Data contracts gain urgency as AI tests data foundations

Fostering accountability among stakeholders

Jes Gonzalez, a principal consultant at ePlus, a consulting and advisory services company, said data contracts are becoming more prominent in large organizations and SMBs with strong data engineering teams.

For CDOs, data contracts align employees on how data is created and consumed. Gonzalez said they bring together the organization's key stakeholders in data quality and data management.

The key here is to delineate the roles and responsibilities of stakeholders. Balazs Fejes, president and CEO of IT consultancy EPAM Systems, said data contracts make ownership and accountability explicit, but data producers, not centralized governance groups, should bear that accountability.

As AI uses more data across domains and workflows, unclear ownership and inconsistent change controls make it difficult to find the source of errors. Data contracts aim to bridge that gap before issues affect downstream systems.

"One of the shifts we're seeing is that AI is driving organizations to be much more deliberate about how data is owned, governed and shared across the enterprise," Adya said. "Those decisions increasingly influence the operating model just as much as the underlying technology."

Supporting compliance and reducing remediation time

Lack of clear accountability isn't the only problem data contracts address. They can also help organizations demonstrate compliance with regulatory obligations governing AI use.

"A data contract becomes a method to demonstrate compliance," Gonzalez noted, citing the  EU's AI Act and ISO/IEC 42001 as examples of AI compliance frameworks. Both frameworks include data governance provisions.

Data contracts document the organization's intended controls and, when used with machine-readable metadata, provide evidence of compliance to support audits and investigations.

"It shows what happened when the data moved or changed, instead of forcing people to rebuild the story later from email, spreadsheets and guesswork," Gonzalez said. "That is what makes data contracts useful for compliance, audit support and AI governance. They turn policy into something that can be enforced and recorded in real time."

As organizations publish data products, they start collecting and absorbing a significant amount of data, Gonzalez noted. Without the proper guardrails in place, "you realize that the downstream folks are having to do a significant amount of cleanup on the data," he added.

Data contracts are one component of implementing a governance-first strategy, also described as shift-left governance or upstream governance, which applies governance and data-quality controls closer to where data is created or changed. This approach can preserve data team capacity by reducing remediation work associated with hygiene tasks, such as executive reporting and other data-driven initiatives.

"You can burn out your data team if you are not leveraging them well," Gonzalez said.

Data contracts require more than agreements

While data contracts provide benefits, they aren't a cure-all. They help with governance, but other layers may still be needed to support meaning, discipline and scale.

Contracts can define the structure, quality and delivery requirements for data, but they do not necessarily explain the business meaning, Fejes noted. A semantic layer provides the context AI agents need to make a consistent sense of the data, including shared definitions, metrics and relationships.

"Now that agents will start making decisions with minimal human interaction, the richness of the information required to support this data asset grows exponentially," Fejes said.

In addition, data contracts need the right discipline, change management and formalization, he added.

From an administrative perspective, organizations that stack multiple data contracts can add administrative and technical debt without strong standard operating procedures for managing them, Gonzalez said. That risk underscores the need for formal discipline as adoption expands.

He also pointed to executive sponsorship as important for data contracts to succeed. Organizational change or employee turnover could demote data contracts from a vital governance tool to a side project.

Executive or board-level sponsorship can help preserve funding and resolve cross-functional ownership disputes, but operational accountability should remain with the teams that produce and consume the data.

How to prioritize data contracts

Before an organization commits to data contracts, it must determine whether they address a material business or operational risk. Then, data leaders and representatives from key departments, such as finance and IT, should determine where data contracts can solve the most important organizational problems.

Gonzalez recommended starting with one or three use cases that address business risks. A confidentiality, integrity and availability (CIA) assessment can help identify sensitive and critical data, but leaders should also consider other factors, such as business impact, downstream dependencies and recovery requirements.

"It's an opportunity for you to say, these are the datasets that, if impacted, have the potential to disrupt the business from a CIA perspective," Gonzalez noted.

Protected health information or payment card data could rank among the most critical assets, depending on the stakeholders involved in the assessment.

"Everybody states what type of data is important to them," Gonzalez said. "Then you have the beginnings of an inventory for what could become a couple of solid data contracts."

John Moore is a freelance writer who has covered business and technology topics for 40 years. He focuses on enterprise IT strategy, AI adoption, data management and partner ecosystems.