Both may be right, that is the issue.
Enterprises are scaling AI in an environment where data, models, applications, agents, and workflows are becoming tightly connected. Yet many organizations still govern data and AI through separate operating models. Data governance is often centered on the asset. AI governance is often centered on the model, application, or use case. Risk builds in the handoff between the two.
This handoff now matters more because AI platforms are no longer merely development environments. Everest Group research shows that AI platforms are moving beyond enablement to become execution and control layers for enterprise AI.
Reach out to discuss this topic in depth.
The divergence problem
The gap between data governance and AI governance is structural. In many enterprises, data governance controls the quality, ownership, classification, lineage, and access rules for enterprise data. AI governance oversees use-case approvals, model documentation, evaluations, monitoring, risk reviews, and compliance evidence. Both are necessary, but neither fully owns what happens when governed data becomes model input, retrieval context, prompt context, agent memory, or workflow action.
The failures are predictable:
- A data team changes a definition or retires a source. The AI team sees the impact after model performance shifts
- A model team adds a retrieval source, prompt dependency, or agent tool. The data team does not see the downstream usage
- A compliance team asks for evidence. The data trail explains the asset, but not how the model or agent used it. The AI trail explains the system, but not the upstream data conditions
This gap is where audit, operational, and reputational risks accumulate.
Agentic AI raises the stakes
Earlier AI deployments usually produced prediction, recommendation, classification, or content output. In many cases, a human reviewed the result before action was taken.
Agentic AI changes the risk profile.
Agents interpret objectives, break work into tasks, call tools, use enterprise systems, and execute workflows. In controlled environments, this can improve speed and consistency. In weakly governed environments, it can also amplify small data, access, or policy failures into downstream actions.
The issue is not that every agent is acting autonomously across high-risk processes today. Most enterprise deployments remain controlled, scoped, and subject to human review. The issue is that the direction of travel is clear. As agents gain more responsibility, governance gaps that were tolerable in analytics or advisory use cases become much harder to manage.
Everest Group’s research on agentic AI adoption shows that enterprise interest is strong, but scaling remains uneven. Only one in five agentic AI pilots moved into production, while ownership, funding, and operating models are still maturing. This stage is exactly where governance design matters. Enterprises that wait until agents are embedded in core workflows will find it harder to retrofit accountability.
The governance gap now has a cost dimension
Cost is becoming a governance problem. Uber reportedly exhausted its 2026 AI coding budget in four months, forcing usage caps. As AI scales, costs increasingly hide in inference, retrieval, data movement, Application Programming Interface (API) calls, and agent workflow execution. Without connected governance, enterprises cannot see which data, model, agent, workflow, or business unit drives consumption. Poor data increases retries and rework, and weak controls trigger needless tool calls. At scale, unmanaged AI consumption becomes another form of governance risk.
Regulation is moving in the same direction
Regulators and standards bodies increasingly treat data quality, lineage, transparency, monitoring, and accountability as connected obligations. Separate data and AI governance workstreams may look organized internally, but externally, they can create two partial audit trails.
One trail explains the data asset, its owner, classification, quality rules, and access policy. The other explains the AI system, its intended use, evaluation results, monitoring, and approvals. The difficult question sits between them: How did this specific AI system use this specific data under these specific controls?
That question will become more common.
The European Union (EU) AI Act is the clearest signal of this shift. For high-risk AI systems, it places data governance, transparency, human oversight, and post-market monitoring at the center of compliance obligations. Other frameworks, including International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 42001 and the National Institute of Standards and Technology (NIST) AI Risk Management Framework, point in the same direction: AI governance is becoming a lifecycle discipline that requires connected controls, evidence, and accountability across data, models, systems, and outcomes.
What convergence looks like
In a siloed model, data and AI teams manage separate glossaries, quality rules, access policies, documentation, evaluations, monitoring, and approvals.
In a converged model, governance is anchored by a shared control layer across data, models, applications, agents, and workflows, as shown in Exhibit 1.
Exhibit 1: Converged governance model with a shared control layer for data and AI
Data contracts are linked to model cards and system cards, while upstream data changes trigger impact reviews for dependent models and agents. Audit evidence connects lineage, quality, access rights, model behavior, agent actions, and monitoring outcomes, creating the foundation for consistent decisions, end-to-end visibility, and trusted AI and data at scale.
The unified governance blueprint
Convergence requires three structural changes:
- Shared policy framework across data assets and AI systems
- Data contracts linked to model and system cards
- Joint accountability across data, AI, risk, security, legal, compliance, and business leaders
Data contracts and model/system cards should capture the critical expectations around quality, access, usage, purpose, limitations, monitoring, and controls. Linking them makes dependencies visible, versioned, and auditable.
The Chief Data Officer (CDO) and Chief Artificial Intelligence Officer (CAIO) should jointly own the boundary between data and AI. That boundary includes data suitability for AI use, downstream dependency tracking, policy inheritance, and evidence continuity.
Where enterprises should start
Enterprises should start with the highest-risk handoffs instead of redesigning the entire governance model at once.
A practical starting point is to identify AI systems and agents that depend on sensitive data, customer data, regulated data, high-impact decisions, or workflow execution. For each system, leaders should be able to answer five questions:
- What data does the system use?
- What policies apply to that data?
- How does the model or agent use the data?
- What actions can the system take?
- What evidence is retained, and who is accountable?
If those questions cannot be answered from one connected evidence chain, the governance model might not be ready for scale.
Final thoughts: the boundary is the strategy
Bridging data and AI governance requires re-architecting enterprise accountability for systems that increasingly act on the organization’s behalf.
Near-term winners will not be enterprises racing fastest toward autonomy, but those giving AI systems and agents governed access to enterprise data. Autonomy will scale only where accountability is built in from the start.
If you found this blog interesting, check out,Unlocking value through R&D process transformation in the age of AI – Everest Group Research Portal, which delves deeper into another topic relating to AI.
If you’d like to continue this discussion, please contact Abhishek Sengupta ([email protected]) and Krishna Chivukula ([email protected]).