From Data Assets to Responsible AI Outcomes: The Data Pillar of STEWARD-AI

Artificial intelligence depends on data to learn, generate outputs and support decisions. The quality and governance of that data shape what an AI system can do and whose interests may be affected. Large volumes of information do not guarantee reliable outcomes. Data may be incomplete, outdated, unrepresentative, obtained without adequate rights or processed in jurisdictions that create legal and operational constraints.

For Boards, the central issue is whether the organisation can use data for AI with confidence and responsibility. Directors need assurance that material data is fit for purpose, that privacy and other rights are protected, and that management understands where critical data originated, how it changed and who controls it. These questions concern enterprise governance, not database administration alone.

This is the focus of the Data pillar within STEWARD-AI™, a Boardroom Framework for Responsible AI Leadership. The pillar helps Boards examine whether the information supporting AI is governed throughout its lifecycle, from collection and acquisition to preparation, use, sharing, retention and deletion. It comprises four connected dimensions: Data Quality, Privacy, Provenance, and Data Sovereignty.

Why Data Governance Requires Board Attention

AI draws information from many parts of the organisation and from external providers. The same dataset may be collected by one function, transformed by another, stored in a cloud service and used by several models. Responsibility can become fragmented, especially when teams acquire AI tools that contain embedded data or connect to information outside established governance processes.

Boards should expect management to identify the datasets that matter most to significant AI uses and assign clear ownership. Oversight should be proportionate to the potential effect of the decision. Data supporting a low-impact internal tool does not require the same assurance as data used for credit, employment, healthcare, safety or access to essential services.

1. Data Quality

Data quality means more than correcting obvious errors. Information should be accurate enough for its intended use, sufficiently complete, current and relevant. It should also represent the populations and conditions to which the AI system will be applied. A dataset can be technically clean yet still create poor outcomes if important groups, events or changing business conditions are missing.

Management should define quality requirements before a material system is approved and continue to monitor them after deployment. Changes in customer behaviour, markets or operating conditions can make previously suitable data less reliable. Boards need reporting that explains significant limitations, unresolved gaps and the controls used to detect deterioration, rather than a general assurance that the organisation has large quantities of data.

Key Board question: Is the data used by material AI systems accurate, representative and fit for its intended purpose?

2. Privacy

AI can increase the scale at which personal and sensitive information is collected, combined and inferred. Data supplied for one purpose may reveal new characteristics when analysed with other sources. Privacy governance must therefore consider the entire AI lifecycle, including training, testing, user prompts, generated outputs, monitoring records and information retained by service providers.

Management should establish a lawful and clearly explained basis for using personal data, apply data minimisation and control access, retention and deletion. Consent should be meaningful where it is relied upon, and individuals should have practical ways to exercise applicable rights. The organisation should also test whether de-identification remains effective when datasets are combined or when an AI system can infer identity or sensitive attributes.

Key Board question: Are privacy, consent and data rights protected throughout the AI lifecycle?

3. Provenance

Data provenance is the ability to understand where information came from, how it was obtained and what happened to it before use. This includes transformations, labelling, corrections, version changes and the addition of synthetic or externally sourced data. Provenance allows management to trace an unexpected outcome back to the relevant source and determine whether the underlying information remains suitable.

Third-party and publicly available data deserve particular attention. Availability does not necessarily establish a right to use information for every purpose. Management should know the applicable licences, contractual limits and usage conditions, and preserve enough evidence to support challenge, audit or regulatory review. Without traceability, the organisation may struggle to explain an outcome or correct a recurring problem.

Key Board question: Can management trace critical AI data to its source, rights, transformations and responsible owner?

4. Data Sovereignty

Data sovereignty concerns the laws, jurisdictions and control arrangements that apply to information. Cloud platforms and global AI services may store, process or permit access to data in several locations. The organisation must understand these arrangements, particularly where rules restrict cross-border transfers or require certain information to remain within a country or regulated environment.

Sovereignty also concerns practical control. Boards should ask whether the organisation can retrieve, move or delete critical data, maintain access during disruption and exit a provider without unacceptable loss or delay. Concentration risk increases when important AI systems depend on the same platform or data source. Contracts, technical architecture and continuity arrangements should support the organisation's obligations rather than limit its ability to act.

Key Board question: Does the organisation know where critical AI data is located and retain effective control over it?

Turning Data into Boardroom Oversight

The Data pillar supports every other part of STEWARD-AI. Strategy depends on information that can support value creation. Trust and Ethics depend on responsible collection and use. Accountability requires clear ownership and traceability. Risk and Innovation depend on reliable inputs and appropriate controls. The Data pillar concentrates these issues into a practical view of quality, rights, origin and control.

The Data pillar encourages Boards to keep three questions at the centre of their oversight:

• Is AI data accurate, representative and fit for purpose?

• Are privacy, consent and data rights protected?

• Do we know the origin, location and control of critical AI data?

These questions help Directors move beyond broad claims that data is an asset. Useful reporting should identify the information supporting material AI systems, accountable owners, significant quality limitations, privacy concerns, provenance gaps, cross-border dependencies and remediation. It should also explain how management decides that data remains appropriate as systems and conditions change.

Boards do not need to inspect datasets or manage technical standards. They do need evidence that important data is reliable, lawfully and responsibly used, traceable and under effective organisational control. When those conditions are met, data can support AI decisions that are more dependable, explainable and aligned with stakeholder expectations.

---

About the author: Dr. Rajiv Yadav is an international Board Strategy & Governance Advisor with more than 35 years of boardroom and executive leadership experience across Asia, Europe, the Americas and Australia in banking, financial services, infrastructure, insurance and technology. He is the creator of STEWARD-AI™.