Forrester’s dual recognition of Collibra and what it signals

At a glance

What this is: This is Collibra’s analysis of its dual Forrester recognition in data governance and AI governance, with the key finding that enterprises are moving toward a unified governance model across both domains.

Why it matters: IAM, data, and AI governance teams need to understand this convergence because policy, catalog, and oversight decisions are increasingly being made as one programme rather than separate controls.

By the numbers:

• Forrester evaluated 10 AI governance solution providers across 19 criteria in its 2025 Wave analysis.

Context

AI governance is no longer a separate conversation from data governance. As organisations operationalise more AI use cases, the same questions keep reappearing: which assets are approved, which policies apply, and how evidence is kept current across both data and AI workflows.

This post is about governance convergence, not product differentiation. Collibra’s article uses Forrester’s dual recognition to argue that enterprises are consolidating data control, AI policy management, and oversight into a single operating model, which changes how teams think about ownership, evidence, and accountability.

For IAM, IGA, and data governance leaders, the practical question is whether current operating models can still support one set of controls across data assets and AI assets without creating gaps between review, policy enforcement, and monitoring.

Key questions

Q: How should teams govern AI assets and data together without creating duplicate controls?

A: Build a single governance inventory that links datasets, models, policies, and approvals, then reuse governance artefacts only when ownership, versioning, and review evidence remain intact. The goal is not consolidation for its own sake. It is to avoid two parallel governance planes that cannot prove the same control outcome.

Q: Why does an AI asset catalogue matter for governance?

A: Because it is where policy status, lineage, approved inputs, and monitoring evidence become usable in operational decisions. If the catalogue is incomplete, teams cannot prove what an AI system used, whether it was approved, or how exceptions were handled. In practice, weak metadata turns governance into paperwork instead of control.

Q: Why do data governance and AI governance need to be connected?

A: Because AI systems depend on data quality, data location and data access, so weak data governance creates blind spots in both model risk and privacy exposure. When organisations cannot see what data exists or who can reach it, they cannot credibly explain or assure AI-supported outcomes. Data governance becomes the control plane for trustworthy AI.

Q: How should security leaders govern AI use in cybersecurity without increasing privacy and compliance risk?

A: Security leaders should treat AI as a governed capability, not a standalone tool. Start with clear data boundaries, strict access control, and lifecycle rules for collection, use, retention, and disposal. Then require monitoring for model drift, bias, and false outputs. The goal is to improve detection and response while preserving privacy, accountability, and auditability across the entire security program.

Technical breakdown

Why unified governance models are replacing separate data and AI controls

Data governance and AI governance are converging because AI systems depend on governed data, and governance teams need consistent lineage, policy, and accountability across both. A separate control plane for AI often duplicates cataloging, approval, and monitoring work without solving the underlying problem of control consistency. The practical mechanism is shared governance artifacts, where approved assets, policies, and usage evidence are mapped once and reused across domains. That reduces friction, but it also raises the bar for metadata quality and policy orchestration.

Practical implication: Practitioners should treat shared governance artifacts as a control architecture, not a reporting convenience.

What AI asset cataloging changes for governance workflows

An AI asset catalog is not just an inventory. It becomes the point where model lineage, approved datasets, policy status, and evidence of use all intersect. When cataloging is weak, teams cannot reliably tell whether an AI system is using approved inputs or whether policy exceptions are propagating into production workflows. That makes the catalog a governance dependency, not a documentation feature. In practice, the quality of catalog metadata determines whether AI oversight can be operationalised at all.

Practical implication: Teams should validate that AI asset catalog entries are complete enough to support policy enforcement and audit evidence.

How governance reuse affects compliance and operating model design

The article’s central signal is that governance reuse is becoming an operating model requirement. If data governance artefacts can be mapped into AI governance, then ownership structures, review cadence, and policy exceptions can no longer sit in separate silos. This is especially important where chief data officers or similar governance owners are being asked to cover both domains. The challenge is not just tooling overlap, but decision rights: who approves, who monitors, and who certifies the control state when the same asset supports both analytics and AI.

Practical implication: Security and governance leaders should align approval, monitoring, and certification roles before expanding AI governance scope.

NHI Mgmt Group analysis

Governance convergence is now an operating model issue, not a tooling preference. When data governance and AI governance are managed separately, organisations duplicate policy logic and create inconsistent evidence paths. The article shows that enterprises are increasingly expecting one governance model to cover both data assets and AI assets, which means control ownership and review cadence must be unified. Practitioners should treat convergence as a governance design problem, not a product selection exercise.

AI asset catalogues are becoming the control surface for governance decisions. Collibra’s article points to cataloguing, policy management, and observability as the core of AI governance evaluation. That matters because a catalogue only works if it can carry lineage, approval state, and usage evidence into operational decisions. The implication is that AI governance fails when metadata is too shallow to support enforcement, audit, or exception handling.

Shared governance artefacts create a new kind of dependency across data and AI teams. Once approved assets, policy mappings, and compliance evidence are reused across domains, weak ownership becomes visible immediately. This is the point where governance maturity is tested: not by how many policies exist, but by whether they remain consistent when reused across adjacent control domains. Teams should expect their data governance decisions to be interrogated by AI oversight demands.

Chief data officers are emerging as de facto coordinators of AI governance, which reshapes accountability. The article reflects a market where AI governance is being pulled into existing data leadership structures rather than built as a standalone function. That can accelerate adoption, but it also concentrates responsibility without automatically resolving risk ownership. Practitioners need explicit decision rights for policy approval, monitoring, and escalation before that convergence becomes a governance bottleneck.

Unified governance will expose whether organisations can certify trust across both data and AI lifecycles. The pressure point is not whether controls exist, but whether they can be reused without weakening assurance. As AI and data governance merge, teams will need evidence that the same control model can survive changes in asset type, policy scope, and operational ownership. The practical conclusion is simple: governance integration must be measurable, not assumed.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Risk Board Briefing

What this signals

Governance convergence changes the control model. When data and AI governance reuse the same artefacts, the programme stops being a set of parallel reviews and becomes a single trust fabric. That raises the value of consistent metadata, exception handling, and ownership across asset classes.

Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap shows how fast governance intent can outrun operating model maturity when AI expands into production workflows.

AI governance policy needs to be tied to real artefacts, not aspirations. If catalogues, approvals, and monitoring data cannot be reused across governance domains, teams will keep discovering gaps only after AI systems are already in use. The control question is whether evidence can move with the asset.

For practitioners

• Define a shared governance operating model Map which decisions are common across data governance and AI governance, then assign one accountable owner for policy, exception handling, and evidence quality.
• Audit the AI asset catalogue Check whether each AI asset record includes approved inputs, lineage, policy status, and monitoring evidence needed for operational decisions.
• Align review and certification cadence Make sure governance reviews, compliance checks, and exception renewals happen on a schedule that covers both datasets and AI use cases.
• Clarify decision rights before expanding scope Document who can approve, monitor, and revoke governance exceptions when one control model is being reused across multiple asset types.

Key takeaways

• Data governance and AI governance are converging into a single operating challenge, and separate control paths create avoidable gaps.
• The article’s significance is operational, not promotional: governance reuse only works when policy, lineage, and evidence remain consistent across asset types.
• Security and governance teams should align ownership, catalog quality, and review cadence before expanding AI governance scope.

Key terms

• AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
• Data Governance Framework: A data governance framework is the rule set that defines how data is owned, accessed, protected, and retired. It turns policy into operating practice by assigning responsibilities, controls, and review mechanisms across teams and systems.
• AI Asset Inventory: A living register of every AI-related asset in an organisation, including models, agents, datasets, notebooks, endpoints, and embedded AI services. It links technical detail to ownership, data exposure, lifecycle status, and controls so governance can operate on facts rather than assumptions.
• Governance Operating Model: A governance operating model defines who approves, who reviews and who is accountable across a process. For AI, it must connect legal, data, security and engineering responsibilities into one decision path rather than leaving each team to manage a partial slice of control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.