Data governance taught us how to govern the information behind a decision. Now, AI is forcing us to govern the decision itself.

Working with customers every week, I keep meeting a new class of decision-maker that nobody hired, nobody onboarded and few govern. The reality is that AI agents are making more and more decisions and the human "in the loop" often shows up too late to matter. In fact, Gartner predicts that by 2028, at least 15% of day-to-day work decisions will be made autonomously by agentic AI.1 Not 15% of tasks. No. 15% of decisions. That’s decisions about pricing, credit dispositions, supply chain reroutes, customer resolutions, etcetera ad infinitum — all made at machine speed without anyone in the loop.

So who governs those decisions today?

For many organizations, honestly, the answer is still nobody.

On the other hand, the solution lies buried in email threads and spreadsheets nobody can search. This gap is why the next chapter of our discipline isn't data governance getting bigger. It's data governance evolving into AI decision governance, and the connective tissue that makes it work is the semantic layer: the shared business vocabulary, ontology and context that let both humans and agents agree on what the data actually means before it's used to decide anything.

This matters more than ever because Gartner's own research shows uniform governance across agents of different autonomy levels is itself a failure mode,2 and McKinsey finds that despite near-universal adoption, only 37% of organizations report a measurable EBIT impact from AI.3 This is largely due to scaled deployments outpacing governance maturity.4 MIT NANDA's GenAI Divide research points to the same root cause: Tools that can't integrate with real workflow context stall out, no matter how capable the underlying model is.5 Without a semantic layer that gives every dataset a consistent definition, lineage and business context, agents inherit exactly the ambiguity that stalls these programs.

The same pattern shows up in security. Verizon's 2026 Data Breach Investigations Report, the largest dataset in the report's history, found that unapproved "shadow AI" use tripled in a year, with employees uploading source code, internal documents and structured data into unauthorized platforms. Executives have highlighted they are concerned about the volume of data being loaded into AI. Third-party and supply-chain breaches jumped 60%, now involved in 48% of overall incidents.6 That's not a data quality problem; that's a data context problem. Nobody could see what data an agent or tool was touching, under what policy or why. If AI governance is a blocker, then shadow AI grows faster.

Many regulators have already made the shift for which this article argues. The EU AI Act doesn't regulate datasets, rather it regulates decision contexts: hiring, credit, insurance, access to essential services. Most of the Act became applicable in August 2026; high-risk obligations land December 2, 2027.7 These are dates to remember.

In my work across executive teams with Collibra, I frame the shift around five disciplines:

Build a decision inventory cataloging every place AI decides or acts
Tier by autonomy, not technology
Demand decision lineage traceable from certified, well-defined data through an ontology and semantic layer to model version to outcome
Name an owner for every class of AI decision
Generate evidence by design, so audit-ready records are a byproduct of how the system runs, not a scramble after an incident

Our intent at Collibra isn't to bolt a compliance burden onto your AI ambition; our goal is to create the operating model that makes future automation fundable and trustworthy. The truth is that the more things change, the more they stay the same. Today, trust is still the key constraint on value.

Data governance was never really about data; at its root it is about confidence. Decision governance extends that same promise to a workforce that now includes machines.

Your data governance program built the foundation. And if you really think about the dynamics of today’s AI-powered world, now, the real question for your next board meeting is: Who's building the semantic layer that goes on top?

Sources

1 Gartner: Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 (June 25, 2025)

2 Gartner: Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure (May 26, 2026)

3 McKinsey: The State of AI in 2026 — On the Road to ROI (Aug 25, 2026)

4 McKinsey: State of AI Trust in 2026 — Shifting to the Agentic Era (Mar 25, 2026)

6 MIT NANDA: The GenAI Divide — State of AI in Business 2025 (July 2025)