Introduction to AI Data Governance: Building the Data Quality Foundation for Manufacturing AI

You rolled out AI, but the floor will not use it. Trace the reason back and the stumble is almost always at the front door. No one is sure which drawing is the latest, the cost estimate lives in a veteran's head, and every department writes part numbers its own way. Load internal data onto AI in that state and what comes back is old dimensions and duplicated part information. AI output can never rise above the quality of the data behind it. This is the classic Garbage In, Garbage Out problem: poor data yields poor results. This article lays out the data governance that forms the foundation of AI adoption, at a level of detail that design and sales staff in manufacturing can read as their own concern.

What you will learn in this article

• What data governance is (and how it differs from data management)
• Why 2026 is the year this can no longer wait (the latest survey data and the Governed AI trend)
• The six dimensions for measuring data quality (with concrete examples from drawings, part numbers, and BOMs)
• The governance questions unique to the RAG and GraphRAG era
• The four steps to build a framework (in a manufacturing context)
• The 2026 regulatory landscape (Japan's AI Promotion Act and AI Business Operator Guidelines, the EU AI Act, and ISO/IEC 42001)
• Common misconceptions, and answers to frequently asked questions

What is data governance?

Data governance is the practice of deciding, within an organization, how data may be collected, how it should be managed, and how it may be used, along with the rules and lines of responsibility that go with it. Think of it as the work of putting into writing who owns the latest revision of a given drawing, and how far a partner supplier's quote data may be shared.

A closely related term is data management. This is the execution side: the day-to-day work of actually preparing and operating data in line with the rules. Governance is the higher-level concept that sets the policy, and management is the practical work that runs it daily. The roles are divided. A policy that no one operates is a pie in the sky, and operation with no policy leaves each part of the floor doing things differently. The two are two wheels of the same cart.

Why this foundation matters so much for AI is simple. Say you want to hand a veteran's drawing search over to AI. You want it to instantly pull up similar past drawings and draft a quote from them. But if the source drawing folder mixes old and new revisions, AI will happily pull the dimensions of a discontinued part. That is not a failure of the AI's intelligence; it is a problem with the data you gave it. This is exactly why the order matters: get the data in shape before you bring in AI.

Why data governance can no longer wait

Three currents lie behind this.

The first is the movement of investment. According to "CDO Insights 2026," published by Informatica in January 2026, 86% of Japanese enterprises plan to increase their data management investment in 2026. The leading investment areas were strengthening data privacy and security (39%), improving data and AI governance (33%), and enhancing employee data literacy (33%). At the same time, 43% of Japan's data leaders cited "data reliability" as a barrier to production AI deployment, and 71% said their own governance has not kept pace with employees' AI adoption. The tension of rising investment while the floor cannot keep up shows up directly in the numbers.

The second is the spread of a design philosophy known as Governed AI. It is the idea of running AI agents on top of controlled internal data without letting confidential data leave the organization. In June 2026, a run of partnerships between major data platforms and AI vendors, led by Snowflake and Anthropic, was announced. Snowflake began a private preview of Claude Sonnet 5 on Cortex AI. The questions being asked here are operational ones: can you record the provenance of data, do you keep audit logs of operations, and can you control access according to permissions? We have entered an era in which AI adoption and data governance are spoken of as one and the same.

The third is regulation. In Japan, the AI Promotion Act came into full force in September 2025, and because the EU AI Act carries extraterritorial reach, Japanese companies are not unaffected. We lay out the details later, but the way data is handled is now being questioned from the regulatory side as well.

The six dimensions that make up data quality

The quality of the data you put on AI can be measured from six angles. Rather than a B2C customer list, the examples here are drawn from manufacturing drawings and BOMs.

Dimension	Meaning	A common breakdown in drawings and part numbers
Accuracy	Does the content match reality?	A dimension changed at revision, but drawings with the old dimension are still in circulation
Completeness	Are all the required fields present?	A drawing has no metadata such as part number, material, or revision number
Consistency	Is the data free of contradictions across systems?	The part-number notation for the same part differs between PDM and ERP
Timeliness	Is it kept in its latest state?	Old revisions remain in the folder after a revision, and no one can tell which drawing is the latest
Uniqueness	Are there no duplicates of the same thing?	The same part is registered twice under multiple part numbers or records
Validity	Does it follow the defined rules?	Material codes and thread standards are written differently from department to department

These six dimensions are intertwined. A timeliness problem, where revision history is not managed, turns directly into an accuracy problem where no one knows which copy is correct. A validity problem, such as inconsistent part-number notation, breeds a uniqueness problem where reconciliation fails and duplicates remain. And missing metadata directly lowers the accuracy of the GraphRAG drawing search described below. It looks like a mundane matter, but we believe this is where it is decided whether AI becomes usable at all.

For the flow of converting drawing PDFs into CAD data and automating everything through quoting and cost calculation, see our guide on how to convert drawing PDFs to DXF and automate quoting and cost calculation. Read together, it becomes clear how data quality ultimately shapes the final output.

The governance questions unique to the AI era

On top of traditional data management, new questions arise once you assume the data will be put on AI. Especially in configurations where AI searches internal data through RAG or GraphRAG, the following five points become the crux. The mechanics of RAG and GraphRAG themselves are explained in Introduction to RAG, knowledge graphs, and GraphRAG.

The first is data provenance, or lineage. Keep things in a state where you can trace which drawing and which revision an AI answer was based on. An AI answer you cannot trace back to a source drawing is unusable on a manufacturing floor.

The second is the AI inheritance of permissions. You need a design in which an AI answer does not leap over the access rights of the source data, where, say, only certain staff may view a drawing meant for a particular partner supplier. A state where asking the AI lets you see a drawing you should not be able to see is the same as an information leak.

The third is managing input data. The prompts employees throw at AI can end up carrying unreleased new-product drawings or deal terms. Decide the rules for what may be handed to AI, and make them known.

The fourth is human verification of output. Keep a step where a person checks a draft quote or technical document produced by AI before it goes out to the customer as is.

The fifth is hallucination control. Curb the risk of AI confidently answering with a nonexistent part or an incorrect tolerance by requiring cited evidence and explicit confidence levels. The Governed AI philosophy is precisely about building these five into operations.

Four steps to build a data governance framework

Step 1: Take inventory of your data assets

First, identify what exists where inside the company. Where do drawings, specifications, meeting minutes, and internal rules lie dormant, whether in a dedicated PDM or PLM, a shared file server, PDFs scanned from paper, or personal PCs? On a manufacturing floor, it is normal for things to be scattered far more than you would expect. In the inventory, organize the data type, storage location, responsible owner, update frequency, and sensitivity level into a register. At this stage you often come face to face with the reality that no one can say for certain where the latest drawing is, and that becomes the starting point.

Step 2: Decide your data policies

Based on the inventory results, decide the rules for handling data. A classification policy that separates data by sensitivity level, an access policy that defines who may access which drawings, a retention policy that sets storage periods and disposal, and a quality policy that unifies how part numbers and revision numbers are written. The quality policy in particular has the effect of pulling out inconsistent notation and duplicates by the root.

Step 3: Put the governing structure in place

Data governance is not the IT department's job alone. You need a structure in which design, manufacturing, procurement, and legal are linked across functions. Even if you cannot create a dedicated organization, defining the minimum roles keeps operations running. There are three: the data owner who holds ultimate responsibility for each data domain (often a manager in the design department), the data steward who takes charge of day-to-day quality maintenance, and the driver who advances policy updates and education across the company.

Step 4: Monitor continuously

The key is not to treat it as done once decided. Regularly measure metrics such as the duplication rate and the proportion of old revisions mixed in, and run a mechanism that fixes what has broken down. If you gradually record the basis for a veteran's cost estimates as metadata, you can move the skills transfer that tends to be lost to retirement into the data itself. It takes time, but this is what works best.

Responding to the 2026 regulatory landscape

Regulation is easier to organize if you hold it in three layers: Japan, overseas, and international standards.

In Japan, the law with the formal name "Act on the Promotion of Research, Development, and Utilization of Artificial Intelligence-Related Technologies," commonly known as the AI Promotion Act, was enacted on May 28, 2025, and came into full force on September 1 of the same year. It is a law that provides for setting up the national AI Strategy Headquarters and formulating a basic plan, but it is innovation-promoting soft law with no penalties, a law of principles, so to speak. It is important not to misread this as "hard regulation has begun." The practical core lies instead in the AI Business Operator Guidelines formulated by the Ministry of Economy, Trade and Industry and the Ministry of Internal Affairs and Communications. They are operated as a living document that keeps updating, from version 1.0 in April 2024 through version 1.1 and on to version 1.2 (March 31, 2026). A distinctive feature is that the responsibilities required differ across the three categories of AI developer, provider, and user. The guidelines themselves carry no penalties, but if you breach existing laws such as the Act on the Protection of Personal Information, the Unfair Competition Prevention Act, or the Foreign Exchange Act, you become subject to sanctions as before. The practical work of complying domestically is covered in detail in the practical guide to complying with Japan's AI Business Operator Guidelines.

The EU AI Act carries extraterritorial reach that broadly applies to AI used within the EU, so Japanese manufacturers who deliver products or output to the EU can fall within its scope. The Digital Omnibus that rearranged the application dates has already been enacted, as Regulation (EU) 2026/1744. It was adopted on July 8, 2026, published in the Official Journal (OJ L 2026/1744) on July 24, 2026, and entered into force on July 27, 2026. Under it, Chapter III Sections 1 to 3 apply to standalone high-risk AI such as employment and credit (Annex III, Article 6(2)) from December 2, 2027, and to product-embedded AI (Annex I, Article 6(1)) from August 2, 2028. The authorised representative in the EU (Article 22), responsibilities along the value chain (Article 25), deployer obligations (Article 26), and the fundamental rights impact assessment (Article 27) all take effect on those same dates.

What is easy to confuse here is what August 2, 2026 actually means. The general date of application of the AI Act remains August 2, 2026, but what begins on that date is not the substantive obligations for high-risk AI. What starts applying is Chapter IV (Article 50), which governs the transparency of generated content; Chapter III Section 5 (Articles 40 to 49) on harmonised standards, conformity assessment, CE marking, and registration; and Article 101, which gives the European Commission the power to fine providers of general-purpose AI models. The obligations for general-purpose AI models (Chapter V), governance (Chapter VII), and the penalty provisions in Articles 99 and 100 have applied since August 2, 2025, while the prohibited AI practices (Article 5) and AI literacy (Article 4) have applied since February 2, 2025. Reading this as "high-risk AI applies in full from August 2, 2026" is simply wrong; the practical approach is to track what moves on each date separately.

On December 2, 2026, the newly added prohibited practices begin to apply: the generation of non-consensual sexual deepfakes and of child sexual abuse material (Article 5(1)(ba) and (bb)). The newly inserted Article 111(4) also requires providers of AI that generates synthetic content and that was placed on the market before August 2, 2026 to bring it into compliance with Article 50(2) by that date. For high-risk AI already on the market, the rule has been reorganised so that it is caught only where significant changes are made to its design on or after the date Chapter III applies, meaning the reference point is tied to the Chapter III application dates (December 2, 2027 and August 2, 2028) rather than to a single fixed date. This mapping of dates is set out in detail in our breakdown of what the EU AI Act brings on August 2, 2026. Note that the data governance obligations for high-risk AI (Article 10, which requires quality and representativeness of training, validation, and test data as well as bias management) sit in Chapter III Section 2, so they apply from December 2, 2027 onward. The thinking they demand, however, is exactly what this article has been describing, so there is value in getting organized ahead of the date.

Among international standards, ISO/IEC 42001:2023, the standard for AI management systems, is rising as a point of reference. Because it sets out the backbone of a management framework covering risk management, data management, and record-keeping and monitoring, it is becoming an international yardstick for framework design. That said, EU-specific requirements under the AI Act, such as conformity assessment and technical documentation, still need to be layered on separately, so this standard alone will not satisfy them.

Regulation is still in motion. That is exactly why it is wise to keep a flexible structure that can follow change, rather than one hardened around specific provisions.

Common misconceptions and mistakes

Here are the stumbles we frequently see on the floor.

The belief that "the more data, the more of an asset" is a prime example. Data that is not in order is not an asset; it is a liability that actually lowers AI accuracy. Next most common is the expectation that "installing a tool will solve it." PDM and data catalogs are powerful, but without rules such as naming conventions and lines of responsibility, you end up merely adding high-performance shelves to a messy warehouse. The third is turning governance into the IT department's job alone. The one who can judge whether a drawing is correct is the designer, not the information-systems staff. The last is the habit of putting off latest-revision management. Push ahead with AI adoption while leaving this unattended, and you end up with an AI that pulls old revisions, and you lose the floor's trust in one shot.

Frequently asked questions

What is the difference between data governance and data management? Governance is the side that decides the policies, rules, and lines of responsibility for how data is handled. Management is the side that actually prepares and operates data in line with those rules. Think of them as two wheels of the same cart, policy and execution, where neither alone works.

Do small manufacturers need this too? Yes. The smaller floors where drawings and quotes depend on individual veterans face the greatest risk of a break at retirement, and they also tend to see a clearer payoff from getting organized. Starting from deciding latest-revision management and access rights for drawings is enough.

What should we do first before handing internal data to AI? An inventory. Establish where your drawings, specifications, and quote histories are, and which copy is the latest, before you load them. Load them while scattered and you will only get low-accuracy answers back.

How do we fix inconsistent notation in drawings and part numbers? Decide a company-wide naming convention that unifies how part numbers, material codes, and revision numbers are written, then reconcile existing data and merge duplicates. Build system-side checks into subsequent entry so inconsistent notation cannot arise, and you prevent recurrence.

Are there penalties for violating the guidelines? The AI Promotion Act and the AI Business Operator Guidelines carry no direct penalties. But if you breach existing laws such as the Act on the Protection of Personal Information or the Foreign Exchange Act, you are subject to sanctions. Because the EU AI Act carries extraterritorial reach and heavy fines, it is safer not to decide whether action is needed based on the presence of penalties alone.

Operational efficiency and ZEROCK

The data governance thinking laid out so far maps directly onto the steps for adopting drawing AI. Take inventory of scattered drawings and technical documents, get the latest revisions and permissions in order first, and then put them on AI. Keep this order, and AI becomes something genuinely usable on the floor.

TIMEWELL's ZEROCK is an AI agent built for design and sales in manufacturing. It supports converting drawing PDFs to DXF and DWG, generating 3D STEP from 2D drawings, creating quotes and calculating costs from drawings, and searching past drawings. Another aim is to turn tacit knowledge, such as a veteran's feel for cost and design judgment, into a form that can be carried forward as skills transfer through GraphRAG. Because operations run entirely on AWS domestic servers, you can keep the location of highly confidential drawing data within Japan. It is a design that lets AI work while protecting data sovereignty, exactly in line with the Governed AI philosophy.

If you want to check your own readiness first, the AI Readiness Check lets you understand where you stand. You can see the features and adoption picture for drawing AI on the ZEROCK service page. If you would like to discuss whether it fits your own drawing environment in concrete terms, feel free to reach out through an individual consultation.

Summary

Finally, here are the iron rules to take away as your next move.

• Before AI, start with an inventory of drawings and documents
• Get latest-revision management and access rights in order before AI adoption
• Unify how part numbers, materials, and revision numbers are written, and reconcile duplicates
• Even as soft law, regulation becomes a substantive requirement at the point of contracts and deals
• Getting your data in order is the shortest path to AI adoption

Data governance is unglamorous work. Even so, whether you can make AI function on the floor is very nearly decided here. It is only on top of well-ordered data that AI first becomes a real asset.

References (primary sources)

• EU AI Act Implementation Timeline
• Ministry of Economy, Trade and Industry / Ministry of Internal Affairs and Communications, "AI Business Operator Guidelines"
• e-Gov Law Search (Act on the Promotion of Research, Development, and Utilization of Artificial Intelligence-Related Technologies, the AI Promotion Act)
• Informatica Newsroom (CDO Insights 2026)
• ISO/IEC 42001:2023 (international standard for AI management systems)
• Snowflake Newsroom (partnership with Anthropic, Governed AI)