Why Data Foundations Are Now a Board-Level Risk, Not an IT Line Item
By Gabbi Stubbs
No serious board would approve a major strategic initiative without asking about cyber exposure. The question is now so routine that it barely registers as a question. Yet many of the same boards are approving significant AI investments with no equivalent scrutiny of the thing those investments depend on most: the state of the organisation's data.
That is a gap, and it is widening. Data debt has quietly become a strategic liability that deserves the same board-level attention as cybersecurity. Most boards have not yet been given the language to see it.
The liability nobody is reporting
Technical debt is a familiar idea: the shortcuts taken in building systems that must eventually be repaid with interest. Data debt is its less visible cousin. It is the accumulation of inconsistent definitions, duplicated records, undocumented pipelines, unclear ownership, and quality problems that everyone has learned to work around.
It rarely appears on a risk register. It does not trigger an alert. It shows up instead as a set of symptoms that leaders tend to attribute to something else: the report that three teams produce with three different numbers, the customer who receives the wrong offer twice, the analytics project that takes nine months because the first eight were spent finding and cleaning data.
Each symptom looks like an operational nuisance. Together they describe a balance sheet liability that is growing quietly, and that is being drawn upon every time the organisation tries to make a decision or automate a process.
Why data debt behaves like cyber risk
The comparison with cybersecurity is not rhetorical. The two share the characteristics that make a risk a board matter rather than a management detail.
It is invisible until it fails.
Both sit quietly in the background, and both are usually discovered through an incident rather than an inspection.
It compounds.
Every new system, acquisition, and quick fix adds to the surface area. Left alone, the cost of remediation rises, not falls.
The consequences are concentrated and public.
A flawed credit decision, a privacy breach, a restated number, or a customer communication that should never have been sent: these are the moments when data debt stops being an internal frustration and becomes a reputational, regulatory, and financial event.
Accountability is diffuse.
Cyber risk used to be "the IT team's problem" until boards recognised that it was a matter of enterprise resilience. Data sits in the same place today. It touches every function, so it belongs to none of them, and the absence of a clear owner is itself a warning sign.
Why AI raises the stakes
For years, poor data foundations were a drag on efficiency. They made reporting slow and analysis unreliable, but a human was usually there to notice that something looked wrong.
AI changes this in two ways. First, it removes the human checkpoint. A model that scores customers, drafts communications, or recommends actions does so at a speed and scale at which no one is inspecting the inputs. Second, it makes errors look credible. A model trained or grounded on flawed data does not return an error message. It returns a fluent, confident answer.
This is the uncomfortable truth behind many stalled AI programmes. The model is rarely the problem. The data it was given is. An organisation can buy the most capable technology available and still get unreliable results, because capability cannot compensate for inputs that were never fit for purpose.
For a board, this reframes the question. An AI investment is not only a bet on a technology. It is a bet on the readiness of the foundations beneath it, and that readiness is currently being assumed rather than examined.
Three questions to ask before approving the next AI investment
Boards do not need to become data engineers. They need to ask questions that reveal whether management has a grip on the issue. These three are a good place to start.
Do we know what data we have, where it lives, and who is accountable for it?
This is the equivalent of asking for an asset register. A strong answer names the critical data domains (customers, products, transactions, finances), identifies a named owner for each, and shows that definitions are agreed across the business. A weak answer refers to the data warehouse or the cloud platform. Those are places where data is stored, not evidence that it is understood.
Warning sign: Management cannot say who is accountable for the accuracy of customer data, or the answer changes depending on who is asked.
Can we trust this data for this specific use, and how do we know?
Data is not simply good or bad. It is fit or unfit for a particular purpose. Data that is adequate for a monthly management report may be wholly inadequate for an automated decision about a customer. Ask management to demonstrate, with measurement rather than assurance, that the data feeding the proposed AI use case meets the standard that use requires.
Warning sign: Quality is described in general terms ("it's pretty good") instead of being measured against the specific use case, or there is no routine measurement at all.
When this goes wrong, what happens, and can we show how a decision was made?
Every AI system will eventually produce a wrong or contested outcome. The board should know what management's response looks like. Can the organisation trace which data informed a decision? Is there a human accountable for high-impact outcomes? Is there a way to detect problems before customers or regulators do? Increasingly, regulators and courts expect organisations to explain their automated decisions, and that is impossible without lineage and governance behind the data.
Warning sign: No one can explain how an output was produced, or accountability for AI-driven decisions is unassigned.
What good looks like
The aim is not perfection. No organisation has flawless data, and demanding it would stall every initiative. What boards should look for is visibility and intent: an honest account of where the weaknesses are, a prioritised plan to address those that matter most to strategy, and a named executive who owns the outcome.
It also helps to change how the topic reaches the boardroom. Cyber risk earned its place on the agenda through regular reporting, clear metrics, and defined accountability. Data foundations can follow the same path. A short, consistent report on data quality for critical domains, progress against remediation, and readiness for planned AI use cases would give directors the visibility they already expect elsewhere.
The decision in front of boards
AI investment is accelerating, and the pressure to move quickly is real. But speed built on weak foundations is not speed. It is the accumulation of risk at a faster rate.
The organisations that will gain most from AI will not necessarily be those that spent the most. They will be those whose boards asked the unglamorous questions early, insisted on honest answers, and treated data foundations as the strategic asset and strategic risk that they are.
Before the next AI proposal is approved, ask the three questions. The quality of the answers will tell you more about the likely return than the quality of the demo.
Want a board-ready version of these questions, with a simple scorecard for management to complete? Get in touch with our team.
Want to talk strategy?
If this resonates, let's have a direct conversation about your business.