Product
Book A Demo
ACTIVE DATA GOVERNANCE SERIES
Part 1: From Knowing Data Exists to Using It
Active Data Governance Series
Part 1 of 3
Series Overview
1
2
3
1
Part 1
This installment explains why traditional data governance stops at visibility and documentation
2
The Challenge
It highlights why knowing data exists is not the same as governing how it is used
3
The Solution
It introduces the need for active governance, where policies and controls operate at the moment data is used
This is Part 1 of a three-part series designed for executives and data leaders seeking a clear, non-technical briefing on the evolution of data governance. The series prepares you to understand how governance must transform from passive documentation into active execution, especially as organizations accelerate their use of analytics and AI.
The Current State of Data Governance
For more than a decade, organizations have invested heavily in data governance. They have built catalogs to inventory their data assets, defined business glossaries to standardize language, documented ownership models, stewardship roles, and accountability frameworks, and have written policies, reviewed them, approved them, and socialized them.

Gartner has repeatedly described this phase as the first wave of governance maturity, focused on visibility, definition, and accountability rather than execution.
In a majority of cases, you would be right to assume that governance should be "working", but, in many organizations today, the same conversation keeps resurfacing, "We know the data exists... but can we actually use it?"

McKinsey has observed that many organizations invest heavily in data foundations yet struggle to convert those investments into usable data for decision making.
The Governance Maturity Illusion
Organizations often mistake documentation for true governance. This infographic highlights the critical gap between having governance artifacts and achieving actual operational effectiveness and trust.
The Illusion of Maturity
  • Analysts manually cross-check numbers "just to be sure"
  • Data teams approve access requests one by one
  • Business users still hesitate before trusting data
  • Issues are discovered after data has been used
The Question That Exposes the Truth
We know the data exists…
but can we actually use it?
➡️
This question exposes an uncomfortable truth
  • Data is visible
  • Data is not usable
  • Governance optimized for compliance, not decision making
The Uncomfortable Truth About Data Usability
That question exposes an uncomfortable truth.
Most data governance programs are very good at making data visible. They are far less effective at making data usable. This can be attributable to the fact that a majority of data governance deployments were for the purposes of compliance, focused on regulations, not on the use of data for decision making.

BARC found that governance initiatives frequently improve transparency but fail to increase trust or reuse of data in analytics and business operations.
Ask an organization how mature its data governance is, and the answer is often framed in terms of artifacts. The catalog is populated. The glossary contains hundreds, sometimes thousands, of defined terms, and critical data elements, ownership roles are clearly documented, and policies exist for access, privacy, and compliance.

Gartner has noted that many organizations mistake the presence of governance artifacts for actual governance effectiveness.
On paper, governance looks complete, but step into the day-to-day reality and a very different picture emerges.
The Reality of Day-to-Day Governance
Business users still hesitate before trusting or reusing data, analysts still cross-check numbers manually "just to be sure", data teams are still asked to approve access requests one by one, risk and compliance teams still discover issues after data has already been used.
Trust Gap
Business users hesitate before trusting data
Manual Verification
Analysts cross-check numbers just to be sure
Access Bottleneck
Data teams approve requests one by one
Late Issue Discovery
Issues discovered after data has been used
Despite documented processes and artifacts, these daily challenges hinder true data effectiveness and trust, acting as significant roadblocks in an organization's data journey.
When Documentation Replaces Control
Trust Gap
Business users hesitate before trusting or reusing data
Manual Verification
Analysts cross-check numbers manually "just to be sure"
Access Bottleneck
Data teams approve access requests one by one
Late Issue Discovery
Risk and compliance teams discover issues after data has already been used

BARC research consistently shows that lack of trust remains one of the biggest barriers to analytics adoption, even in organizations with formal governance programs. Monte Carlo's State of Data Reliability reports show that data incidents continue to occur despite documented controls.
Governance exists, but confidence does not.
This is the illusion of governance maturity, mistaking the presence of documentation for the presence of control, and confusing awareness with trust.

McKinsey has described this as a common failure pattern where governance frameworks exist, but execution breaks down at the moment data is consumed.
Knowing that data exists is not the same as governing how it is used.
The Descriptive Governance Trap
What Does This Dataset Contain?
Traditional governance answers this well through catalogs and metadata
How Is This Field Defined?
Business glossaries provide clear definitions and standardized language
Who Owns It?
Ownership models document accountability and stewardship
What Policy Applies?
Policy documents outline rules for access, privacy, and compliance
Traditional governance models are largely descriptive by design, driven by a compliance focus. They are concerned with answering questions such as what does this dataset contain, how is this field defined, who owns it, and what policy applies.

Deloitte has highlighted that most governance models focus on definition and accountability, while enforcement is fragmented across tools and teams.
These questions matter. Without them, governance has no foundation, but they are also fundamentally incomplete.
The Critical Questions Left Unanswered
They describe what the data is, not how the data should be used, but they do not tell us whether this data should be used in a specific business context, whether it can be safely combined with other datasets, whether it is suitable for automation, AI, or external sharing, and whether the intended use aligns with regulatory intent, not just policy text.

The Institute of International Finance has warned that this gap between policy and usage is a major contributor to regulatory reporting and risk data failures in banks.
As a result, governance becomes a static reference point, something users "search", rather than a system that actively shapes behavior.
The rules exist, but they do not operate.

Collibra itself has stated that governance must move beyond passive documentation and become embedded into data workflows to sustain trust.
This is where most governance programs quietly fail. They stop at awareness and leave users stranded when it comes time to act.
The real test of governance is not whether data is documented. It is whether a user can safely build and use a data product, in real time, against live data sources without breaking trust, policy, or compliance.

European Central Bank supervisory reviews repeatedly show that governance failures surface during usage and reporting, not during definition or documentation.
The Theory Versus Reality of Data Governance
In Theory: The Ideal Journey
That is the moment governance is supposed to show up. In theory, the typical user journey should look like this:
A user has a business question or decision to support. They assemble the required data sources. Policies and controls are evaluated automatically. Access, masking, and constraints are enforced at runtime. A data product is created, shared, and reused with confidence.
Secure by default. Context aware. Governed as it runs.

The Federal Reserve has emphasized that governance controls must operate continuously, particularly as data feeds automated and AI driven decision systems.
In Reality: The Fragmented Process
What most organizations call governance today forces users through a fragmented, stop-start process.
A user discovers a dataset in a catalog. They submit an access request. They wait for approval. They are granted logical access, but not physical access. They move to another system to request credentials or roles. They ask a central team to build a pipeline or dataset. They wait again.
Eventually, something is delivered.
By the time the data arrives, the original question has often changed. This is not because people are slow or incompetent. It is because governance is decoupled from execution.

Deloitte and McKinsey both note that disconnected governance processes create delays, risk, and lost business value.
Governance Theatre
This is not governance, it is governance theatre.
The environment has changed faster than governance models have evolved.
The Facade
Impressive Policies & Documents
Complex Frameworks & Processes
Compliance Checklists & Audits
The Reality
Lack of Real-time Control
Delayed Responses & Bottlenecks
Manual & Fragmented Processes
The Fragmented Governance Journey
Data governance, in many organizations, creates a disjointed and frustrating experience for users. This often results in critical delays and missed opportunities.
This stop-start process wastes valuable time and diminishes trust in the data system. The original business need often evolves before the data can even be put to use.
Why AI Amplifies the Governance Gap
The rise of AI and automation has made this problem urgent. AI systems do not wait for approval workflows. They do not read policy documents. They consume data at scale, in real time, and make decisions based on what they are given.

Gartner has warned that AI systems amplify governance failures because they operate at machine speed, not human review speed.
If governance is not embedded in the data itself, if it does not operate at the moment data is accessed, combined, or used, then AI will inherit every gap, every ambiguity, and every unresolved risk in your governance model.

The European Central Bank has stated that AI driven systems require governance to be automated, continuous, and context aware, not manual and retrospective.
This is not a theoretical concern. Organizations are already discovering that their governance frameworks, built for human led analytics, break down completely when applied to automated systems.
AI does not ask permission. It uses what it can reach. If governance is not in the data, it is not in the AI.
The Shift from Descriptive to Active Governance
This is why governance must evolve. The next generation of governance is not about creating better documentation. It is about embedding governance into the data itself, so that policies operate at the moment data is used.

Forrester has described this shift as moving from governance as a reference layer to governance as an execution layer.
This is the shift from descriptive governance to active governance.
This is where active governance flips the model entirely.
Descriptive Governance:
  • Documents what data is
  • Defines policies in text
  • Relies on users to interpret and comply
  • Operates outside the data flow
  • Reactive and retrospective
Active Governance:
  • Controls how data is used
  • Executes policies in real time
  • Enforces rules automatically at runtime
  • Embedded in the data flow
  • Proactive and continuous

McKinsey has noted that organizations achieving data driven transformation embed governance into workflows rather than treating it as a separate compliance function.
What Active Governance Looks Like
Active governance means that when a user accesses data, policies are evaluated in real time. When datasets are combined, compatibility and compliance are checked automatically. When a data product is created, governance constraints are applied at runtime, not after the fact. When data is shared, controls travel with the data, not in a separate document.

Gartner has stated that active governance requires policy enforcement to be automated, context aware, and embedded in data platforms themselves.
This is governance that operates, not governance that observes.

The Institute of International Finance has emphasized that financial institutions must move toward continuous, automated governance to meet regulatory expectations for data quality and lineage.
It does not replace catalogs, glossaries, or ownership models. It builds on them. But it goes further. It takes the intent captured in those artifacts and makes it executable.
Diagram illustrating the Active Governance process flow.
Why This Matters Now
Organizations are under pressure to move faster. Business users expect self service access to data. Analytics teams are being asked to deliver insights in days, not months. AI initiatives are being launched at scale.

Deloitte has observed that the velocity of data consumption is increasing faster than governance processes can adapt using traditional models.
At the same time, regulatory expectations are rising. Regulators are no longer satisfied with governance on paper. They expect organizations to demonstrate that governance is operating, that controls are enforced, and that data is being used in ways that align with policy and regulatory intent.

The European Central Bank and the Federal Reserve have both increased scrutiny on how banks govern data used in risk reporting, stress testing, and AI driven decision systems.
The gap between these two forces, speed and control, is widening. Traditional governance cannot close it. Active governance can.
The Widening Gap
The chasm between business demands for speed and regulatory requirements for control is growing. Traditional governance struggles to keep pace, while active governance provides a vital bridge.
Governance Must Operate at Runtime
The fundamental insight is
governance must operate at the moment data is used.
Not before. Not after.
At runtime.
This is not about adding more rules. It is about making rules executable. It is not about slowing down data access. It is not about making safe access faster. It is not about replacing governance teams. It is about giving them tools that scale.

Forrester has stated that the future of governance is not more documentation, but more automation.
Active governance is the only model that can sustain trust, compliance, and velocity at the same time.
TRADITIONAL GOVERNANCE
Diagram of Traditional Governance showing a separate data flow and rules.
Rules exist separately from data flow.
ACTIVE GOVERNANCE
Diagram of Active Governance showing rules integrated into the data flow.
Rules execute within data flow.
Conclusion
Knowing that data exists is not governance. Documenting policies is not governance. Governance is what happens when data is used.
If your governance model cannot answer the question, "Can I safely use this data for this purpose, right now?", then it is not governing. It is documenting.
The organizations that will succeed in the next decade are not the ones with the most complete catalogs. They are the ones where governance operates in real time, embedded in the data itself, enforcing policy at the moment it matters.
Active governance is not about more rules. It is about rules that run.
Join a Data Conversation.
Cameron Price.
References
This article draws on research, regulatory guidance, and industry commentary from the following sources:
  • Gartner: Research on data governance maturity, analytics leadership, AI governance frameworks, and the evolution from descriptive to active governance models.
  • BARC: Research on data governance effectiveness, analytics trust barriers, and the gap between governance documentation and operational confidence.
  • McKinsey & Company: Research on data foundations for AI, execution gaps in governance programs, and the failure pattern where governance frameworks exist but break down at the moment of data consumption.
  • Deloitte: Publications on governance frameworks, operational enforcement challenges, and the velocity gap between data consumption and traditional governance processes.
  • Monte Carlo: State of Data Reliability research documenting ongoing data incidents despite documented governance controls.
  • Collibra: Thought leadership on active data governance, governance in motion, and the shift from governance as a reference layer to governance as an execution layer.
  • IDC: Research on decentralized data environments, domain-owned data architectures, and governance challenges in distributed systems.
  • Forrester: Analysis of governance automation, policy enforcement at runtime, and the future of governance as an execution layer rather than documentation.
  • Basel Committee on Banking Supervision: Regulatory guidance including BCBS 239 on risk data aggregation and reporting, emphasizing the need for automated, continuous governance.
  • European Central Bank: Supervisory findings on data governance weaknesses in financial institutions, particularly regarding data used in risk reporting, stress testing, and AI driven decision systems.
  • Federal Reserve: Guidance on model risk management, AI governance, and the requirement for continuous control operation in automated decision systems.
  • Institute of International Finance: Research on regulatory data management challenges and the need for continuous, automated governance in financial services.
  • Mike Ferguson: Industry commentary on governance execution challenges and the gap between governance theory and practice.