AI Governance Is Not Data Governance — And Your Degree Alone Won’t Qualify You to Lead It
Beyond Data: Why AI Governance Requires Multidisciplinary Leadership and Clear Accountability
There is a conversation I keep seeing companies get wrong.
They hear AI governance and immediately start talking about data governance.
Who has access to the data? Where is it stored? Is the information secure? Are permissions correct? Are we following privacy requirements?
Those are important questions.
They are also not AI governance.
Data governance is concerned with the management, quality, security, ownership, accessibility, and appropriate use of data. AI governance has to go much further because we are no longer only talking about information sitting inside a system.
We are talking about systems that can analyze that information, generate content from it, recommend actions, influence decisions, automate processes, communicate with customers and employees, and increasingly operate with some level of autonomy.
That changes the conversation completely.
An organization can have beautifully governed data and still deploy AI irresponsibly.
Your database can be secure while your AI hiring system creates unfair outcomes.
Your customer information can be properly permissioned while an employee puts confidential information into the wrong generative AI platform.
Your cybersecurity team can lock down the network while nobody has established who is accountable when an AI-generated recommendation causes financial, legal, operational, or reputational damage.
That is the gap.
And this is also where companies have to stop assuming AI governance automatically belongs to whoever has traditionally handled IT, data, compliance, or cybersecurity.
Those professionals absolutely belong at the table.
But AI governance is a multidisciplinary responsibility.
You need someone who understands the technology, but that person also needs to understand the business.
They need to know what the AI is being asked to do, who will be affected by its decisions, what information it touches, where human oversight is required, what could go wrong, what regulations apply, how vendors are using your information, and whether the business can explain and defend the system if somebody starts asking difficult questions.
That is much bigger than IT.
It is also why I believe we are entering an era where the degree alone goes out the window.
And I don't mean education has no value.
I mean the letters behind someone's name cannot be the deciding factor in determining whether that person understands AI well enough to govern it.
Artificial intelligence is evolving too quickly for that.
Someone can have an advanced degree earned before generative AI entered mainstream business operations and still have very little practical experience implementing, testing, auditing, or governing modern AI systems.
Meanwhile, another professional may have spent years actively building AI workflows, studying model behavior, evaluating platforms, developing policies, testing automation, working with businesses, identifying failure points, and keeping up with a technology that changes almost weekly.
Who understands the actual risk better?
That is the question companies should be asking.
AI is one of those fields where continuous learning and practical competency matter tremendously.
The person responsible for AI governance cannot be someone who took one certification course, read a few articles, learned the new terminology, and suddenly became the company's AI expert.
They need to understand what happens when AI leaves the PowerPoint presentation and enters the real business.
Because that's where things get messy.
Employees will use tools leadership never approved.
Departments will purchase AI software without realizing what happens to the information they upload.
Vendors will put the words “powered by AI” on products without clearly explaining what models are operating behind them.
Teams will automate decisions that should still include human judgment.
Executives will get excited about efficiency before anyone has asked what happens when the system is confidently wrong.
And somebody has to be knowledgeable enough to say, “Before we deploy this, here are the questions we haven't answered yet.”
That person does not work alone.
Strong AI governance should bring together leadership, operations, technology, cybersecurity, privacy, legal and compliance professionals, data teams, human resources where appropriate, and the people who actually understand how the technology is being used.
But somebody still has to connect those dots.
That is the person I would trust.
Not simply the individual with the most technical degree.
Not automatically the CIO.
Not automatically the attorney.
Not automatically the data scientist.
And definitely not the person who just became fascinated with ChatGPT three months ago.
I would look for the person who can comfortably move between the technical conversation and the boardroom conversation.
Someone who understands AI well enough to challenge the developers, understands business well enough to challenge leadership, understands risk well enough to involve legal and compliance when necessary, and understands operations well enough to know whether the policy being written can actually work in the real world.
Most importantly, I want the person who is comfortable saying “I don't know yet” and knows how to find the right answer.
AI governance isn't about pretending one person knows everything.
Nobody does.
It is about establishing accountability around technology that is developing faster than most organizations can write policies for it.
So when a company tells me it already has data governance and therefore has AI governance covered, my next question is simple:
Who is governing what the AI actually does?
Who decides which systems are acceptable?
Who evaluates the risk before deployment?
Who determines where humans stay involved?
Who monitors what changes after deployment?
Who reviews third-party AI vendors?
Who handles an AI incident?
Who explains the system when the board asks questions?
And who has the authority to shut something down when the risk outweighs the reward?
If nobody can answer those questions clearly, you don't have AI governance yet.
You have technology.
And technology without clear accountability is exactly where governance becomes necessary.
Jamilah N. Lawry
AI Governance and Business Strategy Advisor
