00:01:31.439
As volumes of enterprise information increase, so too does the need for digital governance to ensure that this information is managed, secured, and searchable.
00:01:32.159 --> 00:01:44.000
From a technology perspective, governance relies on the effective management of information throughout its life cycle, from creation or capture and classification to long-term archival or deletion.
00:01:44.239 --> 00:01:56.159
Successful information governance programs demand that companies balance the needs and priorities to mitigate legal and business risk with the costs required to manage both unstructured and structured information.
00:01:56.400 --> 00:02:04.799
For an information governance strategy to be effective, key resources and stakeholders need to be identified, empowered, and supported.
00:02:05.040 --> 00:02:08.319
Policies must be incorporated into relevant processes.
00:02:08.639 --> 00:02:19.520
Education and training should be provided to all employees, technology infrastructure optimized, and the appropriate solutions implemented to support secure and reliable operations.
00:02:20.000 --> 00:02:32.639
In the following feature, ASR Nederland is demonstrating how good governance is good for their business, enabling them to comply with regulations and providing a strategic advantage through improved customer service.
00:02:32.960 --> 00:02:36.080
Case study ASR Netherland.
00:02:37.039 --> 00:02:41.840
One of ASR's core business processes is disability income insurance.
00:02:42.000 --> 00:02:45.520
Previously, this claims process was paper driven.
00:02:45.680 --> 00:02:56.800
Both medical and technical information were kept in one folder and accessible to unqualified personnel, consequently, leading to a nonconformance with Dutch privacy law.
00:02:56.960 --> 00:03:03.280
In addition, ASR required a significant amount of storage space to store the continuously growing folders.
00:03:03.599 --> 00:03:17.680
ASR recognized the need for a solution that would improve business processes, enable collaboration between departments, reduce costs across the organization, and permit only authorized access to information to comply with regulations.
00:03:18.000 --> 00:03:28.719
Using a combination of business process modeling and operational improvement solutions, ASR has been able to modernize existing processes while responding to legislative change.
00:03:28.960 --> 00:03:41.360
For example, medical and technical information related to disability claims are now separated and only accessible to qualified personnel, helping ASR comply with privacy legislation.
00:03:41.680 --> 00:03:48.159
As well, the entire claims management process can be measured to give management visibility into processes.
00:03:48.639 --> 00:03:56.400
The flexible environment supports a new way to benchmark so that business activities can be monitored across numerous divisions.
00:03:56.719 --> 00:04:06.000
The solution gives ASR an enterprise-wide standard claims processing system that has dramatically improved internal efficiencies and increased productivity.
00:04:06.240 --> 00:04:26.319
Employees now process 80% of the claims on time, which has led to a 25% reduction to the claims processing team, and services costs and indemnity have been significantly reduced, all of which enable ASR to deliver new products faster, comply with regulations, and provide better customer service.
00:04:26.879 --> 00:04:36.319
Now that we've seen how data governance benefits the enterprise, let's consider the four key pillars of strong data governance introduced at the beginning of this chapter.
00:04:36.560 --> 00:04:41.680
Pillar one, metadata, the context behind every decision.
00:04:42.160 --> 00:04:52.079
Metadata is the DNA of digital information, the hidden context that tells systems what something is, where it came from, and how it should be used.
00:04:52.319 --> 00:05:00.160
It links content to business purpose and transforms raw data into something searchable, governable, and meaningful.
00:05:00.800 --> 00:05:03.920
Information enters the enterprise through many doors.
00:05:04.160 --> 00:05:12.079
Some is born digital, created by people using word processors, spreadsheets, CAD software, or email clients.
00:05:12.399 --> 00:05:25.600
Some originates in business systems, generated by enterprise resource systems, ERPs, customer relationship management, CRM, or databases with defined schemas and relational structures.
00:05:25.759 --> 00:05:30.000
Other content is captured from analog sources, as scanners.
00:05:30.240 --> 00:05:38.800
Then there's machine data from sensors, logs, and telemetry, and web and social content from internets, collaboration tools, and portals.
00:05:39.040 --> 00:05:49.839
Organizations also produce multimedia, training videos, marketing assets, and recorded meetings, all of which carry operational and legal value.
00:05:50.079 --> 00:05:53.279
Managing this diversity requires a control layer.
00:05:53.519 --> 00:06:00.560
Metadata, classification, retention tags, provenance, and sensitivity serves as that control plane.
00:06:00.720 --> 00:06:07.199
It allows automated permissioning, targeted search, version control, and records enforcement.
00:06:07.439 --> 00:06:10.959
It's also the foundation for responsible enterprise AI.
00:06:11.279 --> 00:06:20.879
Without metadata, an AI model can't distinguish between a draft and a final version, or between a public brochure and a privileged client file.
00:06:21.120 --> 00:06:30.240
Metadata provides the essential context: who created something, when it was changed, where it came from, and how sensitive it is.
00:06:30.800 --> 00:06:40.879
These details give meaning to raw content and help both people and intelligent systems understand what can be trusted, what can be shared, and what should be protected.
00:06:41.040 --> 00:06:45.839
Without unified metadata, AI training is unreliable or unsafe.
00:06:46.160 --> 00:06:59.519
EIM provides the framework to map governance directly to information models, ensuring that automation and AI respect the same business, legal, and ethical boundaries that already define trusted data.
00:06:59.759 --> 00:07:06.160
Metadata isn't a static label, it's a living framework for policy enforcement and machine reasoning.
00:07:06.319 --> 00:07:13.040
As AI matures, metadata becomes the connective tissue between governed data and intelligent action.
00:07:13.519 --> 00:07:19.839
Discover how HBO relies on metadata to consolidate and manage assets throughout their life cycle.
00:07:20.079 --> 00:07:20.879
Case study.
00:07:21.360 --> 00:07:36.959
HBO HBO is America's most successful premium television network, offering rich digital media content, blockbuster movies, innovative original programming, provocative documentaries, concert events, and championship boxing.
00:07:37.279 --> 00:07:46.639
HBO sought a solution that would allow them to easily access and share digital content both within HBO and the larger Time Warner family.
00:07:46.959 --> 00:08:00.399
The requirements for the overall system functionality and user experience entailed the system handling large volumes of content, as well as addressing disparant databases, workflows, and use cases for each of the organizations.
00:08:00.800 --> 00:08:11.360
HBO's media management implementation encompassed all of HBO's digital photographs, supporting such areas as marketing, promotions, advertising, and sales.
00:08:11.759 --> 00:08:19.279
These assets can range from location shots from films to a gallery of quality professional photos of HBO celebrities.
00:08:19.439 --> 00:08:23.680
Part of their overall strategy was to ensure careful management of metadata.
00:08:24.079 --> 00:08:34.960
Assets are tagged with corresponding metadata, such as contractual information, as early as possible to ensure that metadata travels with the asset throughout its life cycle.
00:08:35.279 --> 00:08:39.919
This meta tagging process is enforced with an embedded workflow component.
00:08:40.240 --> 00:08:49.679
The HBO Digital Asset Management System is accessed by all of the regional offices and currently holds more than 325,000 assets.
00:08:50.000 --> 00:08:55.840
If governance defines the rules, permissions enforce them, one decision at a time.
00:08:56.159 --> 00:08:59.120
Pillar two permissions and access control.
00:08:59.679 --> 00:09:02.799
Who can see what, when, and why?
00:09:03.039 --> 00:09:05.679
Permissions define the boundaries of trust.
00:09:05.919 --> 00:09:11.519
They determine who can view, edit, or share information, and under what conditions.
00:09:11.840 --> 00:09:15.919
For decades, these principles have protected corporate and personal data.
00:09:16.159 --> 00:09:19.600
In the AI era, they take on new urgency.
00:09:19.919 --> 00:09:30.320
Every decision an intelligent system makes depends on access, what data it can see, what it can learn from, and what actions it's authorized to perform.
00:09:30.639 --> 00:09:35.519
In an enterprise information environment, permissions are not simple IT switches.
00:09:35.679 --> 00:09:38.080
They are the enforcement layer of governance.
00:09:38.399 --> 00:09:45.519
Version control, workflow approvals, records holds, and selective publication all depend on them.
00:09:45.759 --> 00:09:51.759
Effective permission models regulate not only what users can do, but also when and why.
00:09:52.000 --> 00:09:58.320
A document that can be edited today might be locked tomorrow under a regulated process or legal hold.
00:09:58.639 --> 00:10:07.759
This dynamic control ensures that information remains traceable and trustworthy, even as it moves through the complex life cycles and collaborative environments.
00:10:08.000 --> 00:10:12.320
Modern EIM systems achieve this precision through granular permissions.
00:10:12.559 --> 00:10:22.960
Every object, document, folder, workflow, or image carries its own security profile, defining access for each group user and group across the system.
00:10:23.200 --> 00:10:32.000
At enterprise scale, where users may number in the hundreds of thousands, these models can translate into billions of unique permission combinations.
00:10:32.320 --> 00:10:34.720
Yet this complexity is necessary.
00:10:34.960 --> 00:10:42.639
Without the ability to assign security at the most granular level, an information system cannot truly be considered secure.
00:10:42.879 --> 00:10:51.679
It's this flexibility that allows organizations to emulate the physical controls of a secure workspace, digitally and at scale.
00:10:52.159 --> 00:10:59.279
As AI becomes another user in the system, those same permission structures must extend to intelligent agents.
00:10:59.519 --> 00:11:03.200
If a document is confidential, the AI must know it too.
00:11:03.519 --> 00:11:16.879
Permissions are no longer just about control, they're about confidence, ensuring that every person and every system interacts with information purposefully, within defined boundaries, and under full accountability.
00:11:17.120 --> 00:11:27.039
This is how organizations protect privacy, preserve competitive advantage, and ensure that AI operates safely inside the zones it's authorized to learn from.
00:11:27.360 --> 00:11:38.480
The case study below, featuring a European investment bank, illustrates the effective use of permissions in classifying documents across locations to achieve operational and governance objectives.
00:11:38.799 --> 00:11:41.279
Case study A European Bank.
00:11:41.519 --> 00:11:47.440
An investment bank in Europe finances capital investments aligned with European Union policy objectives.
00:11:47.759 --> 00:11:50.960
The literal infrastructure of a more integrated Europe.
00:11:51.200 --> 00:11:59.679
With operations spanning roughly 150 countries outside the EU, secure and efficient remote access to documents isn't a convenience.
00:11:59.840 --> 00:12:01.440
It's mission critical.
00:12:01.679 --> 00:12:14.399
To achieve this, the bank implemented an EIM system as part of a broader IT modernization effort to transform every major process in the bank, borrowing, lending, and administration.
00:12:14.799 --> 00:12:28.000
The system was fully embedded into the bank's IT ecosystem so that content, data, and workflows could move seamlessly between systems, ensuring consistency and compliance across all operations.
00:12:28.399 --> 00:12:30.960
Governance lies at the heart of this system.
00:12:31.120 --> 00:12:42.000
The investment bank developed a bank-wide taxonomy that defines not only how content is categorized, but how it aligns with business processes and regulatory frameworks.
00:12:42.240 --> 00:12:55.919
Based on international best practices, including the DIRKS methodology and the ISO 15489 standards, the taxonomy is paired with a sophisticated access control model that applies at the highest level of classification.
00:12:56.159 --> 00:12:59.600
Together, these models form a living governance framework.
00:12:59.759 --> 00:13:08.720
The taxonomy maps what information exists and where it belongs, while the permissions model governs who can access it, under what conditions, and for what purpose.
00:13:08.960 --> 00:13:16.159
The result is a digital knowledge map that reflects the institution's structure, accountability, and decision rights.
00:13:16.399 --> 00:13:21.440
This disciplined information architecture now provides the foundation for AI enablement.
00:13:21.679 --> 00:13:38.159
With a consistent taxonomy and granular permissioning, they can train AI tools to retrieve, summarize, and classify documents safely, knowing that every action taken by an intelligent agent adheres to the same access and compliance rules as a human user.
00:13:38.399 --> 00:13:46.799
Governance ensures that AI doesn't just automate tasks, but operates within the same boundaries of trust that define the bank's human workflows.
00:13:47.039 --> 00:13:49.279
The results validate the approach.
00:13:49.519 --> 00:14:00.639
Two months after launch, user adoption rates were 20% higher than projected, with 100% of vital records from new lending and borrowing operations supported in the system.
00:14:00.879 --> 00:14:08.399
Within weeks, the repository contained over 600,000 documents, growing by roughly 100,000 per week.
00:14:08.720 --> 00:14:17.919
This success demonstrated that when governance, taxonomy, and access control work together, they don't slow innovation, they make it scalable.
00:14:18.159 --> 00:14:24.320
Pillar three, retention and lifecycle management, knowing when to keep and when to let go.
00:14:24.639 --> 00:14:29.120
Information governance isn't just about storage, it's about stewardship.
00:14:29.279 --> 00:14:37.200
Every piece of content has a life creation, use, revision, retention, and eventual disposal.
00:14:37.440 --> 00:14:43.200
Managing that life cycle is how organizations stay compliant, efficient, and sustainable.
00:14:43.519 --> 00:14:48.000
Regulated information or records come from every corner of the enterprise.
00:14:48.320 --> 00:14:56.879
ERP and CRM systems, email, documents, scanned paper, telemetry, medical devices, even aviation maintenance systems.
00:14:57.120 --> 00:15:07.039
The first step in governance is capture, bringing this information in through the controlled channels such as digital mailrooms, system connectors, or APIs.
00:15:07.279 --> 00:15:15.440
Each record must arrive with its metadata, timestamps, and provenance intact to ensure authenticity and legal defensibility.
00:15:15.679 --> 00:15:23.600
Governance begins not when information is stored, but at the moment it enters the system, when the trail of trust is first created.
00:15:23.840 --> 00:15:30.879
Once captured, records are distributed across layered storage environments that reflect their purpose and risk profile.
00:15:31.200 --> 00:15:33.759
Operational systems handle active records.
00:15:34.080 --> 00:15:44.879
Content management repositories enforce versioning, classification, and retention, and immutable archives preserve communications and evidence for legal or regulatory use.
00:15:45.360 --> 00:15:52.960
In analytics environments, regulated data may be tokenized or masked to protect privacy while still enabling insight.
00:15:53.200 --> 00:16:01.840
Long-term archives on tape, in object storage, or in sovereign clouds provide non-erasable retention where required by law.
00:16:02.000 --> 00:16:07.440
An EIM platform embeds retention policies directly into the systems where content lives.
00:16:07.679 --> 00:16:18.000
This ensures that the same document that supports a business decision today can be archived tomorrow or automatically deleted when its legal or operational value expires.
00:16:18.240 --> 00:16:23.200
The same principles that govern enterprise records now extend to artificial intelligence.
00:16:23.440 --> 00:16:32.720
As AI systems generate, consume, and learn from enterprise content, their inputs and outputs must be treated with the same rigor as regulated data.
00:16:32.960 --> 00:16:40.559
Each model interaction becomes its own record, subject to capture, classification, retention, and auditability.
00:16:40.879 --> 00:16:52.720
Governance ensures that AI learns from trusted sources, acts within defined boundaries, and produces outcomes that are explainable, defensible, and aligned with enterprise policy.
00:16:52.960 --> 00:16:59.919
In this way, the disciplines that built confidence in data governance become the guardrails for responsible intelligence.
00:17:00.159 --> 00:17:02.879
Pillar four, auditability.
00:17:03.120 --> 00:17:05.039
Proof that governance works.
00:17:05.279 --> 00:17:11.279
In traditional records management, auditability meant logs, version histories, and paper trails.
00:17:11.519 --> 00:17:18.400
In the AI era, it also means model transparency, understanding what information shaped an outcome.
00:17:18.559 --> 00:17:22.240
Auditability should be incorporated into the content lifecycle.
00:17:22.480 --> 00:17:29.200
Every document, transaction, and system event carries a traceable history of changes and approvals.
00:17:29.440 --> 00:17:39.039
When extended to AI, the same principle provides explainability, showing not just what a model decided, but which data contributed to that decision.
00:17:39.359 --> 00:17:43.039
This visibility is what turns governance into trust.
00:17:43.279 --> 00:17:50.640
Auditability assures regulators, executives, and the public that automation operates within defined boundaries.
00:17:51.039 --> 00:17:58.000
It transforms compliance from a reactive process into a verifiable standard for responsible intelligence.
00:17:58.240 --> 00:18:03.039
These governance capabilities are bundled in an EIM platform in the cloud.
00:18:03.200 --> 00:18:12.799
With the evolution of AI, governance has to come first because it defines the rules of engagement between people, data, and intelligent systems.
00:18:13.119 --> 00:18:14.960
Metadata provides the map.
00:18:15.279 --> 00:18:17.200
Permissions define access.
00:18:17.440 --> 00:18:22.960
Life cycle management ensures balance, and auditability proves accountability.
00:18:23.200 --> 00:18:26.079
Without these foundations, AI is guessing.
00:18:26.240 --> 00:18:30.480
With them, it becomes part of a disciplined information ecosystem.
00:18:30.880 --> 00:18:39.200
One that learns, reasons, and acts within the boundaries that make intelligence safe, lawful, and human aligned.
00:18:39.519 --> 00:18:43.920
More than 100,000 rules and regulations and growing.
00:18:44.240 --> 00:18:45.440
North America.
00:18:46.000 --> 00:18:47.119
Dodd Frank.
00:18:47.839 --> 00:18:51.839
PCI-DSS Pipada.
00:18:52.799 --> 00:20:05.200
SEC Rule 17A-4, Sarbanes Ackley, Europe and Asia, Basel III with Basel II, Capital Accord, Financial Services Authority, UK Bribery Act, BSI, PD5000, Mobile Payments Security in Europe, UAE wallet, PSD two, Financial Inclusion, SEPA slash E SEPA, SEPA for cards, NPCI, Global Facta, Basel III, Capital Norms, Basel and Intraday Liquidity Norms, Real Time Retail Payments, Anti-Money Laundering, AML, Anti-Terrorism Financing, ATF, ISO 20022 Standards and Payments, CPSS-IOSCO, a complex governance landscape.
00:20:05.519 --> 00:20:12.240
In today's global marketplace, the regulatory landscape is complex, especially for global firms.
00:20:12.559 --> 00:20:20.079
Organizations are subject to industry specific regulations and standards as well as regional or national regulations.
00:20:20.559 --> 00:20:31.519
According to these regulations, they are held accountable for their actions and must be able to access years of historical data in response to requests for information at any given time.
00:20:31.839 --> 00:20:35.839
The relationship between compliance and governance is reciprocal.
00:20:36.160 --> 00:20:39.680
Compliance serves as a driver for information governance.
00:20:39.920 --> 00:20:44.240
And information governance, in turn, can simplify compliance.
00:20:44.400 --> 00:20:55.759
In the face of growing volumes of data, there is a strong need for governance programs to help transform organizations to enable them to benefit from the better management of their information.
00:20:56.640 --> 00:21:09.920
Enterprises that implement EIM as a governance platform are realizing the opportunities it gives them to drive business transformation efficiently and successfully through optimized intelligence and AI.
00:21:10.480 --> 00:21:14.960
Compliance, sovereignty, and the shape of modern governance.
00:21:15.599 --> 00:21:20.559
Data sovereignty has moved from a compliance footnote to a design principle.
00:21:20.799 --> 00:21:27.599
It now defines where data lives, who can reach it, and under what jurisdiction those actions fall.
00:21:27.839 --> 00:21:31.359
In an AI-driven world, this matters deeply.
00:21:31.680 --> 00:21:36.880
Models trained or hosted in one region may still be governed by the laws of another.
00:21:37.200 --> 00:21:41.279
The result is that sovereignty is no longer a legal abstraction.
00:21:41.519 --> 00:21:43.839
It's an architectural constraint.
00:21:44.079 --> 00:21:51.839
Every storage choice, API, and training data set must now account for the regulatory geography it touches.
00:21:52.160 --> 00:21:55.119
Privacy laws and regional regulation.
00:21:55.759 --> 00:21:59.599
Europe set the global pace with the General Data Protection Regulation.
00:22:00.319 --> 00:22:01.519
GDPR.
00:22:02.160 --> 00:22:09.039
It transformed cross-border data flows from a technical assumption into a legal engineering challenge.
00:22:09.359 --> 00:22:23.200
GDPR codified principles of lawfulness, purpose limitation, minimization, and accountability, mandating clear consent, impact assessments, and data subject rights.
00:22:23.440 --> 00:22:37.440
Its enforcement has reshaped how enterprises design systems, data inventories, metadata driven workflows, and automated deletion policies are now baseline governance features, not optional controls.
00:22:37.680 --> 00:22:42.000
The EU Data Act extends those ideas to cloud mobility.
00:22:42.240 --> 00:22:48.240
Providers must now support interoperability and enable customers to exit cloud environments freely.
00:22:48.559 --> 00:22:52.240
No lock-ins, no excessive transfer fees.
00:22:52.559 --> 00:23:02.079
For architects, that means building with portability in mind, open standards, reversible formats, and cloud independence by design.
00:23:02.319 --> 00:23:06.480
Sovereignty in Europe is being legislated into existence.
00:23:06.720 --> 00:23:12.799
Across the Atlantic, the United States is assembling a de facto federal standard one state at a time.
00:23:13.039 --> 00:23:22.240
Over twenty states now enforce their own comprehensive privacy laws, each defining consent, sensitive data, and user rights differently.
00:23:22.559 --> 00:23:34.960
This patchwork demands policy as code, automated rules that adapt to jurisdictional nuance and ensure the right law applies to the right record, user, or transaction.
00:23:35.680 --> 00:23:39.359
The Cloud Act further complicates matters by granting U.S.
00:23:39.440 --> 00:23:41.839
authorities access to data held by U.S.
00:23:42.000 --> 00:23:51.839
based providers, even when stored abroad, forcing global enterprises to think carefully about contractual control and storage sovereignty.
00:23:52.079 --> 00:23:54.079
Canada's Layered Model.
00:23:54.400 --> 00:23:57.759
Canada approaches sovereignty through layered accountability.
00:23:58.000 --> 00:24:14.720
Federally, PIPADA or the Personal Information Protection and Electronic Documents Act, sets the baseline for responsible handling of personal information, permitting cross-border transfers but maintaining that organizations remain accountable for protections end to end.
00:24:15.039 --> 00:24:36.319
Its forthcoming replacement, the Digital Charter Implementation Act, Bill C27, introduces the Consumer Privacy Protection Act, CPPA, a data protection tribunal and the Artificial Intelligence and Data Act designed to govern responsible AI development and deployment.
00:24:36.559 --> 00:24:40.160
At the provincial level, compliance becomes more granular.
00:24:40.400 --> 00:24:58.960
BC's FOIPA, or Freedom of Information and Protection of Privacy Act, reforms have relaxed residency restrictions for public data, while Ontario's health privacy law, the Personal Health Information Protection Act, FIPA, continues to enforce strict standards for health information.
00:24:59.440 --> 00:25:12.480
Financial regulators such as OSVI or Office of the Superintendent of Financial Institutions through Guidelines B-10 have elevated data location and cloud oversight to board level responsibilities.
00:25:12.720 --> 00:25:14.400
The message is consistent.
00:25:14.640 --> 00:25:22.799
Sovereignty in Canada is both practical and provincial, demanding careful mapping of where data resides and who can access it.
00:25:23.119 --> 00:25:26.559
Global compliance and industry specific rules.
00:25:26.880 --> 00:25:31.359
Beyond North America and Europe, data sovereignty pressures are global.
00:25:31.599 --> 00:25:41.279
China's personal information protection law requires explicit security assessments for cross-border transfers of important data.
00:25:41.680 --> 00:25:54.000
India's Digital Personal Data Protection Act adds localization style provisions and new transfer conditions that could influence where and how AI workloads operate.
00:25:54.319 --> 00:26:01.440
Each regulation tightens expectations for lawful transfer, explicit consent, and retention discipline.
00:26:01.599 --> 00:26:04.480
Industry regulations amplify these demands.
00:26:04.720 --> 00:26:05.279
The U.S.
00:26:05.359 --> 00:26:17.200
HIPAA, or Health Insurance Portability and Accountability Act, is framework governs electronic health records with strict access, control, encryption, and breach notification.
00:26:17.839 --> 00:26:30.319
The FDA's Food and Drug Administration's 21 CFR Part 11 sets standards for trustworthy electronic records and signatures in regulated manufacturing and clinical environments.
00:26:30.640 --> 00:26:46.319
The FTC, or Federal Trade Commission, enforces reasonable care over consumer data security, while the FAA, or Federal Aviation Administration, defines authenticity and traceability requirements for digital maintenance records in aviation.
00:26:46.559 --> 00:26:49.200
Together they reinforce a common truth.
00:26:49.440 --> 00:26:55.359
Regulated data must be captured, retained, and auditable throughout its life cycle.
00:26:55.599 --> 00:26:57.599
Sovereignty and AI.
00:26:58.559 --> 00:27:04.160
For artificial intelligence, these laws translate into operational limits and design choices.
00:27:04.480 --> 00:27:08.319
Enterprise AI cannot learn from what it cannot lawfully see.
00:27:08.559 --> 00:27:17.279
Sovereign clouds, built to localize storage, processing, and access, are becoming the architectural answer to regulatory fragmentation.
00:27:17.519 --> 00:27:27.200
They allow organizations to deploy AI where the data lives, respecting jurisdictional boundaries while maintaining the control needed for compliance and trust.
00:27:27.440 --> 00:27:39.599
As EAI models grow more agentic, sovereignty will define their perimeter, what they're allowed to read, what they can retain, and how their actions are logged and explained.
00:27:39.839 --> 00:27:42.559
Compliance is no longer about static records.
00:27:42.720 --> 00:27:48.319
It's about dynamic systems that think, learn, and act under legal supervision.
00:27:48.559 --> 00:27:55.759
An enterprise information management platform with embedded governance is now the operating system for intelligence itself.
00:27:56.079 --> 00:27:59.200
Governance as the operating system of trust.
00:27:59.839 --> 00:28:07.200
In a world where information moves across borders, clouds, and algorithms, governance defines the rules of engagement.
00:28:07.359 --> 00:28:15.200
It ensures that data remains accurate, traceable, and defensible, no matter where it travels or how it's used.
00:28:15.440 --> 00:28:18.640
Effective governance requires more than documentation.
00:28:18.880 --> 00:28:27.759
It demands executive sponsorship, streamlined processes, automated policy enforcement, and identity-centric security.
00:28:28.000 --> 00:28:37.920
It requires that every action on data, from capture to disposal, be visible, auditable, and aligned with legal and ethical standards.
00:28:38.160 --> 00:28:44.240
Modern information management frameworks now embed these controls directly into daily operations.
00:28:44.559 --> 00:28:53.680
Metadata, permissions, and retention aren't afterthoughts, they're embedded logic that keeps systems honest and AI accountable.
00:28:53.920 --> 00:29:05.839
By treating information as a managed asset, one with provenance, purpose, and lifecycle, organizations transform governance from a cost of doing business into a source of competitive advantage.
00:29:06.079 --> 00:29:10.880
Ultimately, governance is what allows enterprises to trust their intelligence.
00:29:11.039 --> 00:29:16.400
It connects the ethics of how we manage information with the mechanics of how AI learns it.
00:29:16.640 --> 00:29:21.759
When done right, governance doesn't slow innovation, it makes it sustainable.
00:29:22.000 --> 00:29:26.160
We discuss the governance of AI in more detail in the following chapter.
00:29:26.480 --> 00:29:32.400
The FAST Five Download one, make governance an enterprise mandate.
00:29:32.640 --> 00:29:39.759
Establish a cross-functional governance council that includes business, IT, legal, and compliance leaders.
00:29:40.000 --> 00:29:43.680
Give it authority to set enterprise-wide data policies.
00:29:44.000 --> 00:29:47.920
Approve AI use cases, and monitor adherence.
00:29:48.240 --> 00:29:52.799
Governance isn't an IT project, it's a management discipline.
00:29:53.119 --> 00:29:57.200
Two, operationalize permissions and access control.
00:29:57.680 --> 00:30:02.559
Move from static role-based permissions to dynamic policy driven access.
00:30:02.880 --> 00:30:08.720
Map who can see or use specific information and extend those same controls to AI systems.
00:30:08.960 --> 00:30:17.279
Treat every AI interaction as a governed event with audit trails, expiry dates, and explicit accountability.
00:30:17.599 --> 00:30:21.519
Three, map and classify critical data assets.
00:30:22.160 --> 00:30:28.400
Conduct enterprise data inventories to locate high value, regulated, and sensitive information.
00:30:28.960 --> 00:30:41.519
Use EIM tools to tag content with metadata, ownership, sensitivity, and retention so it can be used safely for AI training, automation, and analytics.
00:30:42.079 --> 00:30:46.880
Four, embed compliance and sovereignty into architecture.
00:30:47.200 --> 00:30:50.400
Design for jurisdictional complexity from the start.
00:30:50.720 --> 00:30:55.519
Choose sovereign or regional cloud configurations where data residency matters.
00:30:55.839 --> 00:31:05.119
Automate compliance through metadata and policy as code, so rules about where data can live or move are enforced by design, not by audit.
00:31:05.440 --> 00:31:06.000
5.
00:31:06.400 --> 00:31:09.039
Govern AI like you govern data.
00:31:09.359 --> 00:31:18.880
Treat models as managed assets with the same expectations as data, documented provenance, life cycle control, and retraining governance.
00:31:19.279 --> 00:31:27.839
Require that every AI initiative demonstrate lawful data use, explainable decisions, and measurable ROI before it scales.
00:00:00.400 --> 00:00:01.600
Chapter 5.
00:00:01.840 --> 00:00:11.279
Data Governance The Foundation of Trusted Enterprise AI Before AI can think, it must trust the information it's built on.
00:00:11.519 --> 00:00:13.759
Governance is what makes that possible.
00:00:14.000 --> 00:00:20.640
It's the discipline that turns scattered content into a coherent, compliant, and usable asset.
00:00:20.879 --> 00:00:26.239
One that can safely feed intelligent systems without compromising security or integrity.
00:00:26.480 --> 00:00:32.640
Enterprise information management treats governance as an operating principle, not a checklist.
00:00:32.799 --> 00:00:43.119
It rests on four interlocking pillars metadata, permissions and access control, retention and lifecycle management, and auditability.
00:00:43.520 --> 00:00:51.840
Each one defines how data behaves across its lifespan, and together, they form the backbone of trusted intelligence.
00:00:52.079 --> 00:00:59.119
In this chapter, we'll examine each of these pillars and their relationship to optimized, compliant, and secure AI.
00:00:59.439 --> 00:01:05.200
Forrester forecasts that AI governance software spending will quadruple by 2030.
00:01:05.519 --> 00:01:08.400
Good governance is good business.
00:01:08.799 --> 00:01:21.200
Information governance is the practice of implementing policies, processes, and controls to manage information in support of regulatory, legal, risk, environmental, and operational requirements.
00:01:21.439 --> 00:01:31.439
As volumes of enterprise information increase, so too does the need for digital governance to ensure that this information is managed, secured, and searchable.
00:01:32.159 --> 00:01:44.000
From a technology perspective, governance relies on the effective management of information throughout its life cycle, from creation or capture and classification to long-term archival or deletion.
00:01:44.239 --> 00:01:56.159
Successful information governance programs demand that companies balance the needs and priorities to mitigate legal and business risk with the costs required to manage both unstructured and structured information.
00:01:56.400 --> 00:02:04.799
For an information governance strategy to be effective, key resources and stakeholders need to be identified, empowered, and supported.
00:02:05.040 --> 00:02:08.319
Policies must be incorporated into relevant processes.
00:02:08.639 --> 00:02:19.520
Education and training should be provided to all employees, technology infrastructure optimized, and the appropriate solutions implemented to support secure and reliable operations.
00:02:20.000 --> 00:02:32.639
In the following feature, ASR Nederland is demonstrating how good governance is good for their business, enabling them to comply with regulations and providing a strategic advantage through improved customer service.
00:02:32.960 --> 00:02:36.080
Case study ASR Netherland.
00:02:37.039 --> 00:02:41.840
One of ASR's core business processes is disability income insurance.
00:02:42.000 --> 00:02:45.520
Previously, this claims process was paper driven.
00:02:45.680 --> 00:02:56.800
Both medical and technical information were kept in one folder and accessible to unqualified personnel, consequently, leading to a nonconformance with Dutch privacy law.
00:02:56.960 --> 00:03:03.280
In addition, ASR required a significant amount of storage space to store the continuously growing folders.
00:03:03.599 --> 00:03:17.680
ASR recognized the need for a solution that would improve business processes, enable collaboration between departments, reduce costs across the organization, and permit only authorized access to information to comply with regulations.
00:03:18.000 --> 00:03:28.719
Using a combination of business process modeling and operational improvement solutions, ASR has been able to modernize existing processes while responding to legislative change.
00:03:28.960 --> 00:03:41.360
For example, medical and technical information related to disability claims are now separated and only accessible to qualified personnel, helping ASR comply with privacy legislation.
00:03:41.680 --> 00:03:48.159
As well, the entire claims management process can be measured to give management visibility into processes.
00:03:48.639 --> 00:03:56.400
The flexible environment supports a new way to benchmark so that business activities can be monitored across numerous divisions.
00:03:56.719 --> 00:04:06.000
The solution gives ASR an enterprise-wide standard claims processing system that has dramatically improved internal efficiencies and increased productivity.
00:04:06.240 --> 00:04:26.319
Employees now process 80% of the claims on time, which has led to a 25% reduction to the claims processing team, and services costs and indemnity have been significantly reduced, all of which enable ASR to deliver new products faster, comply with regulations, and provide better customer service.
00:04:26.879 --> 00:04:36.319
Now that we've seen how data governance benefits the enterprise, let's consider the four key pillars of strong data governance introduced at the beginning of this chapter.
00:04:36.560 --> 00:04:41.680
Pillar one, metadata, the context behind every decision.
00:04:42.160 --> 00:04:52.079
Metadata is the DNA of digital information, the hidden context that tells systems what something is, where it came from, and how it should be used.
00:04:52.319 --> 00:05:00.160
It links content to business purpose and transforms raw data into something searchable, governable, and meaningful.
00:05:00.800 --> 00:05:03.920
Information enters the enterprise through many doors.
00:05:04.160 --> 00:05:12.079
Some is born digital, created by people using word processors, spreadsheets, CAD software, or email clients.
00:05:12.399 --> 00:05:25.600
Some originates in business systems, generated by enterprise resource systems, ERPs, customer relationship management, CRM, or databases with defined schemas and relational structures.
00:05:25.759 --> 00:05:30.000
Other content is captured from analog sources, as scanners.
00:05:30.240 --> 00:05:38.800
Then there's machine data from sensors, logs, and telemetry, and web and social content from internets, collaboration tools, and portals.
00:05:39.040 --> 00:05:49.839
Organizations also produce multimedia, training videos, marketing assets, and recorded meetings, all of which carry operational and legal value.
00:05:50.079 --> 00:05:53.279
Managing this diversity requires a control layer.
00:05:53.519 --> 00:06:00.560
Metadata, classification, retention tags, provenance, and sensitivity serves as that control plane.
00:06:00.720 --> 00:06:07.199
It allows automated permissioning, targeted search, version control, and records enforcement.
00:06:07.439 --> 00:06:10.959
It's also the foundation for responsible enterprise AI.
00:06:11.279 --> 00:06:20.879
Without metadata, an AI model can't distinguish between a draft and a final version, or between a public brochure and a privileged client file.
00:06:21.120 --> 00:06:30.240
Metadata provides the essential context: who created something, when it was changed, where it came from, and how sensitive it is.
00:06:30.800 --> 00:06:40.879
These details give meaning to raw content and help both people and intelligent systems understand what can be trusted, what can be shared, and what should be protected.
00:06:41.040 --> 00:06:45.839
Without unified metadata, AI training is unreliable or unsafe.
00:06:46.160 --> 00:06:59.519
EIM provides the framework to map governance directly to information models, ensuring that automation and AI respect the same business, legal, and ethical boundaries that already define trusted data.
00:06:59.759 --> 00:07:06.160
Metadata isn't a static label, it's a living framework for policy enforcement and machine reasoning.
00:07:06.319 --> 00:07:13.040
As AI matures, metadata becomes the connective tissue between governed data and intelligent action.
00:07:13.519 --> 00:07:19.839
Discover how HBO relies on metadata to consolidate and manage assets throughout their life cycle.
00:07:20.079 --> 00:07:20.879
Case study.
00:07:21.360 --> 00:07:36.959
HBO HBO is America's most successful premium television network, offering rich digital media content, blockbuster movies, innovative original programming, provocative documentaries, concert events, and championship boxing.
00:07:37.279 --> 00:07:46.639
HBO sought a solution that would allow them to easily access and share digital content both within HBO and the larger Time Warner family.
00:07:46.959 --> 00:08:00.399
The requirements for the overall system functionality and user experience entailed the system handling large volumes of content, as well as addressing disparant databases, workflows, and use cases for each of the organizations.
00:08:00.800 --> 00:08:11.360
HBO's media management implementation encompassed all of HBO's digital photographs, supporting such areas as marketing, promotions, advertising, and sales.
00:08:11.759 --> 00:08:19.279
These assets can range from location shots from films to a gallery of quality professional photos of HBO celebrities.
00:08:19.439 --> 00:08:23.680
Part of their overall strategy was to ensure careful management of metadata.
00:08:24.079 --> 00:08:34.960
Assets are tagged with corresponding metadata, such as contractual information, as early as possible to ensure that metadata travels with the asset throughout its life cycle.
00:08:35.279 --> 00:08:39.919
This meta tagging process is enforced with an embedded workflow component.
00:08:40.240 --> 00:08:49.679
The HBO Digital Asset Management System is accessed by all of the regional offices and currently holds more than 325,000 assets.
00:08:50.000 --> 00:08:55.840
If governance defines the rules, permissions enforce them, one decision at a time.
00:08:56.159 --> 00:08:59.120
Pillar two permissions and access control.
00:08:59.679 --> 00:09:02.799
Who can see what, when, and why?
00:09:03.039 --> 00:09:05.679
Permissions define the boundaries of trust.
00:09:05.919 --> 00:09:11.519
They determine who can view, edit, or share information, and under what conditions.
00:09:11.840 --> 00:09:15.919
For decades, these principles have protected corporate and personal data.
00:09:16.159 --> 00:09:19.600
In the AI era, they take on new urgency.
00:09:19.919 --> 00:09:30.320
Every decision an intelligent system makes depends on access, what data it can see, what it can learn from, and what actions it's authorized to perform.
00:09:30.639 --> 00:09:35.519
In an enterprise information environment, permissions are not simple IT switches.
00:09:35.679 --> 00:09:38.080
They are the enforcement layer of governance.
00:09:38.399 --> 00:09:45.519
Version control, workflow approvals, records holds, and selective publication all depend on them.
00:09:45.759 --> 00:09:51.759
Effective permission models regulate not only what users can do, but also when and why.
00:09:52.000 --> 00:09:58.320
A document that can be edited today might be locked tomorrow under a regulated process or legal hold.
00:09:58.639 --> 00:10:07.759
This dynamic control ensures that information remains traceable and trustworthy, even as it moves through the complex life cycles and collaborative environments.
00:10:08.000 --> 00:10:12.320
Modern EIM systems achieve this precision through granular permissions.
00:10:12.559 --> 00:10:22.960
Every object, document, folder, workflow, or image carries its own security profile, defining access for each group user and group across the system.
00:10:23.200 --> 00:10:32.000
At enterprise scale, where users may number in the hundreds of thousands, these models can translate into billions of unique permission combinations.
00:10:32.320 --> 00:10:34.720
Yet this complexity is necessary.
00:10:34.960 --> 00:10:42.639
Without the ability to assign security at the most granular level, an information system cannot truly be considered secure.
00:10:42.879 --> 00:10:51.679
It's this flexibility that allows organizations to emulate the physical controls of a secure workspace, digitally and at scale.
00:10:52.159 --> 00:10:59.279
As AI becomes another user in the system, those same permission structures must extend to intelligent agents.
00:10:59.519 --> 00:11:03.200
If a document is confidential, the AI must know it too.
00:11:03.519 --> 00:11:16.879
Permissions are no longer just about control, they're about confidence, ensuring that every person and every system interacts with information purposefully, within defined boundaries, and under full accountability.
00:11:17.120 --> 00:11:27.039
This is how organizations protect privacy, preserve competitive advantage, and ensure that AI operates safely inside the zones it's authorized to learn from.
00:11:27.360 --> 00:11:38.480
The case study below, featuring a European investment bank, illustrates the effective use of permissions in classifying documents across locations to achieve operational and governance objectives.
00:11:38.799 --> 00:11:41.279
Case study A European Bank.
00:11:41.519 --> 00:11:47.440
An investment bank in Europe finances capital investments aligned with European Union policy objectives.
00:11:47.759 --> 00:11:50.960
The literal infrastructure of a more integrated Europe.
00:11:51.200 --> 00:11:59.679
With operations spanning roughly 150 countries outside the EU, secure and efficient remote access to documents isn't a convenience.
00:11:59.840 --> 00:12:01.440
It's mission critical.
00:12:01.679 --> 00:12:14.399
To achieve this, the bank implemented an EIM system as part of a broader IT modernization effort to transform every major process in the bank, borrowing, lending, and administration.
00:12:14.799 --> 00:12:28.000
The system was fully embedded into the bank's IT ecosystem so that content, data, and workflows could move seamlessly between systems, ensuring consistency and compliance across all operations.
00:12:28.399 --> 00:12:30.960
Governance lies at the heart of this system.
00:12:31.120 --> 00:12:42.000
The investment bank developed a bank-wide taxonomy that defines not only how content is categorized, but how it aligns with business processes and regulatory frameworks.
00:12:42.240 --> 00:12:55.919
Based on international best practices, including the DIRKS methodology and the ISO 15489 standards, the taxonomy is paired with a sophisticated access control model that applies at the highest level of classification.
00:12:56.159 --> 00:12:59.600
Together, these models form a living governance framework.
00:12:59.759 --> 00:13:08.720
The taxonomy maps what information exists and where it belongs, while the permissions model governs who can access it, under what conditions, and for what purpose.
00:13:08.960 --> 00:13:16.159
The result is a digital knowledge map that reflects the institution's structure, accountability, and decision rights.
00:13:16.399 --> 00:13:21.440
This disciplined information architecture now provides the foundation for AI enablement.
00:13:21.679 --> 00:13:38.159
With a consistent taxonomy and granular permissioning, they can train AI tools to retrieve, summarize, and classify documents safely, knowing that every action taken by an intelligent agent adheres to the same access and compliance rules as a human user.
00:13:38.399 --> 00:13:46.799
Governance ensures that AI doesn't just automate tasks, but operates within the same boundaries of trust that define the bank's human workflows.
00:13:47.039 --> 00:13:49.279
The results validate the approach.
00:13:49.519 --> 00:14:00.639
Two months after launch, user adoption rates were 20% higher than projected, with 100% of vital records from new lending and borrowing operations supported in the system.
00:14:00.879 --> 00:14:08.399
Within weeks, the repository contained over 600,000 documents, growing by roughly 100,000 per week.
00:14:08.720 --> 00:14:17.919
This success demonstrated that when governance, taxonomy, and access control work together, they don't slow innovation, they make it scalable.
00:14:18.159 --> 00:14:24.320
Pillar three, retention and lifecycle management, knowing when to keep and when to let go.
00:14:24.639 --> 00:14:29.120
Information governance isn't just about storage, it's about stewardship.
00:14:29.279 --> 00:14:37.200
Every piece of content has a life creation, use, revision, retention, and eventual disposal.
00:14:37.440 --> 00:14:43.200
Managing that life cycle is how organizations stay compliant, efficient, and sustainable.
00:14:43.519 --> 00:14:48.000
Regulated information or records come from every corner of the enterprise.
00:14:48.320 --> 00:14:56.879
ERP and CRM systems, email, documents, scanned paper, telemetry, medical devices, even aviation maintenance systems.
00:14:57.120 --> 00:15:07.039
The first step in governance is capture, bringing this information in through the controlled channels such as digital mailrooms, system connectors, or APIs.
00:15:07.279 --> 00:15:15.440
Each record must arrive with its metadata, timestamps, and provenance intact to ensure authenticity and legal defensibility.
00:15:15.679 --> 00:15:23.600
Governance begins not when information is stored, but at the moment it enters the system, when the trail of trust is first created.
00:15:23.840 --> 00:15:30.879
Once captured, records are distributed across layered storage environments that reflect their purpose and risk profile.
00:15:31.200 --> 00:15:33.759
Operational systems handle active records.
00:15:34.080 --> 00:15:44.879
Content management repositories enforce versioning, classification, and retention, and immutable archives preserve communications and evidence for legal or regulatory use.
00:15:45.360 --> 00:15:52.960
In analytics environments, regulated data may be tokenized or masked to protect privacy while still enabling insight.
00:15:53.200 --> 00:16:01.840
Long-term archives on tape, in object storage, or in sovereign clouds provide non-erasable retention where required by law.
00:16:02.000 --> 00:16:07.440
An EIM platform embeds retention policies directly into the systems where content lives.
00:16:07.679 --> 00:16:18.000
This ensures that the same document that supports a business decision today can be archived tomorrow or automatically deleted when its legal or operational value expires.
00:16:18.240 --> 00:16:23.200
The same principles that govern enterprise records now extend to artificial intelligence.
00:16:23.440 --> 00:16:32.720
As AI systems generate, consume, and learn from enterprise content, their inputs and outputs must be treated with the same rigor as regulated data.
00:16:32.960 --> 00:16:40.559
Each model interaction becomes its own record, subject to capture, classification, retention, and auditability.
00:16:40.879 --> 00:16:52.720
Governance ensures that AI learns from trusted sources, acts within defined boundaries, and produces outcomes that are explainable, defensible, and aligned with enterprise policy.
00:16:52.960 --> 00:16:59.919
In this way, the disciplines that built confidence in data governance become the guardrails for responsible intelligence.
00:17:00.159 --> 00:17:02.879
Pillar four, auditability.
00:17:03.120 --> 00:17:05.039
Proof that governance works.
00:17:05.279 --> 00:17:11.279
In traditional records management, auditability meant logs, version histories, and paper trails.
00:17:11.519 --> 00:17:18.400
In the AI era, it also means model transparency, understanding what information shaped an outcome.
00:17:18.559 --> 00:17:22.240
Auditability should be incorporated into the content lifecycle.
00:17:22.480 --> 00:17:29.200
Every document, transaction, and system event carries a traceable history of changes and approvals.
00:17:29.440 --> 00:17:39.039
When extended to AI, the same principle provides explainability, showing not just what a model decided, but which data contributed to that decision.
00:17:39.359 --> 00:17:43.039
This visibility is what turns governance into trust.
00:17:43.279 --> 00:17:50.640
Auditability assures regulators, executives, and the public that automation operates within defined boundaries.
00:17:51.039 --> 00:17:58.000
It transforms compliance from a reactive process into a verifiable standard for responsible intelligence.
00:17:58.240 --> 00:18:03.039
These governance capabilities are bundled in an EIM platform in the cloud.
00:18:03.200 --> 00:18:12.799
With the evolution of AI, governance has to come first because it defines the rules of engagement between people, data, and intelligent systems.
00:18:13.119 --> 00:18:14.960
Metadata provides the map.
00:18:15.279 --> 00:18:17.200
Permissions define access.
00:18:17.440 --> 00:18:22.960
Life cycle management ensures balance, and auditability proves accountability.
00:18:23.200 --> 00:18:26.079
Without these foundations, AI is guessing.
00:18:26.240 --> 00:18:30.480
With them, it becomes part of a disciplined information ecosystem.
00:18:30.880 --> 00:18:39.200
One that learns, reasons, and acts within the boundaries that make intelligence safe, lawful, and human aligned.
00:18:39.519 --> 00:18:43.920
More than 100,000 rules and regulations and growing.
00:18:44.240 --> 00:18:45.440
North America.
00:18:46.000 --> 00:18:47.119
Dodd Frank.
00:18:47.839 --> 00:18:51.839
PCI-DSS Pipada.
00:18:52.799 --> 00:20:05.200
SEC Rule 17A-4, Sarbanes Ackley, Europe and Asia, Basel III with Basel II, Capital Accord, Financial Services Authority, UK Bribery Act, BSI, PD5000, Mobile Payments Security in Europe, UAE wallet, PSD two, Financial Inclusion, SEPA slash E SEPA, SEPA for cards, NPCI, Global Facta, Basel III, Capital Norms, Basel and Intraday Liquidity Norms, Real Time Retail Payments, Anti-Money Laundering, AML, Anti-Terrorism Financing, ATF, ISO 20022 Standards and Payments, CPSS-IOSCO, a complex governance landscape.
00:20:05.519 --> 00:20:12.240
In today's global marketplace, the regulatory landscape is complex, especially for global firms.
00:20:12.559 --> 00:20:20.079
Organizations are subject to industry specific regulations and standards as well as regional or national regulations.
00:20:20.559 --> 00:20:31.519
According to these regulations, they are held accountable for their actions and must be able to access years of historical data in response to requests for information at any given time.
00:20:31.839 --> 00:20:35.839
The relationship between compliance and governance is reciprocal.
00:20:36.160 --> 00:20:39.680
Compliance serves as a driver for information governance.
00:20:39.920 --> 00:20:44.240
And information governance, in turn, can simplify compliance.
00:20:44.400 --> 00:20:55.759
In the face of growing volumes of data, there is a strong need for governance programs to help transform organizations to enable them to benefit from the better management of their information.
00:20:56.640 --> 00:21:09.920
Enterprises that implement EIM as a governance platform are realizing the opportunities it gives them to drive business transformation efficiently and successfully through optimized intelligence and AI.
00:21:10.480 --> 00:21:14.960
Compliance, sovereignty, and the shape of modern governance.
00:21:15.599 --> 00:21:20.559
Data sovereignty has moved from a compliance footnote to a design principle.
00:21:20.799 --> 00:21:27.599
It now defines where data lives, who can reach it, and under what jurisdiction those actions fall.
00:21:27.839 --> 00:21:31.359
In an AI-driven world, this matters deeply.
00:21:31.680 --> 00:21:36.880
Models trained or hosted in one region may still be governed by the laws of another.
00:21:37.200 --> 00:21:41.279
The result is that sovereignty is no longer a legal abstraction.
00:21:41.519 --> 00:21:43.839
It's an architectural constraint.
00:21:44.079 --> 00:21:51.839
Every storage choice, API, and training data set must now account for the regulatory geography it touches.
00:21:52.160 --> 00:21:55.119
Privacy laws and regional regulation.
00:21:55.759 --> 00:21:59.599
Europe set the global pace with the General Data Protection Regulation.
00:22:00.319 --> 00:22:01.519
GDPR.
00:22:02.160 --> 00:22:09.039
It transformed cross-border data flows from a technical assumption into a legal engineering challenge.
00:22:09.359 --> 00:22:23.200
GDPR codified principles of lawfulness, purpose limitation, minimization, and accountability, mandating clear consent, impact assessments, and data subject rights.
00:22:23.440 --> 00:22:37.440
Its enforcement has reshaped how enterprises design systems, data inventories, metadata driven workflows, and automated deletion policies are now baseline governance features, not optional controls.
00:22:37.680 --> 00:22:42.000
The EU Data Act extends those ideas to cloud mobility.
00:22:42.240 --> 00:22:48.240
Providers must now support interoperability and enable customers to exit cloud environments freely.
00:22:48.559 --> 00:22:52.240
No lock-ins, no excessive transfer fees.
00:22:52.559 --> 00:23:02.079
For architects, that means building with portability in mind, open standards, reversible formats, and cloud independence by design.
00:23:02.319 --> 00:23:06.480
Sovereignty in Europe is being legislated into existence.
00:23:06.720 --> 00:23:12.799
Across the Atlantic, the United States is assembling a de facto federal standard one state at a time.
00:23:13.039 --> 00:23:22.240
Over twenty states now enforce their own comprehensive privacy laws, each defining consent, sensitive data, and user rights differently.
00:23:22.559 --> 00:23:34.960
This patchwork demands policy as code, automated rules that adapt to jurisdictional nuance and ensure the right law applies to the right record, user, or transaction.
00:23:35.680 --> 00:23:39.359
The Cloud Act further complicates matters by granting U.S.
00:23:39.440 --> 00:23:41.839
authorities access to data held by U.S.
00:23:42.000 --> 00:23:51.839
based providers, even when stored abroad, forcing global enterprises to think carefully about contractual control and storage sovereignty.
00:23:52.079 --> 00:23:54.079
Canada's Layered Model.
00:23:54.400 --> 00:23:57.759
Canada approaches sovereignty through layered accountability.
00:23:58.000 --> 00:24:14.720
Federally, PIPADA or the Personal Information Protection and Electronic Documents Act, sets the baseline for responsible handling of personal information, permitting cross-border transfers but maintaining that organizations remain accountable for protections end to end.
00:24:15.039 --> 00:24:36.319
Its forthcoming replacement, the Digital Charter Implementation Act, Bill C27, introduces the Consumer Privacy Protection Act, CPPA, a data protection tribunal and the Artificial Intelligence and Data Act designed to govern responsible AI development and deployment.
00:24:36.559 --> 00:24:40.160
At the provincial level, compliance becomes more granular.
00:24:40.400 --> 00:24:58.960
BC's FOIPA, or Freedom of Information and Protection of Privacy Act, reforms have relaxed residency restrictions for public data, while Ontario's health privacy law, the Personal Health Information Protection Act, FIPA, continues to enforce strict standards for health information.
00:24:59.440 --> 00:25:12.480
Financial regulators such as OSVI or Office of the Superintendent of Financial Institutions through Guidelines B-10 have elevated data location and cloud oversight to board level responsibilities.
00:25:12.720 --> 00:25:14.400
The message is consistent.
00:25:14.640 --> 00:25:22.799
Sovereignty in Canada is both practical and provincial, demanding careful mapping of where data resides and who can access it.
00:25:23.119 --> 00:25:26.559
Global compliance and industry specific rules.
00:25:26.880 --> 00:25:31.359
Beyond North America and Europe, data sovereignty pressures are global.
00:25:31.599 --> 00:25:41.279
China's personal information protection law requires explicit security assessments for cross-border transfers of important data.
00:25:41.680 --> 00:25:54.000
India's Digital Personal Data Protection Act adds localization style provisions and new transfer conditions that could influence where and how AI workloads operate.
00:25:54.319 --> 00:26:01.440
Each regulation tightens expectations for lawful transfer, explicit consent, and retention discipline.
00:26:01.599 --> 00:26:04.480
Industry regulations amplify these demands.
00:26:04.720 --> 00:26:05.279
The U.S.
00:26:05.359 --> 00:26:17.200
HIPAA, or Health Insurance Portability and Accountability Act, is framework governs electronic health records with strict access, control, encryption, and breach notification.
00:26:17.839 --> 00:26:30.319
The FDA's Food and Drug Administration's 21 CFR Part 11 sets standards for trustworthy electronic records and signatures in regulated manufacturing and clinical environments.
00:26:30.640 --> 00:26:46.319
The FTC, or Federal Trade Commission, enforces reasonable care over consumer data security, while the FAA, or Federal Aviation Administration, defines authenticity and traceability requirements for digital maintenance records in aviation.
00:26:46.559 --> 00:26:49.200
Together they reinforce a common truth.
00:26:49.440 --> 00:26:55.359
Regulated data must be captured, retained, and auditable throughout its life cycle.
00:26:55.599 --> 00:26:57.599
Sovereignty and AI.
00:26:58.559 --> 00:27:04.160
For artificial intelligence, these laws translate into operational limits and design choices.
00:27:04.480 --> 00:27:08.319
Enterprise AI cannot learn from what it cannot lawfully see.
00:27:08.559 --> 00:27:17.279
Sovereign clouds, built to localize storage, processing, and access, are becoming the architectural answer to regulatory fragmentation.
00:27:17.519 --> 00:27:27.200
They allow organizations to deploy AI where the data lives, respecting jurisdictional boundaries while maintaining the control needed for compliance and trust.
00:27:27.440 --> 00:27:39.599
As EAI models grow more agentic, sovereignty will define their perimeter, what they're allowed to read, what they can retain, and how their actions are logged and explained.
00:27:39.839 --> 00:27:42.559
Compliance is no longer about static records.
00:27:42.720 --> 00:27:48.319
It's about dynamic systems that think, learn, and act under legal supervision.
00:27:48.559 --> 00:27:55.759
An enterprise information management platform with embedded governance is now the operating system for intelligence itself.
00:27:56.079 --> 00:27:59.200
Governance as the operating system of trust.
00:27:59.839 --> 00:28:07.200
In a world where information moves across borders, clouds, and algorithms, governance defines the rules of engagement.
00:28:07.359 --> 00:28:15.200
It ensures that data remains accurate, traceable, and defensible, no matter where it travels or how it's used.
00:28:15.440 --> 00:28:18.640
Effective governance requires more than documentation.
00:28:18.880 --> 00:28:27.759
It demands executive sponsorship, streamlined processes, automated policy enforcement, and identity-centric security.
00:28:28.000 --> 00:28:37.920
It requires that every action on data, from capture to disposal, be visible, auditable, and aligned with legal and ethical standards.
00:28:38.160 --> 00:28:44.240
Modern information management frameworks now embed these controls directly into daily operations.
00:28:44.559 --> 00:28:53.680
Metadata, permissions, and retention aren't afterthoughts, they're embedded logic that keeps systems honest and AI accountable.
00:28:53.920 --> 00:29:05.839
By treating information as a managed asset, one with provenance, purpose, and lifecycle, organizations transform governance from a cost of doing business into a source of competitive advantage.
00:29:06.079 --> 00:29:10.880
Ultimately, governance is what allows enterprises to trust their intelligence.
00:29:11.039 --> 00:29:16.400
It connects the ethics of how we manage information with the mechanics of how AI learns it.
00:29:16.640 --> 00:29:21.759
When done right, governance doesn't slow innovation, it makes it sustainable.
00:29:22.000 --> 00:29:26.160
We discuss the governance of AI in more detail in the following chapter.
00:29:26.480 --> 00:29:32.400
The FAST Five Download one, make governance an enterprise mandate.
00:29:32.640 --> 00:29:39.759
Establish a cross-functional governance council that includes business, IT, legal, and compliance leaders.
00:29:40.000 --> 00:29:43.680
Give it authority to set enterprise-wide data policies.
00:29:44.000 --> 00:29:47.920
Approve AI use cases, and monitor adherence.
00:29:48.240 --> 00:29:52.799
Governance isn't an IT project, it's a management discipline.
00:29:53.119 --> 00:29:57.200
Two, operationalize permissions and access control.
00:29:57.680 --> 00:30:02.559
Move from static role-based permissions to dynamic policy driven access.
00:30:02.880 --> 00:30:08.720
Map who can see or use specific information and extend those same controls to AI systems.
00:30:08.960 --> 00:30:17.279
Treat every AI interaction as a governed event with audit trails, expiry dates, and explicit accountability.
00:30:17.599 --> 00:30:21.519
Three, map and classify critical data assets.
00:30:22.160 --> 00:30:28.400
Conduct enterprise data inventories to locate high value, regulated, and sensitive information.
00:30:28.960 --> 00:30:41.519
Use EIM tools to tag content with metadata, ownership, sensitivity, and retention so it can be used safely for AI training, automation, and analytics.
00:30:42.079 --> 00:30:46.880
Four, embed compliance and sovereignty into architecture.
00:30:47.200 --> 00:30:50.400
Design for jurisdictional complexity from the start.
00:30:50.720 --> 00:30:55.519
Choose sovereign or regional cloud configurations where data residency matters.
00:30:55.839 --> 00:31:05.119
Automate compliance through metadata and policy as code, so rules about where data can live or move are enforced by design, not by audit.
00:31:05.440 --> 00:31:06.000
5.
00:31:06.400 --> 00:31:09.039
Govern AI like you govern data.
00:31:09.359 --> 00:31:18.880
Treat models as managed assets with the same expectations as data, documented provenance, life cycle control, and retraining governance.
00:31:19.279 --> 00:31:27.839
Require that every AI initiative demonstrate lawful data use, explainable decisions, and measurable ROI before it scales.
