Editor’s note: Originally published in June 2018 and refreshed in November 2026. The core argument hasn’t changed, but the stakes have.
A lot is written about the important role the CDO has in promoting, monetizing and leveraging data. There is no doubt this is a primary function, and failing to fulfill it can cost an organization revenue, competitiveness and market position. But the CDO has an equally important role in governing data, and neglecting that half of the role can lead to similarly negative outcomes.
When I first wrote this, I made a provocative statement: the data leverage market was charging ahead while the data governance disciplines were not keeping up. Eight years later, AI has pulled the two ends of that rubber band even further apart. The risks aren’t only that data is lost or breached, but that it is misused, relied on when it shouldn’t be, or never delivers its full value. The CDO plays a key role in managing that tension, and done well, it lets the organization move faster, not slower.
Let’s talk about the data
The volume keeps growing. In 2018, one estimate put the world’s data at 44 zettabytes by 2020. IDC now expects more than 274 zettabytes to be generated in 2026 alone, and most of it unstructured. Generative AI is accelerating that growth: AI models consume data, and they create more of it, in prompts, outputs, training sets and logs.
So how is it being managed?
The CDO role has gone mainstream. In 2018, fewer than one in five large companies had named a CDO. Today, around 90% of leading companies report having one, and Gartner found that 70% of chief data and analytics officers now hold primary responsibility for their organization’s AI strategy.
Frameworks have matured too, from data management standards to privacy frameworks and, more recently, AI governance standards and regulation. But they remain fragmented. Data, privacy, security and AI governance often sit with different leaders (the CDO, CPO, CISO and now the Chief AI Officer), with different priorities and limited integration. The question I raised in 2018 still stands: how can an organization position data as a key asset while also ensuring proper and proportional protection, if no one owns the whole picture?
Protection should still be proportional to data’s value, its risks and threats, and the organization’s compliance obligations. What has changed is that AI adds new dimensions: how data is used to train and run models, whether outputs are accurate and fair, and whether individuals can exercise their rights over data that now flows into systems no one fully maps.
What can go wrong?
The pattern is the same, only faster. Data is breached, questionable data is over-relied on, or momentum builds to leverage data, and now AI, without proportional governance. An event occurs, or worse, goes undetected until outsiders raise the alarm, resulting in financial and reputational damage and regulatory intervention. The headlines still lead to the same questions: “How could this have happened?” and “You should have seen that coming.”
Is it avoidable?
Black swan events are, by definition, unanticipated. But organizations can take significant steps to anticipate, avoid or prepare for them by embracing information management and governance. A data event, whether a breach or a perceived abuse of data or AI, affects not only the organization but everyone around it.
Data leverage and data governance remain opposing forces pulling at either end of the rubber band. The tension needs to be released in a controlled way, and the CDO, working closely with privacy, security and AI leaders, is well placed to do it:
- Balance opportunity with governance. The CDO needs to be empowered to pursue value while ensuring protection, quality and accuracy.
- Govern data and AI together. AI governance built on weak data governance inherits its weaknesses.
- Close the gaps between roles. Whether through a combined CDO and CPO mandate or tight collaboration, someone has to see the whole picture.
We are living in a world where data is everywhere and AI multiplies what can be done with it. Forward-looking companies are looking to their CDOs to help, and those CDOs need to be properly enabled. In 2018 I said now is the time to engage. In 2026, it’s past time.
