Data, model and AI governance: one discipline, three inventories

The same four questions

Whether the asset is a dataset, a model or an agent, governance asks the same things.

• What is it, and who owns it?
• What is it allowed to use, and who is allowed to use it?
• Who approved it, on what evidence?
• What has it done since?

Why three inventories appear

Organizations usually answer those questions in three separate systems: a data catalogue, a model registry and, increasingly, a register of AI use cases. Each is maintained by a different team and updated after the fact.

The result is three partial pictures. A model's risk depends on the data it was trained on; an agent's risk depends on the models and tools it can call. Those relationships fall in the gaps between inventories.

Governance that is enforced, not described

A policy in a document relies on people remembering it. A policy that the platform enforces does not. The difference is whether governance shares identity, permissions and audit with the tools doing the work.

When it does, classification can follow data through a pipeline into a dashboard and a prompt, and an approval can be a condition of deployment rather than a meeting.

A sensible first step

Start with the inventory. You cannot govern what you have not listed. Record every model and AI agent in use, give each a named owner, and note what data it touches. Most organizations find more than they expected.