If You Do Not Govern Your Information, Someone Else Will Do It for You

Artificial intelligence is changing the value of information inside and outside organizations. As a result, knowledge governance, its protection, and change management are becoming increasingly strategic issues.

Years ago, while working in banking, I began to understand how important it was to have processes defined, documented, and governed. In certain environments, depending on one person knowing a procedure, an exception, or a business rule creates a risk you simply cannot afford to take. Over time, I was surprised to find that same discipline in completely different sectors, such as hospitality, where some particularly well-run restaurants had documented much of their operation. It made me realize that this was not a question of size, industry, or technology, but of organizational maturity. The knowledge a company needs to operate should not depend exclusively on the people who happen to possess it.

And yet, we have all known organizations where certain things are known only by one specific person. Processes that work because someone has spent twenty years handling the same exceptions, decisions whose criteria were never documented, or information that exists in several versions without anyone being entirely sure which one is correct. We have lived with these situations for years, sometimes even treating them as normal, but the arrival of artificial intelligence is changing the consequences of that lack of governance. It has not created a new problem; it has the ability to amplify it.

When information stops being passive

Until relatively recently, an outdated document in a repository was mainly a problem when someone consulted it and used its contents. Today, an artificial intelligence system can retrieve information from documents, emails, presentations, or knowledge bases and use it to answer questions, make recommendations, or even trigger actions within a process. Unstructured information, which we have accumulated across different systems for years, is beginning to take on an operational role it did not have before. A document is no longer simply something we store. It can become a source of context for a decision.

Imagine an organization with three documents containing different criteria for handling a particular situation. Which one should the AI use? What happens if a policy has changed but the previous version remains available? Who guarantees that the system is using current information? We may have an excellent technology architecture, but if we cannot answer these questions, it will be difficult to trust the results. Centralizing information does not mean governing it, and having thousands of documents available does not mean having a reliable source of knowledge.

This is where a concept I consider especially important appears: ownership. It is not enough for information to exist or be accessible. We need to know who is responsible for it, who validates its content, who can change it, and who guarantees that it remains correct. Technology can help us identify contradictions, organize knowledge, and make it easier to access, but responsibility for the validity of information must remain with the relevant business areas. Otherwise, we risk replacing dependence on individual knowledge with dependence on corporate information that nobody maintains or supervises.

If you do not tell your story, others will tell it for you

There is another dimension to this problem that I consider especially relevant from a strategic point of view: what happens outside our organization. More and more people are using artificial intelligence assistants to ask about products, services, companies, or commercial terms, and many of those queries no longer necessarily end with a visit to our website.

Imagine that a customer asks an assistant about the features, availability, or price of one of our products. It would be logical for the answer to be based on our official information, but what happens when that information has not been published, is difficult to interpret, is out of date, or is not accessible to the system? The model does not have to stop because our company has not provided a validated answer. If it has search capabilities, it can turn to distributors, comparison sites, old publications, forums, or any other available source. And if it cannot access reliable sources, it may even generate an apparently convincing answer from its prior knowledge.

This changes how we understand a company’s digital presence. For years, we have worked to make sure customers could find information on our website. Now we must also think about how that information will be interpreted by systems that answer questions directly about us. If our official information is not available, others may end up defining the answer about our own products or services. Not necessarily because there is malicious intent. It is enough for a third party to publish incomplete or outdated information for it to end up influencing an answer.

When disinformation is intentional

But what happens when incorrect information is not the result of a mistake, but of a deliberate action? This is a risk I believe we should pay much more attention to. Imagine that someone starts publishing false information about our products, commercial terms, or corporate policies. They can do it on apparently specialized websites, forums, comparison sites, or pages designed to look like reliable sources. If that content is eventually used by an assistant, it can influence the answers our customers receive without their query ever passing through our official channels.

In artificial intelligence, there are different ways of contaminating information. Data poisoning affects the data used to train or fine-tune models, while contamination of retrieved sources, known as RAG poisoning, can manipulate the context used to generate answers. There are also prompt injection attacks, in which external content attempts to introduce instructions that alter an assistant’s behavior. Although the mechanisms are different, they all remind us of something important: the information an AI consumes does not have to be correct, neutral, or published in good faith.

From a business perspective, this opens up a reputational and commercial risk. We cannot control everything third parties publish about our organization, but we can act to reduce our exposure. Having complete, structured, up-to-date, and accessible official information makes it easier for systems to find reliable references. Assigning owners to that information allows us to correct errors quickly and keep it consistent. And periodically monitoring what the main assistants say about our products, services, or commercial terms can help us detect contradictions, incorrect references, or possible attempts at manipulation.

In our own AI systems, we can also establish source confidence criteria, validate the origin of retrieved information, limit which content may be used for particular decisions, and maintain traceability for responses. These are not absolute guarantees, especially when we are dealing with external assistants we do not control, but they are measures that reduce risk. It is no longer enough to protect our information systems; we must also care about the integrity of the information about our company that circulates outside them.

Change management takes center stage again

All of this brings me to a discipline I believe is regaining enormous importance: change management. We can implement the best artificial intelligence tools, build corporate repositories, and design highly sophisticated information architectures, but if people continue to keep critical knowledge in personal files, private conversations, or simply in their heads, we will have solved very little. Changing this reality means changing habits, responsibilities, and ways of working that have been established for years. This is probably one of the most difficult parts of any transformation.

We also need to be careful about how we approach this change. The goal is not to make the people who hold the knowledge dispensable, but to use their experience to turn individual knowledge into a corporate asset. When we achieve this, we reduce the risks associated with absences, departures, or changes in responsibility, make it easier to onboard new professionals, and improve operational continuity. The goal is not to eliminate the people who know, but to eliminate the risk of an organization depending exclusively on them.

This effort must also translate into measurable results: less time spent looking for information, fewer errors caused by incorrect versions, less dependence on specific profiles, processes that are easier to scale, and a greater ability to provide reliable answers to employees and customers. We are not simply talking about organizing documents. We are reducing operational risks, protecting reputation, and improving the company’s ability to operate and evolve.

A shared responsibility

I believe one of the mistakes we can make is to treat information governance as a problem exclusively for the technology department. Technology can provide tools, establish controls, and facilitate traceability, but it cannot decide on its own which information represents the truth of an organization. That requires business owners, shared criteria, and decisions that must form part of the company’s strategy.

For years, we have worried that a company’s critical knowledge might exist only in the heads of certain people. Now there is an additional risk: that answers about our own organization, both inside and outside it, will be built from information that nobody governs, that we do not control, or that someone has deliberately manipulated.

Artificial intelligence has not invented these problems. It has multiplied their reach and consequences. And perhaps that is why, at a time when everyone is talking about models, agents, and automation, we should spend a little more time asking ourselves who is responsible for what our organization knows, what it publishes, and what others may eventually say about it.

Because if you do not govern your information, someone else will do it for you.