Data & Information ยท DAT-02
Data ownership and stewardship
Every data set used by AI has a named accountable owner and day-to-day stewards who understand the data and look after it.
Why it matters
Decisions about whether data can be used for AI, whether it is good enough and who may see it need someone with authority to make them. Without named owners and stewards these questions go unanswered, or are answered by whoever happens to be building the system.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Ownership of data is unclear; system administrators or project teams make decisions about data by default. |
| 2 Developing | Some important data sets have named owners, but stewardship is informal and data used by AI is not consistently covered. |
| 3 Defined | Every data set used by AI has a named owner and steward, recorded centrally, with defined responsibilities for approving use, quality and access. |
| 4 Managed | Coverage of ownership and stewardship is measured, gaps are filled within a set time, and owners are held to their responsibilities through regular review. |
| 5 Optimising | Owners and stewards actively shape how their data is used for AI, and the arrangements are improved from experience of where decisions were slow or missed. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- DAT-02.1 Every data set used by AI has a named owner and a named steward.
- DAT-02.2 Owners and stewards are recorded in a central record.
- DAT-02.3 Owner and steward responsibilities for approving use, quality and access are defined.
Assessment questions
- For the data a given use of AI depends on, who is the owner and who looks after it day to day?
- What can the owner decide, and what must they be asked about before the data is used for AI?
- What happens to ownership when the owner changes role or the data set changes?
- A register of data owners and stewards covering data used by AI
- Role descriptions or terms of reference setting out owner and steward responsibilities
- Examples of owners approving or declining a use of their data
How to reach Level 3
- List every data set used by AI, starting from the AI inventory (GOV-06).
- Name an accountable owner and a day-to-day steward for each data set.
- Write down what owners and stewards are responsible for, including approving use, quality and access.
- Record owners and stewards in one central place, such as the data catalogue (DAT-04), and keep it current when people move.
Common pitfalls
- Naming a team or system as owner rather than a person.
- Giving people the title without the time or authority to do the job.
Starter artefacts
- Data owner and steward register
- Role descriptions for data owner and steward
Ownership and sequence
- Accountable
- data owner
- Contributors
- ai governance lead, business owner
- Depends on
- None
- Roadmap step
- 1
- Lifecycle
- design, acquire_build, operate, retire
Cross-references
| AI Cyber Security Code of Practice | 2.1 partial; 2.5 partial; 13.1 partial; 13.2 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Development data specification partial |
| ISO/IEC 42001 | A.7.2 partial |
| MITRE AI Maturity Model | P5.3 direct; P5.4 partial |
| UNESCO AI Maturity Framework | 6.3 partial; 6.5 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.