TechNews: AI Governance at Data Governance's Turning Point from a Decade Ago; Firms Need Inventories Before Embedded Controls
The article uses the history of data governance as a mirror, noting that current AI application expansion outpaces governance readiness. Citing IDC and PwC data showing surging Asia-Pacific AI spending but lagging governance capabilities among Taiwanese firms, it recommends building a governance architecture through dynamic AI inventories, embedding controls in operational workflows, and aligning with international standards.
ImportanceLocalEvidenceE2 unreplicatedWrite-upQuick
The AI governance challenges facing enterprises today closely resemble the stage data governance went through more than a decade ago. Companies that established governance mechanisms early avoided high remediation costs, while those that ignored them spent years correcting course. Now, AI applications are expanding rapidly with higher risks, leaving enterprises less time to prepare. According to IDC's Worldwide AI and Generative AI Spending Guide, AI and generative AI spending in the Asia-Pacific region, including China and Japan, is expected to grow nearly fivefold from $73 billion in 2024 to reach approximately $365 billion by 2029, with a compound annual growth rate of 38.4%. Generative AI will account for nearly half of Asia-Pacific AI spending.
However, there is a clear gap between technology deployment and governance capability. PwC's 2026 Global and Taiwan CEO Survey indicates that 31% of Taiwanese companies report their most commonly used AI tools can access all documents and data, yet only 28% possess 'Responsible AI' and risk management-related governance capabilities, lower than the global average of 51% and the Asia-Pacific average of 54%. This means many enterprises deploy models individually without centralized review, and agentic AI may even directly use unapproved data.
The article suggests enterprises learn from data governance experience and build a governance architecture across three levels. First is inventory and registry: just as data governance requires a Data Catalog, enterprises need a continuously updated AI Inventory recording all formally operating models, agents, and pipelines, marking risk levels and owners. Second is embedding governance into AI operational workflows, such as detecting prompt injection, identifying sensitive data before output, and using sandbox environments. Third is compliance and policy management, cross-referencing governance requirements with standards like the NIST AI Risk Management Framework, the EU AI Act, and ISO 42001. Gartner notes that effective governance technologies can reduce regulatory compliance costs by 20%.