Don't wait for perfect data. Build AI data and governance in parallel

My first two articles in this series established that most AI programmes aren't moving the P&L. Additionally, the cost of running them is escalating faster than most organisations can see or manage. The natural response to both realities is to pause, get the conditions right and then move forward. That's exactly what a significant number of firms are doing right now, for two distinct reasons.

The first group has run pilots, seen enough to believe in the potential, and found they can't shift from AI proofs of concept to AI production at scale. This is because the orchestration layer required to enable processes with humans and AI working together isn't in place. Additionally, the governance infrastructure isn't built. The cost visibility that would make this defensible to a board doesn't exist. This group has the belief, but they lack the enabling infrastructure to successfully move forward.

The second group has been told by strategy consultants, technology architects, or well-intentioned board members that the data landscape needs to be fixed before meaningful AI deployment can begin. Data architecture, quality programmes and an AI governance framework are all critical, but they shouldn't be treated as precursors to deployment. The firms in this group are following advice from people they trust.

In my experience, this advice is wrong.

The challenge for both groups is finding an approach that allows you to make meaningful progress, knowing you will never have everything you need in place and conditions will never be perfect.

The sequencing trap

Long before AI arrived on the agenda, organisations were finding reasons to perfect the conditions before deploying new capability. Processes had to be redesigned before moving to shared services. Workflows had to be standardised and systems consolidated before offshoring could begin. In almost every case, that linear thinking made theoretical sense, but perfect processes were never achieved, standardisation ran for years and system consolidation consumed far more budget than planned.

What made it worse was that the sequencing felt responsible. IT architects sought clean foundations, legal teams sought resolved frameworks and finance teams sought proven returns before committing further. None of those concerns were wrong in isolation, but collectively they produced organisations that were protecting themselves against each of these individual risks. However, they forgot to add the critical risk of getting left behind to their risk register.

AI is following the same pattern, and the stakes are higher because the pace of change is faster. Firms waiting for clean data landscapes before touching AI and the orchestration required to make it successful are wasting time, however prudent it feels. They're making a choice (often without realising it's a choice) to let the gap between themselves and more agile organisations grow larger each quarter.

There's a principle in biology worth borrowing here. Species do not wait for perfect conditions before adapting. They adapt continuously in the real environment, under real selection pressure, with the variations that work propagating and the ones that don't dying out quickly. Organisations are ecosystems too. The firms compounding value from AI are running real work through reimagined workflows with real clients, generating real feedback and adapting on the basis of what they learn. Their data landscape and AI governance framework develop alongside that work, shaped by what it reveals.

My own experience across multiple transformation programmes confirms this. The companies that deployed new capability while building the supporting infrastructure in parallel consistently outperformed those that sequenced things linearly.

Data, governance and AI deployment must be run as parallel, evolving tracks of a broader AI transformation that inform and improve each other, and value only compounds when they're run in an interconnected way.

Regulation is a real factor too. The EU AI Act has been phasing in since 2025, and obligations for high-risk AI systems covering areas such as HR screening, credit decisions and biometric identification now apply from December 2027. As with other regulations, the broadening of scope over time is a real and likely prospect. For firms operating in or serving the EU market, the regulatory clock is already running, and it's not pausing for anyone's data landscape and readiness programme to complete.

Good enough to build from

There's a principle I've applied across transformation programmes in a variety of services firms that's directly relevant here. In almost every firm, between 70% and 90% of the outcomes for any given service line are the same across clients.

The remaining 10-30% are driven by client-specific requirements, country-level regulatory variation, or the particular history of how that client relationship was set up. If you wait to find a process that covers 100% of cases before deploying anything, you'll wait indefinitely. In a business-to-business services environment, variation is structural, permanent and in many cases the source of genuine client value. That same mindset applies to data.

Data quality, in my experience, is a transactability question. Ask yourself: do we have the data quality to serve a client correctly the first time? Do we have poor data quality creating downstream errors and rework because teams are trying to fix a mess we never contracted to deal with? That's the operational baseline that matters. A fully AI-ready data estate can come later. Firms that set full data readiness as the entry condition for AI deployment are deferring an outcome that will never arrive in the form they are waiting for.

The right framing is that the data landscape is something the transformation produces over time. Data quality improves as workflows are redesigned, as the orchestration layer creates visibility of what is actually flowing through client engagements, and as teams learn which data gaps are causing real operational friction and which are theoretical concerns that never surface in practice.

The data landscape needs to be architected and built as part of the reimagined human-AI operating model from the outset. It can't be bolted on after and should not be addressed in isolation before.

Governance as a design input, not a precondition

Research published in March 2026 by MIT's Center for Information Systems Research defines minimum viable governance as the least amount of governance required to manage risk effectively while enabling the organisation to sense and seize opportunities. MIT Sloan's research summary notes that organisations with well-developed minimum viable approaches to policy were able to cut complex decision time in half and identify new opportunities at three times the rate of peers who didn't.

The same body of research documents a financial services firm that routed every AI proposal through a centralised review committee. It took six months to approve low-risk proposals, and shadow AI returned across the organisation until the board forced a redesign. That's the cost of treating governance as a precondition.

MIT CISR identifies four characteristics of minimum viable governance: structurally agile, trustworthy by design, integrated end to end and opportunity sensitive. That last point is the most important and most often ignored. Moving too slowly is itself a risk category, and it belongs on the risk register alongside everything else.

From my own experience, I would translate that into four practical anchors for any professional services, business services or BPO firm.

1. Know what data AI can and cannot touch at the level of each client engagement. That is the minimum viable data position. A full data strategy can follow.
2. Log what the orchestration layer needs and does from day one, so visibility into what AI is touching, at which step, on which client's work, is built into the architecture from the start.
3. Involve legal, compliance, ethics and HR expertise from the outset. Their input shapes the reimagined workflow, so it needs to arrive while the design is still taking shape, well before a contract review or an incident.
4. Finally, maintain human review at the points of highest regulatory, client and IP exposure. That review is what makes the outputs legally and commercially defensible.

None of these require the data landscape to be perfect or the governance framework to be complete.

The governance failure MIT CISR documents almost always comes down to structure. The right people were probably involved. They were usually just organised in a way that made governance a gate rather than a guide. What these programmes actually need is legal, compliance, ethics and HR expertise, available and embedded in the design conversations that shape how the reimagined workflow and workforce will actually operate.

This ensures that the questions that would otherwise be raised after the fact are answered as part of the design itself. This move from governance as oversight to governance as design input is what minimum viable governance in practice actually looks like.

What comes next?

The organisations that are accelerating and compounding value are the ones deploying AI capability in parallel to the supporting data landscape and governance infrastructure, as part of a continuous AI transformation anchored in the real work.

As part of this, there are still uncomfortable questions that stand between you and success.

For example, do you know what your AI has been trained on? Who owns the outputs AI produces? What legal exposure do you have when these outputs are used in client work?

These legal and reputational questions must be addressed, especially by services firms whose value proposition rests on the quality, accuracy and defensibility of their work product. This topic will be the focus of my next article.

‍