Skip to content
Henry Rincón
CV (PDF)

Methods · Topic T5

How AI and data should be governed

It prints in full from the browser, on A4 or Letter.

Block 1

The problem

Governing AI on top of data governance that works: every piece of data with a meaning, an owner and a purpose, every AI system inventoried, assessed and monitored, and an organization able to prove it without claiming more than it has.

Summary in three lines

  1. AI governance continues data governance and extends it: the questions about data remain —what it represents, where it comes from, who answers for it, who may use it and what happens when it changes— and two are added: what the system may do and when it must stop.
  2. An AI management system organizes the work: context, roles, risks, impact assessment, inventory and continual improvement, with controls that show they work and not only that they exist.
  3. Standards and frameworks are used as a map: the system is structured with a management standard, complies with the personal data law that applies and does not claim a certification it does not have.
Block 2

The map

From data with an owner and a purpose to an AI system that is inventoried, assessed and monitored

Swipe to see the whole map.

From data with an owner and a purpose to an AI system that is inventoried, assessed and monitoredThe business and the data owners set shared definitions; those definitions are checked with quality and lineage rules, which enable purpose-based access, and that access restricts the use of personal data before it feeds an AI system. Every system, in-house or from a vendor, is registered in an inventory; the inventory leads to assessing its impact, the assessment sets how much autonomy it gets according to its risk, and that autonomy is monitored through traces. The institution runs underneath: leadership assigns roles, appoints the data owners and answers for an AI management system, which receives as evidence what the traces show.Business and dataowners1Shareddefinitions2Quality andlineage3Purpose-basedaccess4Protectedpersonal data5AI system6AI systeminventory7Impact assessment8Autonomy by risk9Traces andmonitoring10Leadership androles11AI managementsystem12Vendors andmodels13

Legend of shapes and colors

  • Actor — who does the work
  • Data — what is stored and read
  • Control — a rule that gets checked
  • Person — a person decides
  • External — what comes from outside

Reading the map, node by node

The business and the data owners set shared definitions; those definitions are checked with quality and lineage rules, which enable purpose-based access, and that access restricts the use of personal data before it feeds an AI system. Every system, in-house or from a vendor, is registered in an inventory; the inventory leads to assessing its impact, the assessment sets how much autonomy it gets according to its risk, and that autonomy is monitored through traces. The institution runs underneath: leadership assigns roles, appoints the data owners and answers for an AI management system, which receives as evidence what the traces show.

  1. Node 1 Business and data owners (Person) — Whoever answers for the meaning of each piece of data and decides what it may be used for.
  2. Node 2 Shared definitions (Data) — Each indicator with one definition, one owner and one calculation rule, reused by every product.
  3. Node 3 Quality and lineage (Control) — Completeness, duplicate and reconciliation rules, with thresholds that trigger a review, and the path of every figure back to its source.
  4. Node 4 Purpose-based access (Control) — Not only who may see a piece of data, but what for and at what level of detail: the same data seen in aggregate for a management decision is not queried in identified form for anything else.
  5. Node 5 Protected personal data (Control) — Anonymization when the analysis does not need to identify anyone, an authorized purpose and traceability of every query.
  6. Node 6 AI system (Actor) — A model, a generative application or an agent: it interprets, recommends or acts on the data it receives.
  7. Node 7 AI system inventory (Data) — Purpose, owner, vendor, sources, users, level of autonomy, status and main risks of each system.
  8. Node 8 Impact assessment (Control) — What the system can do to people, groups and processes, beyond its technical performance.
  9. Node 9 Autonomy by risk (Control) — Retrieve, draft, recommend or execute: only what can be verified and reversed acts without approval.
  10. Node 10 Traces and monitoring (Control) — What each system did, with which data, for whom and with what result; an exception that does not show up is a control that does not work.
  11. Node 11 Leadership and roles (Person) — Priorities, resources and acceptable risk levels; the business, data, security, risk, compliance and technology each with their share.
  12. Node 12 AI management system (Control) — Context, policies, objectives, controls, evaluation and continual improvement: AI as a capability that is managed and proven.
  13. Node 13 Vendors and models (External) — Third-party platforms, models and agents: they enter the same inventory and a change on their side calls for a new assessment.

Connections

  • from Business and data owners to Shared definitions (defines)
  • from Shared definitions to Quality and lineage (is checked)
  • from Quality and lineage to Purpose-based access (enables)
  • from Purpose-based access to Protected personal data (restricts)
  • from Protected personal data to AI system (feeds)
  • from AI system to AI system inventory (is registered)
  • from Vendors and models to AI system inventory (also)
  • from AI system inventory to Impact assessment (is assessed)
  • from Impact assessment to Autonomy by risk (sets)
  • from Autonomy by risk to Traces and monitoring (is monitored)
  • from Traces and monitoring to AI management system (evidence)
  • from Leadership and roles to AI management system (answers for)
  • from Leadership and roles to Business and data owners (appoints)
Block 3

The phases

  1. Phase 1

    Govern meaning: definitions, owners and lineage

    Inputs

    • The indicators and data that decisions depend on.
    • The different versions of the same figure circulating between areas.

    Activities

    • Agree each definition with the business owner, not only with the technical team.
    • Centralize the calculation rule in a semantic model that every product reuses.
    • Record the path of every figure back to the sources and rules that produce it.

    Artifacts

    • The glossary of definitions with their owner.
    • The lineage of the critical indicators.
    Who decides
    The data owner in the business.
    Control that closes the phase
    No indicator reaches an analytics product without a definition, an owner and a single calculation rule.
    Evidence

    At Banco Pichincha each indicator had one definition, one owner and one calculation rule, centralized in the semantic model and reused by every product; the lesson was that security protects access, and semantics and lineage protect interpretation.

  2. Phase 2

    Control purpose-based access and protect personal data

    Inputs

    • The data that describes people and the personal data law that applies.
    • The decisions that need each piece of data and at what level of detail.

    Activities

    • Write access policies around purpose, not around job title.
    • Anonymize when the analysis does not need to identify anyone.
    • Record who queried what and what for.

    Artifacts

    • The purpose-based access policies.
    • The log of queries to personal data.
    Who decides
    The data owner, with whoever is responsible for data protection.
    Control that closes the phase
    No personal data is used for a purpose other than the authorized one, even if it can technically be reached.
    Evidence

    At Fundación CTIC, since 2025, work with data about people follows three rules: anonymization when the analysis does not need to identify anyone, access by purpose rather than by job title, and traceability of who queried what and what for.

  3. Phase 3

    Inventory the AI systems and assess their impact

    Inputs

    • The AI capabilities the organization develops, acquires or uses.
    • The people, groups and processes each system can affect.

    Activities

    • Register each system with its purpose, owner, vendor, sources, users, level of autonomy, status and risks.
    • Assess the system's impact on people and processes, not only its performance.
    • Set the criteria for a use case to move forward, with controls proportional to its risk.

    Artifacts

    • The AI system inventory.
    • The impact assessment of each system.
    Who decides
    The system owner, with risk and compliance.
    Control that closes the phase
    No AI system operates without being in the inventory and without its impact assessment.
    Evidence

    At Fundación CTIC the strategy provides for progressively building an inventory of AI systems, and the standard also calls for assessing the impact of each system —the AIIA—.

  4. Phase 4

    Structure the AI management system: context, roles, risks and controls

    Inputs

    • Why the organization uses or could use AI and which stakeholders are affected.
    • The legal, institutional and ethical obligations that apply.

    Activities

    • Assign roles, responsibilities and authorities: not every AI decision belongs to the technical team.
    • Turn the management standard into instruments: policies, procedures, matrices, evaluation criteria and follow-up mechanisms.
    • Measure each instrument's progress by its definition, review, approval and application, not by its existence.

    Artifacts

    • The AI management system and its instruments.
    • The link between each requirement, the instrument that covers it and the evidence it produces.
    Who decides
    Senior leadership, with the business, data, risk and technology owners.
    Control that closes the phase
    No instrument is considered finished without evidence that it is applied.
    Evidence

    At Fundación CTIC the institutional AI strategy is structured following the principles and requirements of UNE-ISO/IEC 42001:2025; the management system comprises more than 20 instruments, a third of them finished and the rest under construction, and the institution is not claimed to be certified.

  5. Phase 5

    Monitor behavior and prove that the controls work

    Inputs

    • The systems in operation and the controls that were declared.
    • Changes in sources, models and vendors.

    Activities

    • Record the event of each run: request, response, status, cost and result.
    • Show each control failing against the condition it must detect.
    • Review the controls when the system, its sources or its vendor change.

    Artifacts

    • The execution traces.
    • The evidence that each control detects what it must.
    Who decides
    Whoever runs the management system, with each system's owner.
    Control that closes the phase
    A control that was never seen detecting its deviation does not count as implemented.
    Evidence

    At Vesting, real-time monitoring of up to 23 agents at once, out of an inventory of 27, recorded what each agent did, for which client, at what cost and with what result; an exception that did not show up in monitoring was a control that was not working.

Block 4

The design decisions

  1. How to structure an AI management system: on top of data governance, not beside it

    When yes
    When the organization uses or is going to use AI, the AI management system is structured as a continuation of data governance: the same owners, the same lineage and the same inventory, extended to models, agents and vendors.
    When no
    When an AI management system is proposed as a separate project, with policies that do not connect to the data the system uses.

    Why

    Evidence

    At Vesting the identity, ownership, isolation and traceability of the data were preserved from the ingestion of each event, and the standardization of what each agent had to record, with what identity and in what format, made it possible to monitor them: one that left no trace according to the standard could not be monitored and did not go to production.

    State of the field

    The Cloud Adoption Framework recommends assigning agent governance to the same leaders responsible for cloud governance, security and compliance, and avoiding parallel governance models.[8]

  2. Access by purpose, not by job title

    When yes
    When the same data serves different decisions or describes people: the policy says what it may be used for and at what level of detail, not only who sees it.
    When no
    When the data does not describe people or sensitive information and a role-based permission is enough for the risk it carries.

    Why

    Evidence

    At Vesting purpose-based access took the form of a separate Microsoft Fabric workspace for each of the 12 clients, with its own identity and ownership of the data: no query crossed that boundary by accident.

    State of the field

    The Cloud Adoption Framework asks that each agent be granted access only to the data its function requires and that, when it acts on behalf of a user, it inherit that user's permissions.[8]

  3. Autonomy proportional to risk

    When yes
    When the result can be verified, reversed and kept within clear limits, a task can run without prior approval.
    When no
    When the action is high-impact or cannot be reversed: the system recommends or drafts, and a person approves.

    Why

    Evidence

    For the 11 agents in the portfolio, what each one does, what limits it has and what it «never» does is written in its sheet.

    State of the field

    OWASP calls excessive agency the risk that a system built on a language model performs damaging actions because it has too many functions, permissions or too much autonomy, and recommends least privilege and human approval of high-impact actions.[9]

  4. How to assess the impact of an AI system: before operating and every time it changes

    When yes
    When an AI system can affect people, groups or the distribution of responsibilities: the impact is assessed before operating and again when the model, the sources or the use change.
    When no
    When the tool does not touch data about people or decisions about them: the use case's risk analysis is enough.

    Why

    State of the field

    ISO/IEC 42005:2025 gives guidance on when and how to assess an AI system's impact on individuals and societies, and at what stages of its life cycle, and how to integrate that assessment into risk management and the AI management system.[5]

    Evidence

    At Fundación CTIC the impact assessment is raised because a solution can be technically functional and still affect certain groups or introduce a dependency that had not been foreseen.

  5. Govern what is bought as well

    When yes
    When the capability comes from a vendor: what data it uses, where it is processed, what dependency it introduces and how its changes will become known are all assessed.
    When no
    When buying the technology is assumed to transfer responsibility for its use and effects: that responsibility stays with the organization.

    Why

    Evidence

    At Cafam, in 2020, the Oracle WMS Cloud implementation was tested for months with 6 vendor people inside the team of 20, and every difference between the system and the operation was resolved with its owner.

    State of the field

    The Cloud Adoption Framework asks to identify the risks of external dependencies —third-party data, models, libraries and integrations— and to set policies so that they meet the organization's privacy, security and compliance standards.[7]

  6. Document what an auditor asks for, without mistaking a document for compliance

    When yes
    When the organization needs to prove its system: every requirement with the instrument that covers it, the document that supports it and the evidence it produces.
    When no
    When using third-party services that meet the standard is expected to make one's own processes conformant: those are assessed separately.

    Why

    Evidence

    The ISO 42001 Expert in the portfolio synthesizes the 38 Annex A controls and knows the 24 supporting documents an auditor asks for in the documentation stage; every normative statement cites clause and page or declares the gap.

    State of the field

    Microsoft Learn notes that whoever uses services covered by ISO/IEC 42001 remains responsible for engaging an assessor for their own controls and processes.[4]

Block 5

What is new in 2026

  • State of the field

    The structure of an AI management system is that of a management system

    What changes from common practice

    ISO/IEC 42001 specifies the requirements of an AI management system and sets out a structured way to manage the risks and opportunities of AI.[4]

  • State of the field

    Agents, with a registry and an owner

    What changes from common practice

    Each agent is recorded in a single organizational inventory with its owner, purpose, platform and access scope, and the organization decides in advance how to disable it if it malfunctions: an agent nobody knows exists cannot be governed.[8]

    Judgment

    An agent with no owner and no record is not a technical risk: it is a governance gap.

  • State of the field

    Excessive agency as a named risk

    What changes from common practice

    An agent's risk stops being generic: it has three causes —too many functions, permissions or too much autonomy— and concrete controls: least privilege, human approval of high-impact actions and activity logging.[9]

  • State of the field

    Impact assessment, with its own standard

    What changes from common practice

    Impact assessment stops being a section of the risk analysis: ISO/IEC 42005:2025 guides it —when, how and at what stages of the life cycle—, and ISO/IEC 23894:2023 gives guidance for integrating the management of AI-specific risk into the organization's activities.[5][6]

    Judgment

    A management system born with the first use case tends to cost less than one that arrives to audit what is already in operation.

  • State of the field

    Generative AI with its own risk profile

    What changes from common practice

    The NIST AI RMF organizes risk management into four functions —govern, map, measure and manage—, with govern as a cross-cutting function, and its generative AI profile (NIST AI 600-1) is a cross-sectoral profile and a companion resource to the framework; both are for voluntary use.[2][3]

  • State of the field

    The AI Act timeline, after the AI Omnibus

    What changes from common practice

    The AI Act has been generally applicable since August 2, 2026, with exceptions: the prohibitions and AI literacy have applied since February 2, 2025 and the obligations for general-purpose models since August 2, 2025; after the AI Omnibus, in force since July 27, 2026, high-risk systems in sensitive areas (Annex III) move to December 2, 2027 and those embedded in regulated products, to August 2, 2028; prohibition 9, introduced as part of the AI Omnibus, comes into effect in December 2026.[1]

    Judgment

    A regulatory timeline that moved once can move again: the piece's review date is part of the data.

  • State of the field

    Colombia: a national policy and a data regulator that already address AI

    What changes from common practice

    CONPES 4144, approved on February 14, 2025, is Colombia's National Artificial Intelligence Policy, with actions through 2030 and six axes and governance and ethics as the first; the Superintendence of Industry and Commerce published guidelines in 2024 on processing personal data in artificial intelligence systems.[12][13]

    Judgment

    Personal data law already governs the AI that uses data about people: there is no need to wait for an AI law to comply with it.

  • State of the field

    Automated compliance where possible, human judgment where not

    What changes from common practice

    AI policies are enforced with tools where possible —assessment templates for AI regulations, auditing of interactions— and with human review where automation falls short, with checkpoints at design, testing and pre-launch approval.[7][10][11]

Block 6

Failure modes and how to anticipate them

  • What breaks
    Policies without a mechanism
    How it shows up
    A policy demands traceability and no system records the event that would prove it.
    Control that catches it
    Every principle with its control, every control with its evidence and every piece of evidence with an owner.
  • What breaks
    Agents with no owner and no record
    How it shows up
    Nobody knows how many agents there are, what they can do or who shuts them down.
    Control that catches it
    A mandatory inventory before operating, with an owner and an access scope.
  • What breaks
    Excessive agency
    How it shows up
    An agent with tools or permissions its function does not use.
    Control that catches it
    Least privilege and human approval of high-impact actions.
  • What breaks
    An indicator that changes silently
    How it shows up
    The same name with a different calculation rule in another product.
    Control that catches it
    A single definition with an owner, and notice to the products and decisions that depend on it.
  • What breaks
    Personal data used for another purpose
    How it shows up
    A report with identified people where an aggregate was enough.
    Control that catches it
    Anonymization by default and access written around purpose.
  • What breaks
    Compliance inherited from the vendor
    How it shows up
    A third-party service's compliance is presented as one's own.
    Control that catches it
    One's own controls and processes are assessed separately, with their evidence.
  • What breaks
    A control that never failed
    How it shows up
    Always green, and nobody has seen it detect the deviation it exists for.
    Control that catches it
    Every control is shown failing against the condition it must detect.
  • What breaks
    The vendor changes without notice
    How it shows up
    Behavior changes without the organization having changed anything.
    Control that catches it
    Monitoring of vendor changes and a new assessment when the model or its terms change.
Block 7

Metrics and controls

  • What is measured
    AI systems in the inventory
    Threshold
    All of them, in-house and third-party, before operating.
    Who approves the step to production
    Whoever runs the management system.
  • What is measured
    Systems with a current impact assessment
    Threshold
    All of those that touch people or decisions about them.
    Who approves the step to production
    The system owner, with risk and compliance.
  • What is measured
    High-impact actions with human approval
    Threshold
    All of them.
    Who approves the step to production
    The process owner.
  • What is measured
    Indicators with a definition and an owner
    Threshold
    All of those that reach an analytics product.
    Who approves the step to production
    The data owner in the business.
  • What is measured
    Queries to personal data with a recorded purpose
    Threshold
    All of them.
    Who approves the step to production
    Whoever is responsible for data protection.
  • What is measured
    Controls shown failing
    Threshold
    All of those declared as implemented.
    Who approves the step to production
    Whoever audits the management system.
  • What is measured
    Instruments with evidence of application
    Threshold
    Each one, not just its existence.
    Who approves the step to production
    Senior leadership, in the system review.

The thresholds are examples of the method, not figures from a specific project.

Block 8

Evidence from projects

  • EvidenceLevel: Real use

    Banco Pichincha: governing meaning

    Between March and July 2023, at Banco Pichincha, a data governance initiative was co-led: each indicator had one definition, one owner and one calculation rule, centralized in the semantic model, and the training program for 12 professionals also worked as a governance instrument.

    See where
  • EvidenceLevel: Real use

    Vesting: governance by design for 12 clients

    Between August 2023 and January 2025, at Vesting, each of the 12 clients had its own Microsoft Fabric workspace, with its identity and ownership of the data, and real-time monitoring watched up to 23 agents at once, out of an inventory of 27.

    See where
  • EvidenceLevel: Real use

    Fundación CTIC: data quality and personal data in healthcare

    Since March 2025, at Fundación CTIC, quality rules are designed from the process that produces each piece of data —completeness, duplicates, reconciliation between sources and thresholds that trigger a review— and data about people is handled with anonymization, purpose-based access and traceability, under habeas data and Law 1581.

    See where
  • EvidenceLevel: Under construction

    Fundación CTIC: the AI management system under UNE-ISO/IEC 42001:2025

    The institutional AI strategy is structured following the principles and requirements of UNE-ISO/IEC 42001:2025, with more than 20 instruments —policies, procedures, matrices, evaluation criteria and follow-up mechanisms—, a third of them finished and the rest under construction; the institution is not claimed to be certified.

    See where
  • EvidenceLevel: Real use

    The ISO 42001 Expert: the standard with clause and page

    A portfolio agent, in the initial version (v1.0.0) of its technical sheet, with the 38 Annex A controls and the 24 supporting documents an auditor asks for; every normative statement cites clause and page or declares the gap, and stamps the date on which the source was verified. The management system's instruments are reviewed against the standard with it, but it does not decide whether one is finished nor does it replace an audit.

    See where
  • EvidenceLevel: Real use

    Ceinfes: access as part of the design

    In 2018, with results from students at more than 100 schools, who queried what and what for was defined before building the report: the permission was part of the process design, not an afterthought.

    See where
  • EvidenceLevel: Real use

    The portfolio: autonomy written in each sheet

    For the 11 agents in the portfolio, what each one does, what limits it has and what it «never» does is written in its technical sheet.

    See where
Block 9

Limits and scope

  • Evidence

    At Fundación CTIC the AI management system is still in a progressive process of structuring and consolidation, with a third of its instruments finished; its figures are published as approximations and no certification is claimed.

  • Evidence

    What is published about Fundación CTIC is aggregated: no process, indicator or person, and no patient data.

  • Evidence

    The ISO 42001 Expert supports the review of the instruments, but it does not decide whether one is finished: that decision remains human.

  • Evidence

    The management standard does not replace the law: ISO/IEC 42001 structures the system and Colombian legislation —habeas data and Law 1581— sets what may be processed; the NIST AI RMF and the AI Act appear here as a map of the field, not as experience.

  • Evidence

    Microsoft Purview is listed as a prototype: what the piece says about Purview is state of the field, not experience.

  • Judgment

    What is worth doing differently today: open the AI system inventory on the day of the first pilot, not when several are already in operation.

  • Judgment

    A governance that cannot prove its controls is a promise, not a system.

Block 10

Sources and review date

  1. [1]
    AI Act

    European Commission — Shaping Europe's digital future ·

    https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

  2. [2]
    Artificial Intelligence Risk Management Framework (AI RMF 1.0)

    NIST ·

    https://doi.org/10.6028/NIST.AI.100-1

  3. [3]
    Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)

    NIST ·

    https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence

  4. [4]
    ISO/IEC 42001:2023 Artificial Intelligence Management System Standards

    Microsoft Learn ·

    https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-42001

  5. [5]
    ISO/IEC 42005:2025 Information technology - Artificial intelligence (AI) - AI system impact assessment

    IEC Webstore (ISO/IEC JTC 1/SC 42) ·

    https://webstore.iec.ch/en/publication/107659

  6. [6]
    ISO/IEC 23894:2023 Information technology - Artificial intelligence - Guidance on risk management

    IEC Webstore (ISO/IEC JTC 1/SC 42) ·

    https://webstore.iec.ch/en/publication/82914

  7. [7]
    Govern AI - Guidance to set up your organization's AI governance process

    Microsoft Learn ·

    https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai/govern

  8. [8]
    Govern and secure AI agents across the organization

    Microsoft Learn ·

    https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization

  9. [9]
    LLM06:2025 Excessive Agency (OWASP Top 10 for LLM Applications 2025)

    OWASP GenAI Security Project ·

    https://genai.owasp.org/llmrisk/llm062025-excessive-agency/

  10. [10]
    Microsoft Purview data security and compliance protections for Microsoft 365 Copilot and other generative AI apps

    Microsoft Learn ·

    https://learn.microsoft.com/en-us/purview/ai-microsoft-purview

  11. [11]
    Responsible AI Policies

    Microsoft Learn ·

    https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai/responsible-ai-policies

  12. [12]
    CONPES 4144: La hoja de ruta de Colombia en Inteligencia Artificial para los retos actuales y la transformación futura

    Departamento Nacional de Planeación (DNP) ·

    https://www.dnp.gov.co/publicaciones/Planeacion/Paginas/conpes-4144-hoja-de-ruta-colombia-inteligencia-artificial-retos-actuales-transformacion-futura.aspx

  13. [13]
    Circular Externa 2 de 2024: Lineamientos sobre el Tratamiento de Datos personales en Sistemas de Inteligencia Artificial

    Superintendencia de Industria y Comercio (SIC) ·

    https://sedeelectronica.sic.gov.co/transparencia/normativa/circular-externa-2-de-2024-de-la-superintendencia-de-industria-y-comercio-lineamientos-sobre-el-tratamiento-de-datos