You cannot govern, secure, or automate what you have not found. Discovery and classification are the unglamorous first moves that make every later data or AI investment defensible.
Start with the inventory, not the platform
Most organizations begin a data programme by choosing a tool. The result is a well-licensed platform pointed at an unknown estate. Before a single pipeline is built, you need a defensible inventory: where data lives, who owns it, what it describes, and how sensitive it is.
Discovery is not a one-off audit. It is a repeatable capability — scheduled scans across file shares, databases, SaaS applications, and unmanaged endpoints, with results feeding a living register rather than a slide.
Classify against decisions, not adjectives
Classification schemes fail when their labels mean nothing operationally. "Confidential" only earns its place if it changes who can access the data, how long it is retained, and what happens when it moves. Tie every tier to a control you actually enforce.
Four to five tiers is usually enough. More than that and the scheme becomes a judgment call, and judgment calls do not scale across thousands of assets.
Make ownership explicit
Every material data asset needs a named business owner accountable for its accuracy, access, and lifecycle — not an IT custodian by default. Ownership is what converts a catalogue into governance.
Publish the register. Visibility of who owns what does more to improve data quality than most quality tooling.
Then, and only then, automate
With a live inventory, an enforced classification scheme, and named owners, AI and analytics stop being risky. Retrieval can be scoped to approved sources, access can be proven to an auditor, and models can be trained on data whose provenance is known.
This is the difference between an AI pilot that stalls at legal review and one that reaches production.
- Inventory before platform — tooling cannot fix an unknown estate
- Every classification tier must map to an enforced control
- Named business owners, published openly, beat quality tooling
- Governed data is the precondition for production AI, not a follow-up task
