Governance programs are standard now, but many of them cost more than the problems they prevent are worth.
McKinsey research shows 30% of total enterprise time is being lost to poor data quality. Gartner expects 80% of governance programs to fail by 2027, and the cost of getting it wrong is rising fast. TheIrish Data Protection Commission's €1.2 billion GDPR fine on Meta in 2023 wasn't an outlier. It was a preview of what regulators are willing to do.
Governance and speed are often treated as opposites. That framing is wrong, and it costs organizations the speed they're trying to protect. The better framing is whether the governance most leaders have built is the kind that works at the speeds they are chasing, and for most organizations, the answer is no.
Well-designed governance covers four areas: access, quality, lineage and deployment. When all four work, teams operate within clear boundaries rather than starting every decision from scratch. The payoff is faster decisions and trust that doesn't break when regulators or executives ask hard questions.
Access
Access controls determine who can use which data and under what terms. This is where most day-to-day friction happens.
Poorly designed access treats every request the same way. Every request goes through the same review, no matter how simple it is, and the approval queue gets longer over time. The problem gets worse when a single data set has multiple owners. A request must clear each owner in turn, and what should be a one-day approval becomes a three-week chain. Marketing teams can't run experiments fast enough to learn from their campaigns, and finance teams wait weeks to add a new analyst to quarterly reporting. By the time approval comes through, the team that needed the data has moved on.
Well-designed access is mostly self-service within set rules, and ownership stays tight. Only the most critical stakeholders are listed as owners, so approval doesn't require chasing five people across three teams. Capital One does this with its "You Build, Your Data" framework, a federated model that spreads ownership across the business, while a central team enforces shared standards. Teams move fast within their lane when ownership is clear.
Quality
Quality controls catch flawed data before it reaches a dashboard, a report or a model. This is where the gap between the visible cost and the hidden one is widest.
Poorly designed quality controls assume the data is fine, letting problems show up later. A finance team finds its quarterly numbers were off two weeks before earnings. A marketing dashboard reports the wrong numbers because something changed upstream last month. The model trains on six months of bad data that nobody notices until it's in production.
Well-designed guardrails don't slow innovation. They're what let finished work ship.
Well-designed quality controls run automatically at every stage.Airbnb does this through its Midas certification process, which requires key datasets to meet defined standards for accuracy, ownership and documentation before the company trusts them. Quality badges are visible in every internal tool, so a data scientist or BI analyst can tell at a glance whether a data set is safe to build on.
Lineage
Lineage tracks where data came from and how it moved through the pipeline. It's the quietest of the four areas, and AI has raised its profile since training data provenance is now a compliance question. Outside of AI, many teams still treat lineage as optional until someone asks how a number was calculated.
Auditors and regulators need to know where a number came from, and so do executives probing a quarterly result and CFOs trying to reconcile two reports that should match but don't. InSeptember 2024, the SEC fined 12 financial firms a combined $88 million for widespread failures to preserve and produce electronic communications when regulators asked for them. Stifel, Invesco and CIBC each paid penalties of $12 million or more.
Well-designed lineage produces the answer in minutes. Brian Dummann, chief data officer and vice president of insights and technology at AstraZeneca, framed the broader principle in an October 2025 CDO Magazine interview: "We're systematically looking at where we can redefine processes to go quicker. It's about removing bottlenecks without removing accountability."
Deployment
Deployment controls decide what gets to production, and how. People often think of deployment as a model problem, but the same pattern applies to dashboards, reports and analyses that go to the board.
Poorly designed deployment treats every release as a new negotiation. Every dashboard, every report, every model waits its turn while the backlog grows. Models that should be in production get stuck in review, and dashboards the business needs sit in draft. The work is done, but it never ships.
The opposite risk is a model that scales before anyone understands its limits. Zillow's 2021 shutdown of its iBuying business shows what that costs. Once the pricing algorithm was buying thousands of homes in a volatile housing market, Zillow found it was paying more for homes than it expected to sell them for. The result was a $304 million inventory write-down and layoffs affecting 25% of Zillow's workforce.
Well-designed deployment follows a known path. Automated checks run in parallel, and teams have tested their rollback procedures. Routine releases don't restart the approval process, and monitoring catches a model or report that drifts after launch. Finished work reaches the business faster, and problems surface while they're still inexpensive to fix.
Why most programs fall short
Organizations usually build governance in response to a problem that has already caused damage, but the controls often don't align with the actual risk. A single audit causes a heavy review of everything, even low-risk work.
Controls are also often run by people rather than software because manual processes are easier to set up than automated ones. Humans end up reviewing routine decisions that don't need human judgment. This works with 20 practitioners, but it breaks with 200.
The result is a governance team that acts as a gatekeeper, measured by what it blocks rather than what it enables. The relationship with the rest of the data team becomes tense, and teams treat even good controls as obstacles to be worked around.
When teams complain that governance is slowing them down, the first reaction is usually to ask whether the controls are needed at all. That's not the right fight. Well-designed guardrails don't slow innovation. They're what let finished work ship. Data in successful organizations is often subject to strict governance, but they've made theirs fast, and that builds the trust the rest of the business depends on.
Mostafa Ibrahim is a freelance software engineer and technical writer who covers machine learning, data engineering and cloud infrastructure for AI and SaaS companies.
