The RecordPoint model for AI-data readiness
Table of contents
Introduction
This model is for the people who own the risks and outcomes of data and AI: data governance and AI leaders, and the compliance, privacy, and security experts who work beside them.
Across financial services, government, and critical infrastructure, today’s data and information leaders tell us the same thing: AI use is growing faster than they can govern the data it touches. Meanwhile, most AI-governance guidance and solutions address the models, while ignoring the data underneath.
The leaders we talk to are stalled by two challenges: risk they can't contain and AI value they can't prove. The problems they describe are rarely caused by the model. They come from not knowing what the model can reach.
How AI adoption is putting sensitive data at risk
AI adoption, sanctioned or not, has widened the blast radius around sensitive data. Controlling that risk means being able to answer three questions on demand:
- Can you name and locate every system holding data?
- Is every dataset classified, and is that classification enforced at the point of AI access?
- Can you produce, on demand, proof of the data an AI system can reach?
Every organization should be able to answer these questions, whether AI is approved, banned, or in use without permission. Regulators now expect proof of control, not just a written policy.
The GDPR has long required organizations to prove compliance, not just claim it: to know what personal data they hold, why they hold it, and how long they keep it, and to show that on request. This applies to any AI system that handles personal data. The EU AI Act adds data governance, logging, and documentation rules for high-risk systems, whether or not personal data is involved. Financial regulators set the highest bar. EU DORA and Australia’s APRA CPS 234 require firms to test that their controls work, not just write them down.
Proving value with AI-data readiness
Today’s boards are funding AI to speed up decisions and delivery. Now they’re asking for proof that initiatives create the value they promised. Proving ROI means governing the data layer, because that’s what drives outputs and decisions the business must answer for.
Both halves point to one idea: you cannot govern AI without governing the data it runs on. The disciplines records and data teams have built over decades are now the control layer AI governance depends on, and that is why data governance maturity has become urgent.
Using the RecordPoint model for AI-data readiness
This framework lays out the path to AI-data readiness in three stages: Visibility, Data Governance, and Defensibility.
1. Visibility: The organization has a complete inventory of what data it holds, where it lives, and who owns it, across every connected system. This includes physical and digital records, cloud and on-premises, as well as structured and unstructured data.
2. Data Governance: Data is classified by type and sensitivity, retention rules are active, and redundant or obsolete data is remediated.
3. Defensibility: Data handling is documented, access is governed across both human and non-human identities, and AI systems are registered and held to the same records obligations as any other business system. The organization can certify its governance posture to regulators, auditors, and the board on demand, not just recover it under pressure.
Each stage builds on the one before it. Visibility shows what data exists so that it can be governed. Once it’s visible and accounted for, Data Governance classifies and controls it, while Defensibility proves that control to regulators, auditors, and the board.
AI-data readiness is the result: AI that can be monitored, held to account, and measured against the value it was funded to deliver.
Each stage is worth doing on its own. Together, they answer one question: do you know what data your AI runs on, and can you prove it?
How this model intersects with regulations
This model supports compliance and addresses AI risks by mapping to existing privacy and AI governance obligations organizations are already bound to:
Visibility supports the inventories that privacy and records obligations depend on. These include records of processing under GDPR and UK GDPR, the data mapping that accountability principles in Australia's Privacy Act and Canada's PIPEDA require, and the information asset registers national archives expect public bodies to keep. It also supports the records principles in ISO 15489 and the data provenance requirements for high-risk AI training data in the EU AI Act.
Data governance supports data minimization, retention limits, and disposal under GDPR, Australia's Privacy Act, PIPEDA, and the GLBA Safeguards Rule. It also supports the public records disposal requirements set by national archives law in Australia, Canada, the UK, and the US, and the records management principles in ISO 15489.
Defensibility supports accountability and impact assessment obligations under GDPR and UK GDPR, and AI system registration and log retention under the EU AI Act. It also maps to the data management and documentation requirements in ISO/IEC 42001.
The AI-data readiness model
Stage 1: Visibility
AI-data readiness signal: Every candidate data source for an AI training set or retrieval pipeline can be named and located before it's ever considered for use.
Visibility is the first step toward AI-data governance. It requires that an organization knows what data it holds across its whole estate: every system, every format, every business unit. No “dark data,” no unmapped silos, and no team keeping its own private inventory.
Visibility risks
If most of your data is dark, meeting compliance obligations becomes a struggle, and every audit or data request becomes a scramble. But for AI deployments, the risk multiplies. Unknown data means no control or even visibility over what AI processes. This means AI projects are built on inputs nobody trusts, and they often stall until someone can answer basic questions about the data.
Visibility cost drivers:
Recommended actions:
- Govern data where it lives. Connect Microsoft 365, file shares, SaaS, legacy platforms, and line-of-business applications to one centralized governance layer. Set classification, retention, and disposal policies once and apply them consistently across every system, so data is governed where it lives instead of being migrated to be controlled.
- Discover and enrich all data types. Inventory physical, structured, semi-structured, and unstructured content, and pull metadata from adjacent systems to enrich records and drive retention triggers.
- Treat discovery as infrastructure. Replace manual scans with automated discovery and set alerts for new data sources or unexpected data movement. Review coverage quarterly to keep inventories fresh.
- Unmask shadow IT and dark data. Check procurement and expense records for unsanctioned SaaS, consolidate duplicate instances of the same platform, and apply the same governance to orphaned file shares as to sanctioned systems.
- Give everything an owner. Give every system or data domain a named steward, not just a central team. Require new systems to be registered, with an owner, before go-live. Track the share of the estate with an assigned owner as a standing metric.
Stage 2: Data governance
AI-data readiness signal: Data is classified so that AI-access controls are enforceable, and training data is retention-compliant by design, not by exception.
Data governance is how you decide what AI can touch. Governance includes classifying data by type and sensitivity, enforcing retention rules, and cleaning up redundant, obsolete, or trivial data.
This lets you control data at the point of access, managing what is processed or relied on by AI. This in turn builds trust in AI outputs, keeping them current and free of personal information that shouldn't be there.
Data governance risks
Without classified data, sensitive data can end up in AI outputs, and data minimization and deletion becomes almost impossible, creating regulatory and security risks, and operational drag. Failure to address data governance adds data estate complexity and can lead to data hoarding out of data retention compliance fears, further amplifying these risks.
Data governance cost drivers
Recommended actions
- Classify every record. Give each record an information class and note whether it has business, legal, regulatory, or historical value. Apply sensitivity tiers from public to highly protected, using your organization's own policy language rather than a generic template. Review access regularly, for people and AI alike.
- Map everything to regulations and owners. Tag each class with the regulations that govern it and the people accountable for it. Build a retention schedule that sets how long each class is kept, including where the rules differ by jurisdiction.
- Start the retention clock with events, not just dates. Track triggering events, such as a contract ending, a matter closing, or an employee leaving. Apply legal holds to pause retention for records involved in litigation, investigations, or access requests.
- Make every disposal authorized and auditable. Route disposal through an approval workflow: a formal archival process for public-sector records, and owner and legal sign-off for private-sector records. Transfer records with historical or public value to an archive instead of destroying them. Let retention expiry trigger disposal automatically, rather than waiting for a cleanup project.
- Clear redundant, obsolete, and trivial data on its own track. Remove redundant, obsolete, and trivial (ROT) data through a lighter process than formal disposal. It's usually the largest volume of data and the fastest way to shrink what AI can reach.
Stage 3: Defensibility
AI-data readiness signal: Every AI output and decision can be traced back to governed sources at any time. The organization can prove its AI governance to regulators, partners, and the board on demand. Leadership can see clear evidence of how AI systems are providing value.
Defensibility means the organization can prove how AI decisions were made by showing which data was fed into models, with documented data handling and governance practices to prove that controls worked as planned.
This means that every AI decision an organization is asked to defend goes back to data visibility and governance decisions: what it was, who could reach it, how long it should have existed, and whether it should still have been reachable at the moment the model read it.
Defensibility risks
Without a deep understanding of the data that feeds into AI, decisions can't be properly explained, which is an audit requirement under the EU AI Act, the GDPR, along with other similar local regulations depending on jurisdiction. In addition, AI projects stall because no one trusts the data or control, and the value from AI initiatives is harder to quantify.
Defensibility cost drivers
Recommended actions:
- Run AI governance through one operating model. Set up approvals, risk assessments, assigned controls, exceptions, and review cycles once, so each AI project uses the same process instead of building its own.
- Treat every AI system as a records system. Keep one register that records, for each AI system, its risk tier, owner, controls, and the datasets it can reach. Apply the same retention and disposal obligations to its outputs and artifacts as to any other business record.
- Extend access governance to non-human identities. Give AI tools, agents, and integrations the same access controls, reviews, and evidence trail as human users, so you can always show what each system was able to reach and when.
- Keep the evidence current. Continuously maintain inventory, classification, ownership, and lifecycle evidence for data in AI systems. This includes retention, disposal, and legal holds as auditable controls, so answers to what data was kept, why, and for how long are always defensible.
- Consolidate value and control reporting. Give every function (legal, compliance, risk, security, and IT) one governance view for consistent reporting. Similarly, offer leadership and the board one place to see value and AI risk posture.
AI-data readiness outcomes
When Visibility, Data Governance, and Defensibility are in place, AI stops being something the organization governs one project at a time and becomes a standing capability it can manage on evidence. Leadership can see in one place which AI tools are in use across the estate, including the ones nobody approved, and which governed data each one can reach.
When data, classification, or access changes, those links are updated, so what was true at approval stays true in production. Every material AI initiative has a value case before it launches and is reviewed on a set schedule alongside its risks and control coverage.
That lets leaders expand, adjust, or retire use cases based on outcomes rather than activity. Because legal, compliance, risk, security, and IT all work from the same view, the organization can answer the board's two basic questions without building a one-off compliance pack each time: what can our AI reach, and is it delivering what we funded?
Operationalizing AI-data readiness
Data governance has always been the foundation of compliance. AI raises the stakes: an AI rollout is only as safe and useful as the data underneath it, yet that data is often the last thing teams check. As a result, most organizations are behind on the data maturity their own AI plans require. The good news is that catching up doesn't mean starting over. It means taking the steps in order, beginning with an honest look at where you stand.
Start by assessing your AI-data readiness maturity honestly. At a minimum you should be able to answer the questions we outlined at the start of this model:
- Can you name and locate every system holding data?
- Is every dataset classified, and is that classification enforced at the point of AI access?
- Can you produce, on demand, proof of the data an AI system can reach?
Build the case for change
Once you know where you stand, build the case for change against the cost carried at each stage: regulatory exposure, operational drag, and blocked AI adoption.
Data governance savings: Start with visibility and data governance gaps, as closing them pays for itself in lower operational and legal cost before a single AI benefit is counted.
Consider the cost of inaction: Once visibility and data governance gaps are closed, estimate the costs of inaction for AI adoption. This can materialize in lost value caused by a lack of trust, or in compliance or security risks.
Factor in outcomes: Pair the costs with a clear picture of outcomes once a stage is genuinely actioned: stabilized costs, faster approvals, shorter audit cycles, a credible board narrative.
Manage change in stages: Visibility is a prerequisite for everything after it. One closed gap moves an organization further than a program that tries to fix everything at once.
Assign ownership across the organization
The gaps this framework surfaces rarely sit inside one function, so each stage needs a named owner and clear supporting roles.
Data and IT teams are the primary owners of Visibility. They run discovery and inventory across the estate, including unsanctioned AI tools, with security's support. Every system or data domain has a named steward who keeps its entry current.
Data and records management teams own the Data Governance that sits inside these systems. They set the classification scheme, retention schedule, and disposal process. Data and IT teams enforce these in the systems, and legal and privacy map each class to its obligations and manage legal holds.
Legal, privacy, and compliance own Defensibility, including the AI operating model and its approval step. Records management supplies the audit trail, and security owns access controls for AI tools, agents, and integrations.
The teams that run AI own the outcomes. Each initiative's value case is theirs, and they decide when to expand, adjust, or retire a use case. They make those decisions using the evidence the three stages produce, not alongside it. That keeps data and compliance stakeholders involved instead of assuming governance stays within one function.