Many boards are funding an AI strategy. Almost none of them are funding a metadata strategy, and the order matters. A model trained, fine-tuned, or prompted against your enterprise data inherits the structure, the gaps, the duplication, and the quiet contradictions sitting underneath. If you do not know what your data is, your AI does not know either. And it will sound confident about it.
The work the NHS spent a decade doing for a reason
In 2022 I drafted a metadata strategy for what was then NHS Digital. The organisation held thousands of national datasets accumulated over decades of organic growth, with bespoke pipelines, inconsistent schemas, and a Capability Maturity Model score of one out of five. The strategy set out six stages of maturity: a centralised schema repository, mapping and normalisation across synonymous data elements, reference and processing metadata, derivations and lineage, operational dissemination, and finally unstructured data.
Each stage existed because the previous one had been skipped at some point and the bill arrived later. PATIENT_NUMBER and P_NUMBER and NHS_NUMBER all referred to the same thing across different collections, except when they did not. Business rules were written into pipelines instead of catalogued. The same dataset was extracted twice because nobody had a single catalogue describing what was held. The 2021 National Audit Office figure for the cost of poor data quality across the NHS was around £1bn a year.
None of this is a technology story. It is a governance story dressed up as one.
What changes when you put AI on top
I have spent the last few months building two production AI products as the developer, not the sponsor. One synthesises Housing Ombudsman case determinations for housing providers. The other is a tenant-facing rights companion grounded in version-controlled legislation. Both rely on a generative model. Neither product works without the metadata layer underneath.
The model is the cheap part. The work is in the schema, the lineage, the provenance of every source, the version of the legislation a clause was retrieved from, and the audit trail letting a user trace an answer back to a determination published on a specific date. When a tenant asks whether their landlord is breaching Awaab's Law, the answer is only useful if I know which version of which statutory instrument the response was grounded in, and on what date. Take the metadata away and you have a chatbot with a confidence problem.
This is the part most boards have not yet understood. A retrieval-augmented generation pipeline is a metadata pipeline with a language model bolted on the end. A fine-tuned model is a metadata problem stored as weights. An agentic system making decisions on your behalf is a lineage problem waiting to surface in an audit.
The audit you will face is not the one you are preparing for
The C-suite question is not whether AI will be regulated. It will be. The question is what your evidence looks like when the regulator, the auditor, the FOI officer, or the litigation partner asks how an output was produced.
If you cannot answer the questions a metadata strategy answers, you cannot answer the questions an AI auditor will ask. Where did this data come from. Who is the senior responsible owner. What is the legal basis for processing.
Which version of which schema produced this output. What business rules were applied, in what order, with what parameters. Was the source still in date when the model used it. Has it changed since.
Those are not novel questions. They are the questions a mature data governance function has been answering about reports and analytics for years. AI does not introduce them. It surfaces them, in public, at speed, and at scale.
The boards that have moved fastest on AI in the last two years are the ones already mature on data governance. They had the catalogue, the lineage, and a clear answer on where their personal data sat and on what legal basis. The AI conversation was an extension of work already done. The boards moving slowest are the ones starting both conversations from a standing start, and trying to hide the second one inside the first.
What to ask before you sign the next AI invoice
Three questions worth putting to whoever is bringing AI proposals to your board.
First, where does the data come from, and do we have a single catalogue describing it. Not a list of systems. A catalogue of datasets, with schema, owners, legal basis, retention rules, and known quality issues. If the answer is no, the AI proposal is funding the wrong problem first.
Second, when this AI produces an output, is the lineage of the output traceable end to end, including the version of every source it drew on. If the answer is no, you have built a system which cannot be audited. This is not an AI risk. It is a governance failure with an AI accelerant.
Third, who in the organisation is accountable for the metadata layer. If nobody is, the AI investment is sitting on borrowed time. Every system ever scaled inside a regulated environment did so because someone owned the boring layer underneath. AI is not the exception. It is the most expensive demonstration yet of the rule.
The unglamorous work is the work. Boards funding it before the model save themselves the second invoice.