3 min read

Data Judgment: The Governance Foundation No One Talks About

Picture of Jennifer Hofmann Jennifer Hofmann : Oct 12, 2026, 8:45:01 AM

AI and the Future of Work

5:01

There's a gap between AI ambition and AI readiness. IBM's Cost of a Data Breach Report 2025 revealed that 63% of organizations lacked AI governance policies to manage AI or prevent shadow AI. Meanwhile, across their organizations, employees are already using AI—with or without permission. A sales rep uploads customer data to ChatGPT because it's fast. A support team pastes confidential conversation logs to generate responses. An L&D designer uses an AI tool to build training content without knowing what data the tool retains. Nobody asked IT. Nobody checked policy. Nobody established boundaries.

This is shadow AI. And it's expensive.

63%

Of L&D leaders lack AI governance guidance.

Meanwhile, across organizations, employees are already using AI—with or without permission. This is shadow AI. And it's expensive.

What AI Governance Actually Is

Governance isn't an IT checkbox, it's a learning strategy decision. It answers a specific set of questions L&D and security must answer together before training with AI begins: What data can be used? Which tools are approved? Which decisions absolutely require human review? What happens when AI hallucinates or introduces bias?

Without those answers, organizations end up with three problems:

Shadow AI: employees finding workarounds, uploading sensitive information, circumventing restrictions because they don't know they exist
Output risk: hallucinations embedded in training content, biases hiding in recommendations, regulatory violations nobody caught
Wasted investments: AI tools deployed, but used inconsistently because governance is unclear

The Three Governance Decisions L&D Must Make

1. What data can be used?

Legal, Security, and L&D must define what's safe to automate. Can designers use internal employee data, customer info, or proprietary processes?

2. Which tools are approved?

Every AI tool has different retention and security policies. An approved list stops the sprawl of unauthorized software and prevents data exposure.

3. What requires human review?

High-stakes decisions require a human in the loop. Define which outputs—like compliance topics or technical content—need strict quality checks.

Decision 1: What data can be used with AI?

This isn't abstract, it's practical. Can training designers use internal employee data to improve content? Can they input customer information? Can they reference proprietary processes? Most organizations haven't answered these questions. They default to "I don't know, so I won't" or "Nobody's asked, so I will." Neither is governance. Governance means a team (Legal, Security, L&D) sits down and defines what's safe to automate and what isn't. Then they communicate it clearly.

Decision 2: Which tools are approved?

Every AI tool has different data retention policies, security practices, and compliance certifications. ChatGPT, Claude, Gemini, industry-specific platforms—they're not interchangeable. An approved tool list answers: what can L&D teams use? What's off-limits? What requires additional approval? Without this, employees pick tools based on personal preference or what their friend mentioned, creating a sprawl of unauthorized software and data exposure.

Decision 3: What requires human review?

Not every AI output needs human validation, but high-stakes decisions do. Training on compliance topics? That needs review. Generating assessment scoring logic? Review. Sensitive technical content? Review. Defining which outputs require a human in the loop means L&D understands the risk profile of each training application and builds quality checks accordingly.

The Cost of Not Doing This

An organization licensed an enterprise AI platform last year. Within three months, they'd discovered employees using it to process customer case files. Nobody had established data-use policy. They scrambled to lock it down. Now they're not using the tool at all.

Another company deployed AI-assisted content generation without defining output validation standards. A hallucination made its way into compliance training—undetected until audited. The remediation cost alone exceeded what they spent on the tool.

A third organization asked facilitators to use AI-powered assessments without communicating which data the system retained. Facilitators assumed it was secure. It wasn't. Trust evaporated.

These aren't hypotheticals. They're the baseline cost of deploying AI without governance.

Minimum Viable Governance

You don't need a 100-page policy book. You need clarity. Start with three moves:

First, define a minimum viable AI policy with Legal, Security, and IT.

It should answer: what data restrictions apply? What tools are approved? What data classification matters for training? Who approves new AI tools?

Second, communicate it.

Not as a memo buried in policy. As a one-page reference everyone can find. "Here's what we use AI for. Here's what we don't. Here's who to ask if you're uncertain."

Third, build it into how L&D works.

When someone proposes an AI tool, governance questions are automatic. When content is created with AI, validation steps are defined. Governance becomes a design pattern, not a compliance hurdle.

This Is Your Readiness Foundation

Data judgment—the ability to protect sensitive information while enabling innovation—is one of three critical readiness dimensions. Without it, AI deployment becomes liability. With it, AI becomes an asset deployed responsibly.

Before you buy another AI tool, before you authorize another training project, ask: Do we have data governance? Do employees know the rules? Do we validate outputs that matter? If the answers are unclear, that's not a sign to move faster. That's a sign to assess.