AI Governance for Analytics Data: A Policy Framework
AI governance is the set of policies, roles, and controls determining how an organisation develops, deploys, and monitors AI systems — and, critically, what data those systems are permitted to use. For most organisations the hardest part is not the model. It is that behavioural data collected years ago under an analytics lawful basis is now being fed into systems nobody anticipated when it was collected.
This framework covers the six decisions every organisation has to make about analytics data and AI, who owns them, and how to evidence them.
General guidance, not legal advice. Regulatory context verified as of August 2026.
Why does analytics data create the hardest AI governance problem?
Three reasons, and they compound.
It was collected for a different purpose. Behavioural event data is typically gathered under a lawful basis framed around product improvement or analytics. Using it to train or ground an AI system is often a new purpose, requiring its own assessment — and sometimes its own basis.
It is personal data. Event streams describe identifiable individuals. Every subject right that applies to the raw data applies to what a model derives from it, which raises questions about erasure that most organisations have not answered.
It is the data most organisations actually have. Companies without proprietary text or image corpora do have years of behavioural telemetry. It becomes the default AI substrate precisely because it is available, not because anyone assessed whether it should be.
A note on timing. The EU AI Act's high-risk obligations were deferred by the Digital Omnibus on AI — Annex III systems now fall due on 2 December 2027 rather than 2 August 2026. That defers the compliance package, not the groundwork. The artefacts high-risk compliance will demand, above all a data provenance record, take longer to assemble than the deferral lasts, and governance built on ungoverned data cannot be assembled retrospectively at all.
The six decisions
Each one needs a documented answer, a named owner, and a review date. An organisation that cannot produce these on request does not have AI governance, whatever its policy document says.
1. What data may be used?
Define permitted and prohibited categories. At minimum: which event categories are eligible, whether identified or only pseudonymous data may be used, whether special-category data is excluded, and whether data collected before the policy existed is in scope.
The retroactive question is the awkward one and skipping it does not make it go away.
2. On what basis?
For each permitted use, the lawful basis, and whether it differs from the basis under which the data was collected. Where it differs, document the compatibility assessment or the new basis.
3. Who may access it?
Access to training data, to model outputs, and to any interface that can query personal data through a model. Role-scoped, logged, and reviewable.
A pattern worth considering: metadata-only access, where an AI system can read schema, definitions, and aggregates but not raw personal records. It resolves a large share of the access question architecturally rather than through policy, and it is straightforward to enforce.
4. What happens to derived artefacts?
Models, embeddings, and fine-tuned weights derived from personal data. Decide, in advance:
- Whether an erasure request requires retraining, and if not, why not
- Retention period for training datasets and derived artefacts
- Whether derived artefacts may leave the organisation
This is the decision most policies omit and the one regulators are most likely to probe.
5. What human oversight applies?
Which decisions may be automated, which require human review, and what recourse a person has. Scale oversight to consequence — a churn score prompting an email is not a credit decision.
6. What is monitored, and by whom?
Model performance, drift, input data quality, and output review. Governance without monitoring is a statement of intent.
Who owns AI governance?
| Role | Owns |
|---|---|
| Executive sponsor | Risk appetite, final authority on prohibited uses |
| Data protection officer / privacy counsel | Lawful basis, DPIAs, subject-rights position |
| Data / analytics owner | Which data is eligible, classification, provenance |
| ML or engineering lead | Access controls, monitoring, technical enforcement |
| Domain owner | Whether the use case is appropriate in context |
The failure mode is assigning this entirely to a technical team. Decisions 1, 2, and 4 are legal and commercial judgements that a technical owner has no standing to make and will, reasonably, defer indefinitely.
What evidence do you need?
Regulators, auditors, and enterprise customers increasingly ask for artefacts rather than assurances:
| Artefact | Answers |
|---|---|
| AI use-case register | What systems exist and what they do |
| Data provenance record | Where the training data came from and under what basis |
| DPIA per use case | The risk assessment |
| Access log | Who reached the data and when |
| Model card | What the system does, its limits, its evaluation |
| Human oversight record | Which decisions were reviewed |
| Retention schedule | For training data and derived artefacts |
The provenance record is the one organisations most often cannot produce, and it is the one that becomes hardest to reconstruct with time.
How does this connect to data governance?
AI governance built on ungoverned data cannot work. Every decision above depends on knowing what data you hold, what it means, what basis it sits under, and how long it lives — which is exactly what an analytics governance framework produces.
The practical sequence is: govern the data, then govern the AI. Organisations that attempt the reverse write a policy they cannot apply, because they cannot answer "which of our events contain personal data" without a taxonomy that classifies them.
→ Prerequisite: Data Governance for Product Analytics
Frequently asked questions
What is AI governance? The framework of policies, roles, and controls determining how an organisation develops, deploys, and monitors AI systems — including what data those systems may use, who may access them, and what human oversight applies.
Can you use product analytics data to train AI models? It depends on your lawful basis, your privacy notice, and whether the new purpose is compatible with the original one. Behavioural data collected under an analytics basis is not automatically available for model training, and the assessment should be documented before use rather than after.
Does an erasure request require retraining a model? This is unsettled and depends on whether personal data is recoverable from the model. The defensible position is to decide your approach in advance, document the reasoning, and be able to explain it — rather than to face the question for the first time when a request arrives.
Who should own AI governance? An executive sponsor with risk authority, supported by privacy, data, and engineering. It should not sit solely with a technical team, because the core decisions are legal and commercial rather than technical.
What is the difference between AI governance and AI compliance? Governance is the internal framework you choose. Compliance is meeting external legal requirements. Good governance produces compliance as a by-product and extends beyond it into decisions no regulation currently addresses.
Does the EU AI Act deferral change what you should do now? Not materially. High-risk obligations under Annex III moved to 2 December 2027, but transparency obligations applied from 2 August 2026 and the system inventory and provenance record that high-risk compliance requires take longer to build than the deferral provides.
Where do you start? With an AI use-case register and a data provenance record. You cannot govern systems you have not enumerated or data whose origin you cannot establish.
Where to go next
- Prerequisite: Data Governance for Product Analytics
- Regulation: The EU AI Act and Product Analytics
- Monitoring: AI Observability vs Data Observability
- Data: First-Party vs Third-Party Data
Countly is a first-party product analytics and customer engagement platform that runs self-hosted, on-premises, or in a private cloud.
Posts that our readers love
to grow your product
is here.