Organizations are moving quickly to apply generative AI across customer service, operations, knowledge management, software development, and decision support. However, before data is made available to an AI solution, organizations need to answer three basic questions:
- Is the data fit for the intended purpose?
- Can the data be traced to a reliable source?
- Is the organization authorized to use it in this way?
When these questions are not addressed systematically, AI adoption creates a significant data-governance control gap. Recent developments involving enterprise privacy concerns, the limited auditability of generative AI, and continuing copyright litigation show why this gap deserves attention from business, technology, risk, and legal leaders.
Enterprise AI restrictions reflect a broader trust problem
A September 14, 2026, report from Tom’s Hardware described how several large organizations are restricting the use of advanced AI models because of concerns about proprietary information and customer intellectual property.
According to the report, some companies are limiting which models employees may use and which tasks those models may perform. Northrop Grumman reportedly operates open-source models on air-gapped infrastructure, while Novo Nordisk continues using Claude for some purposes but prohibits the submission of proprietary data. Nvidia reportedly reserves sensitive work for an internal AI solution rather than using an external model without the data-retention assurances it considers necessary. (tomshardware.com)
These measures may appear to be primarily about model providers and privacy terms, but they also reveal an internal governance challenge. Organizations cannot enforce meaningful AI data restrictions unless they know:
- Which data is sensitive, confidential, licensed, or contractually restricted
- Who owns the data and can authorize its use
- Where the data originated and how it has been transformed
- Which AI systems can access it
- Whether prompts, outputs, logs, or metadata are retained
- What business purpose the AI use serves
A policy telling employees not to enter sensitive information into an AI tool is not enough if “sensitive information” has not been consistently classified or if users cannot determine which data is covered.
AI creates an evidence problem as well as a data problem
Data governance becomes even more important because generative AI systems do not always produce the evidence that traditional governance frameworks expect.
A September 6, 2026, article from California Management Review describes an “evidence paradox”: organizations are becoming more comfortable deploying systems whose outputs they cannot fully trace, even though established governance and accountability processes rely on reproducible evidence about how decisions were made.
The authors distinguish between systems whose outputs can be observed and systems whose outputs can be fully verified through their internal decision paths. Large language models can be tested, monitored, and constrained, but their learned representations and probabilistic generation processes cannot generally provide a complete explanation of how a particular output was produced. (cmr.berkeley.edu)
This limitation does not make governance impossible. It changes where governance must concentrate.
If organizations cannot completely inspect a model’s internal reasoning, they need stronger evidence around the environment in which the model operates. That includes evidence about:
- The data the system was permitted to access
- The sources used to support a response
- The controls applied before data entered the system
- The versions of datasets, models, prompts, and policies in use
- The human reviews required for higher-risk decisions
- The tests and monitoring applied to outputs
- The actions taken when results exceeded defined risk thresholds
In other words, model opacity increases the importance of governing inputs, access, usage boundaries, and operational controls.
A narrow legal ruling does not remove the need for provenance
Copyright risk adds another dimension to the same governance issue.
On September 17, 2026, Bloomberg Law reported that Microsoft and OpenAI had secured a narrow victory in the first federal appellate decision concerning AI copyright. The Ninth Circuit ruling closed off one potential claim involving the alleged removal of copyright-management information attached to creative works. However, the report emphasized that the decision did not resolve the larger intellectual-property questions affecting the AI industry.
For enterprises adopting AI, the practical lesson is not that copyright concerns have disappeared. It is that data provenance and permitted use remain necessary even while the legal landscape continues to develop.
An organization may possess a document, image, dataset, or code repository without necessarily having the right to use it for every AI-related purpose. Authorization to store information does not automatically establish authorization to use it for model training, retrieval-augmented generation, automated content creation, or external model processing.
Reliable provenance helps an organization identify the source, creator, owner, license, contractual conditions, and transformations associated with data. Permitted-use controls then connect that information to a specific AI purpose.
Without those capabilities, organizations may struggle to determine whether an AI solution is using data in accordance with privacy obligations, intellectual-property rights, vendor agreements, customer commitments, and internal policies.
The control gap begins before deployment
Many AI governance programs focus on model selection, output testing, security reviews, and responsible-use principles. Those controls are important, but they may begin too late.
The control process should start when enterprise data is proposed for an AI use case. At that point, the organization should determine whether the data is:
- Relevant: Does it support the intended business question?
- Reliable: Is its quality sufficient for the consequences of the use case?
- Representative: Could omissions or imbalances create misleading outcomes?
- Traceable: Can the organization identify its source and transformations?
- Owned: Is an accountable person or function responsible for it?
- Classified: Are sensitivity and handling requirements documented?
- Authorized: Do legal, contractual, privacy, and policy conditions permit the proposed use?
- Current: Is the information sufficiently timely and subject to an appropriate lifecycle?
- Monitored: Will quality, access, and usage continue to be reviewed after deployment?
This assessment should not be treated as a one-time questionnaire. Data changes, permissions expire, source systems are replaced, models are updated, and AI solutions begin supporting purposes beyond their original scope.
Building an AI data-readiness process
A practical response is to establish an AI data-readiness process within the broader data- and AI-governance framework.
Several capabilities provide the foundation:
1. Establish clear ownership
Data owners should be accountable for approving access and intended use within defined domains. Technology teams should not have to infer whether a dataset is appropriate simply because it is technically available.
2. Standardize definitions and quality criteria
A business glossary can reduce ambiguity by establishing common definitions, owners, classifications, and quality expectations. Fitness-for-purpose should be evaluated against the needs and risks of the specific AI use case.
3. Document lineage and provenance
Lineage should show where data originated, which systems handled it, and how it was transformed. Provenance records should also capture applicable licenses, consents, contracts, and restrictions.
4. Create permitted-use checkpoints
Approval workflows should connect data classification and provenance to the proposed AI activity. Higher-risk uses may require review from privacy, legal, security, compliance, or risk functions.
5. Monitor continuously
Organizations should monitor data quality, access, exchanges, policy exceptions, and changes in usage. Governance evidence should be retained so that decisions can be reviewed after deployment.
Governance should enable informed use
The goal is not to prevent AI systems from using enterprise data. It is to make that use deliberate, supportable, and aligned with organizational obligations.
At SCG, we see data readiness as a core part of AI governance rather than a separate technical workstream. Formal ownership, common definitions, documented lineage, quality monitoring, lifecycle controls, and enforceable usage policies help organizations manage risk while avoiding costly remediation later.
Organizations must be able to demonstrate why the data is suitable, where it came from, who approved its use, and under what conditions it may continue to be used.
