AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Operational
Control requirement
Assign accountable owners and operational stewards for data used by AI, with authority over permitted use, quality, access, retention, sharing and disposal. Resolve responsibility across source data, derivatives and supplier copies.
Why this matters
An engineering team may operate a store without authority to approve the information’s use. Clear ownership connects business decisions to the people maintaining the controls and handling requests.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
AI source datasets, generated records, retrieval collections, logs and material derivatives, including data controlled by different business units.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The data governance lead establishes the model; business data owners approve decisions and stewards operate assigned practices.
Implementation guidance
- Identify owners and stewards for each material data asset and derived store, linking assignments to the inventory.
- Define approval authority for new purposes, access, external sharing, retention and rights requests with reachable deputies.
- Reconcile source and downstream responsibilities, including suppliers and cross-business integrations.
- Verify that assigned roles have usable information, access and capacity; update assignments during changes and handovers.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a new data use | An authorized owner reviews the purpose and conditions. |
| Submit a cross-system handling request | A responsible coordinator and participating stewards are identified. |
| Review a role handover | Open decisions, stores and supplier responsibilities transfer explicitly. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Ownership and stewardship register
- Authority and escalation rules
- Use and handling decisions
- Handover and capacity reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unowned data or conflicting instructions to the governance lead. Restrict new consequential uses or transfers until an accountable decision authority is established.
Example in practice
Hypothetical example: Customer support owns transcripts while analytics operates an AI evaluation store. Named stewardship links the copies so a retention change applies to both rather than stopping at the original database.
Related controls
- CF05-001: Data Security & Privacy Policy for AI
- CF05-002: AI Data Inventory
- CF05-010: AI Data Purpose Limitation
Framework mappings
- CSA AICM (DSP-06)
- NIST AI RMF (GOVERN 1.1)
- EU AI Act (Art. 10)
- ISO 42001 (Cl. 5.3, A7.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0