Data Governance Guidelines for AI

How to use this document

• What it is for. This is a base standard that sets the criteria data must meet when used to train, fine-tune, test or operate AI systems, including internal data connected to generative AI tools: purpose and legal basis, provenance, quality, minimization, bias, access, retention and documentation.
• Who should own it. The function that manages the organization's data, with the AI lead, the data protection officer (or the country's equivalent role) and information security. In small organizations, the AI lead. Enter the function in [RESPONSIBLE FUNCTION] and the person responsible in [OWNER].
• Decisions to take first. Before adopting it, decide who approves the use of a dataset in AI (Section 6), which quality thresholds apply depending on the system's risk (Section 7), which privacy-protecting techniques are mandatory (Section 9) and the retention periods (Section 13).
• Fields to complete. Replace the bracketed fields, such as [ORGANIZATION NAME], [RESPONSIBLE FUNCTION], [AI COMMITTEE], [PRIVACY EMAIL] and [COMPLETE]. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This document has no country variants. Rules on legal basis, sensitive data, new purposes, records of processing and retention vary by country: use "Related regulatory references" to complete Sections 6, 9 and 13 with your advisors.
• Review. Have privacy and legal review Sections 6, 9, 13 and 14, and have security review Sections 11 and 12.
• Approval and publication. Have it approved by the AI committee or the data governance body, record it in "Version history" and communicate it to the data, AI and IT teams and to system owners.

Data Governance Guidelines for AI

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Standard owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Privacy contact	[PRIVACY EMAIL]

1. Purpose

These guidelines set out the requirements [ORGANIZATION NAME] applies to the data it uses in its AI systems, so that such data are lawful, fit for purpose, of sufficient quality, representative, secure and traceable throughout their life cycle, and that data-related risks stay within the risk appetite (see "AI Risk Appetite Statement").

2. Scope

2.1 These guidelines apply to:

a) data used to train, fine-tune, validate or test AI models;
b) internal data connected to AI tools as a knowledge source (for example, document repositories, knowledge bases or retrieval-augmented generation systems);
c) data entered into AI systems during operation, including prompts and files provided by staff;
d) outputs generated by AI systems and logs of their operation;
e) synthetic data and data acquired from third parties or obtained from public sources.

2.2 They apply to all staff and to vendors that process data for AI systems on behalf of [ORGANIZATION NAME].

2.3 These guidelines complement the privacy and data protection policy, the information security policy, the information classification policy and the responsible AI use policy.