Forrester’s data governance wave signals a wider AI governance shift

At a glance

What this is: This is Collibra’s summary of Forrester’s Data Governance Solutions Wave, with the main finding that AI governance, lineage, observability, and policy modelling are now central to mature governance platforms.

Why it matters: It matters because identity and access programmes increasingly rely on data governance to define who, what, and which AI or workload can access sensitive data under policy.

Context

Data governance is no longer just a reporting layer. In practice, it has become the place where access policy, lineage, observability, and accountability meet, especially as organisations extend governance into AI use cases and data sharing decisions.

Collibra’s article uses Forrester’s Wave to argue that mature governance now needs a metadata-centric operating model, not just a catalogue of policies. That matters for IAM, because governance decisions increasingly shape access boundaries for people, workloads, and AI-enabled workflows.

The article’s core claim is that the market is treating governance as infrastructure for AI readiness. That framing is typical of the current enterprise direction rather than an isolated niche requirement.

Key questions

Q: How should security teams govern data access for AI workloads?

A: They should govern AI data access by business purpose, dataset classification, and downstream reuse, not by repository alone. If AI systems can transform or redistribute data, then the entitlement review must cover how the data will be used after access is granted. That requires tighter alignment between IAM, data governance, and AI owners.

Q: Why do lineage and observability matter for governance decisions?

A: Because policy decisions are only defensible if teams can see where data came from, how it changed, and who used it. Lineage and observability make governance operational by showing whether access boundaries still match real data movement and downstream use.

Q: What breaks when governance cannot model data reuse across AI use cases?

A: Teams lose the ability to explain how data can be shared safely, which roles inherit risk, and what downstream consumers are affected by a policy change. In practice, that creates inconsistent access decisions and weakens accountability across analytics and AI workflows.

Q: How can security and IAM teams keep governance from becoming a one-time project?

A: Treat governance as an operating model that needs monitoring, reinforcement, and periodic expansion. Set thresholds for coverage, require named ownership, and review whether teams still follow the process after the initial rollout. If the process only works when specialists are pushing it, adoption is incomplete.

Technical breakdown

Why data observability now sits inside governance

Data observability in governance means being able to see where data comes from, how it changes, who uses it, and whether controls still match reality. The article points to lineage analysis, usage monitoring, and observability as differentiators because static policy lists do not survive fast-moving analytics and AI consumption patterns. Without those signals, governance becomes declarative rather than operational, and teams cannot tell whether sensitive data is being used as intended.

Practical implication: align governance with telemetry so access decisions can be checked against actual data movement and usage.

How lineage and impact analysis change access governance

Lineage analysis traces dependencies across datasets, reports, and downstream AI use cases, while impact analysis shows what changes when a source or rule changes. In governance terms, that is what turns access control from a point decision into a mapped dependency model. The article’s emphasis on lineage acquisition and visualization reflects a broader need to understand which users, roles, and systems inherit risk when source data changes or is exposed.

Practical implication: use lineage to decide which data grants, reviews, and policy changes need escalation before they affect downstream consumers.

Why policy modelling matters for AI-ready governance

Policy modelling is the ability to express governance rules in a structured way so they can be enforced, audited, and adapted across datasets and use cases. The article links this to AI governance because model training, prompt workflows, and downstream access decisions all depend on consistent policy logic. As organisations expand data use into AI, governance has to describe not only who can access data, but also under what conditions it can be reused, shared, or observed.

Practical implication: translate governance intent into explicit policy models before AI use cases create inconsistent access decisions across teams.

NHI Mgmt Group analysis

Data governance is becoming the policy substrate for AI access decisions. The article reflects a broader market shift: governance platforms are being asked to define not just data quality and stewardship, but the conditions under which data can safely feed analytics and AI. That makes governance inseparable from identity and access design, because policy now reaches into both human use and machine consumption. Practitioners should treat governance as an enforcement layer, not a documentation exercise.

Metadata-centric governance is the only model that scales across people, workloads, and AI use cases. A platform that can model lineage, usage, and responsibility creates a usable control plane for complex enterprises. That is especially relevant where access decisions need to survive cross-platform data sharing and repeated reuse by automation. The practical conclusion is that fragmented governance tooling will not keep pace with AI-enabled data sprawl.

AI governance is forcing data governance to prove operational relevance, not just audit defensibility. The criteria highlighted in the article, including observability and policy modelling, point to a control environment that must explain how decisions are made and how they change over time. This is where governance stops being a reporting function and starts functioning as a living access model. Teams should judge governance platforms by whether they can carry policy into execution.

Forrester’s ranking signals that market expectations have moved from cataloguing data to governing its reuse. The article’s references to AI governance, data sharing, and commercialization show that governance now spans business enablement and risk control at the same time. That widens the remit for IAM, data stewardship, and security teams, because shared data is now part of the access landscape. The implication is that governance programmes must join policy, lineage, and accountability into one operating model.

Lineage visibility is becoming a prerequisite for trust in AI-supported decisions. If organisations cannot trace how data was acquired, transformed, and reused, they cannot defend the resulting AI or analytics outcome with any confidence. The article’s emphasis on lineage acquisition and visualization points to this exact pressure. Practitioners should interpret lineage as a governance dependency map, not a nice-to-have reporting feature.

What this signals

Data governance is moving closer to the enforcement layer of enterprise access, especially where AI use cases depend on reused data. That changes the job for IAM and security teams, which now need governance models that can explain not just who accessed data, but how that access propagates across downstream consumers.

Metadata-centric governance: the shift described in the article is really about making policy, lineage, and accountability machine-readable enough to support complex reuse. When governance can trace decisions across platforms and roles, it becomes a usable operating model rather than a static record of intent.

For practitioners

• Map governance controls to access decisions Identify where data governance decisions affect who can use data, which workloads can consume it, and how AI use cases inherit those permissions.
• Prioritise lineage and usage visibility Require traceability from source to downstream consumer so policy reviews can account for transformations, sharing, and reuse across platforms.
• Model policy for AI reuse explicitly Define how governed data may be observed, shared, and reused in AI workflows before those use cases expand beyond the original access model.
• Test configurability against enterprise complexity Check whether the governance model can support granular role responsibilities, audit trails, and multiple operating patterns without losing consistency.

Key takeaways

• The article shows that data governance is being recast as a control layer for AI readiness and governed reuse, not just a reporting discipline.
• Its strongest signals are lineage, observability, policy modelling, and configurable operating models that can handle complex enterprises.
• IAM and security teams should align governance with access architecture so policy decisions remain traceable as data moves into AI workflows.

Key terms

• Data Governance Framework: A data governance framework is the rule set that defines how data is owned, accessed, protected, and retired. It turns policy into operating practice by assigning responsibilities, controls, and review mechanisms across teams and systems.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Policy modelling: The structured definition of access and usage rules that determine how data may be handled. It becomes operational when policies are linked to identities, workflows, and enforcement points, allowing organisations to show that decisions were made consistently and can be reviewed later.
• Data Observability: Data observability is the practice of understanding whether data is healthy, complete, and trustworthy across systems. It combines telemetry, lineage, and operational context so teams can diagnose problems faster and trace where data changed, broke, or became unreliable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.