Data Management Frameworks

The pain AI data management is causing our customers

Companies want AI results but cannot answer basic questions about their data: where it lives, who owns it, what quality it has, how it moves, who can access it. AI amplifies these problems: biased data produces biased AI, incomplete data produces hallucinations, uncontrolled data produces privacy incidents. The pain is that AI programs launched without underlying data management fail predictably.

What AI data management frameworks cover

Three frameworks, each addressed in detail on its own page.

Why AI data management matters to you

Data quality is the ceiling for AI quality. Data governance is the ceiling for AI governance. Every mature AI program has a data management foundation. Every failed AI program lacked one.

What the research says about data management

The academic literature on data management is ahead of most corporate practice, and it is unusually blunt. Two findings are worth putting in front of any executive who thinks this is a compliance formality.

“the performance of a machine learning model is upper bounded by the quality of the data”

Jain, Patel, Nagalapatti et al., ACM SIGKDD (2020)

That is the gap between having AI and governing it. The second finding is the one that tends to change the room.

“failure to do so can result in inaccurate analytics and unreliable decisions”

Gupta, Patel, Khan et al., ACM SIGKDD (2021)

Neither of these is a fringe position. Both come from peer-reviewed work, and both describe the condition most organisations are actually in when the question about data management arrives from the board, the buyer, or the regulator.

How to get compliant with Data Management Frameworks: a 5-step path

This is the sequence that works, and it is not the sequence most organisations choose. They start with the framework and work backwards toward reality. Start with reality.

1. Inventory the AI in scope. List every AI system that could fall under data management. Record what it does, what decision it influences, what data it touches, and who owns it. You cannot govern AI you cannot name, and almost every organisation we assess is running more AI than its leadership believes.
2. Determine whether you are actually in scope. Work out precisely which of your AI systems and activities data management reaches, and write the determination down with its reasoning. Do this in writing. A documented scope determination, right or wrong, is defensible. An undocumented assumption is not.
3. Assign one accountable owner. Name a person, not a committee, with the authority to stop a deployment. Governance without someone who can say no is documentation, not control.
4. Build the evidence file. Assemble the documentation data management expects: the scope, the risk assessment, the controls, the testing evidence, and the incident record. Assemble it before anyone asks. Reconstructing it under a regulator's deadline costs several times more and looks exactly like what it is.
5. Set a review cadence and hold it. Re-run the assessment on a schedule and after any material change to the model, the data, or the use case. Alignment decays. A control tested once is a snapshot, not a control.

Done in this order, data management becomes tractable. Done out of order, it becomes a document nobody uses and a control nobody exercises.

Frequently asked questions about AI data management

Which framework should we start with?

DAMA-DMBOK is the reference body of knowledge. DCAM is a capability model good for financial services. CDMC is cloud-specific. Most mature programs use DAMA-DMBOK as vocabulary and DCAM or CDMC for maturity assessment.

Where does AI data management fit in SRJ's work?

The AI Governance Framework Crosswalk™ in Appendix L of Volume III of The Operating Discipline for AI Library™ maps data management frameworks to AI governance artifacts.

What each area of data management covers

The detail pages below each take one component of data management and answer the same four questions: what it actually is, what it requires of you, why it matters commercially and legally, and what a defensible position looks like. Read the one that maps to your exposure first. The others become relevant as your AI footprint widens.

• DAMA-DMBOK. The reference body of knowledge for data management. Eleven knowledge areas covering the discipline AI governance sits on.
• EDM Council DCAM. The EDM Council's capability model for measuring data management maturity, widely used in financial services.
• CDMC Cloud Data Management. The EDM Council's cloud data management framework. Fourteen key controls for cloud data security and governance.

How to prioritise your work on data management

Executives ask, reasonably, where to start. The sequence that works is the same one every time, and it is not the sequence most organisations choose. Start with an inventory: you cannot govern AI you cannot list, and almost every organisation we assess is using more AI than its leadership believes. Then rank by consequence, not by volume, because the tool that makes one high-stakes decision a week carries more exposure than the one that drafts a thousand emails.

Only then assign an owner. Not a committee, an owner, named, with the authority to stop a deployment. Governance without a person who can say no is documentation, not control. With those three steps done, the specific requirements of data management become tractable, because you now know what you have, what matters, and who answers for it.

The organisations that struggle are the ones that begin with the framework and work backwards toward reality. The frameworks are the map. The inventory is the territory. Start with the territory.

Primary sources on data management

The authoritative texts and agency pages behind this summary. We keep this page current, but where a compliance decision turns on exact wording, read the source. Anything concerning data management that carries legal consequence should be confirmed against the enrolled text or the issuing body, not against a secondary summary, including this one.

• EDM Council