Stage 6 summary. Governance and strategy

Governance answers two questions about a data asset: who decides, and who answers for the outcome. The decisions are concrete. Which definition is authoritative when two systems disagree. Who approves access for a new purpose. What quality level is acceptable before a figure reaches a board pack. Whether a producer may make a change that breaks a downstream consumer. An organisation that cannot name the person holding each of those for a given asset does not have governance, whatever its policy library says.

Three roles make the allocation workable, and the split between them is the point rather than the titles. The owner is accountable: one named business role deciding purpose, access and acceptable quality, and answering when the asset causes harm. Stewards are responsible for meaning day to day, curating definitions, quality rules and the issue queue. Custodians run the platform and implement the controls the owner decided, which is a technical responsibility rather than an ownership claim. The test is unglamorous: for one named asset, say from records who approved its definition, who signs off access, and who owns the quality rule.

A centralised model puts pipelines, definitions and quality with one team. It produces consistency and a single place to ask, and it becomes the queue every domain waits in, which is why organisations abandon it at a certain size rather than because it was wrong.

Data mesh, set out by Zhamak Dehghani from 2019, pushes ownership outward on four principles: domain ownership of the data, data treated as a product with a consumer and a service level, a self-serve platform that makes ownership affordable, and federated computational governance. That fourth principle is the one most often dropped, and dropping it is why mesh programmes produce inconsistency rather than autonomy. It keeps the rules that must hold everywhere global and encodes them in the platform, so mesh decentralises ownership of products, not the standards they must meet.

The hybrid is where most organisations land, and it is a design rather than a failure to choose. The centre supplies standards, platform, lineage and identity so that owning a data product is affordable; the domains own their products, definitions, quality and roadmap. Choose on evidence about how many domains can genuinely own a product, where the queue forms today, and whether the centre can supply a platform rather than a service desk.

DAMA-DMBOK maps the knowledge areas of the discipline and is best used for vocabulary and scope rather than as a standard to certify against. Its current text is the 2024 revision of DAMA-DMBOK 2.0, which DAMA describes as a maintenance release improving clarity without altering the framework, so a citation to a third edition points at something that does not exist.

ISO/IEC 38505-1:2017 does what DMBOK does not, placing data inside the corporate governance frame where a governing body evaluates, directs and monitors its use. That makes data an accountability of the board rather than a task delegated to a team, and it is the standard to reach for when the argument is about who should be answering.

The artificial intelligence framing changes urgency rather than substance. ISO/IEC 42001:2023 supplies a management system for AI, and Article 10 of the EU AI Act places data governance duties on the training, validation and testing sets of high-risk systems, covering quality, provenance and bias examination. A model inherits every ambiguous definition, quality defect and unclear lawful basis in the data it learned from, at a speed no quarterly report ever exposed.

Regulation (EU) 2023/2854, the Data Act, gives the user of a connected product a right of access to the data its use generates, and a right to have the data holder pass it to a third party the user nominates. The recipient may be an independent repairer, an insurer or a competitor, with one exclusion: an undertaking designated as a gatekeeper under the Digital Markets Act is not eligible by this route.

It arrives on four dates rather than one, which is where most compliance mistakes start. It entered into force on 11 January 2024 and bound nobody to act. It became applicable on 12 September 2025, when the access duties and the matching user rights went live. From 12 September 2026 a design obligation attaches to connected products placed on the market after that date, requiring the data to be accessible by default in a structured, commonly used and machine readable form, securely and free of charge. From 12 January 2027 the switching charge rules change again. Two products in the same catalogue can therefore carry different obligations, so the record is held per product line and placement date.

Where a holder must make data available, the terms have to be fair, reasonable and non-discriminatory, and transparent. Non-discriminatory stops a holder quoting one price to an independent repair network and another to its own subsidiary. Two engineering consequences follow: the cost of serving a request has to be measurable, and one interface should serve every recipient class, because the cheapest way to prove non-discrimination is to have only one path with which to discriminate.

Regulation (EU) 2022/868, the Data Governance Act, entered into force on 23 June 2022 and has applied since 24 September 2023, and reading it as a mandate is the common error. It sets conditions for re-using protected public sector data, regulates the data intermediary, which must notify its activity, keep the service structurally separate and not use the data for its own purposes, and registers data altruism organisations. It creates no right to obtain data that national law keeps closed.

A data space is a sector-wide arrangement to share under common rules and infrastructure, covering health, energy, mobility, finance and agriculture, and the geometry that matters is that each sector draws on one shared interoperability core of identity and trust, vocabularies, access rules and audit. Health became law: Regulation (EU) 2025/327 on the European Health Data Space was adopted on 11 February 2025 and entered into force on 26 March 2025, separating primary use for care from secondary use served by permitted access rather than copies, with cross-border exchange of the first priority categories from March 2029.

The United Kingdom took a different route. The Data (Use and Access) Act 2025 gives ministers a power to require a business to pass customer data, at that customer's request, to an authorised third party, with each smart data scheme made sector by sector. Open Banking shows what a scheme needs beyond a duty to share: an authorisation model, a register of authorised third parties, common interfaces and a dispute route. A horizontal access right is scheduled by date; a scheme-making power by political priority.

The Open Definition 2.1 holds that data is open if anyone is free to use, modify and share it for any purpose, and three dimensions must hold at once. Legally open means a licence actually grants those permissions, since posting a file leaves copyright in place. Technically open means a format processable without proprietary software, so a table trapped in a PDF is legally open and technically closed. Practically open means discoverable and described. Shared data is narrower, being access for named parties under agreed terms, and FAIR is a different promise, about reuse rather than permission.

The FAIR principles, published by Wilkinson and colleagues in Scientific Data in 2016, each bind to concrete metadata. Findable needs a globally unique persistent identifier and indexed metadata. Accessible needs that identifier to resolve over a standardised, open protocol, with metadata reachable even where the data is restricted, so it is about mechanism rather than price. Interoperable needs shared vocabularies and qualified references. Reusable needs provenance, a clear licence and domain standards, and it fails most often because it costs somebody the time to describe their data to a stranger.

DCAT 3 became a W3C Recommendation on 22 August 2024 and describes datasets, services and distributions so catalogues can interoperate, adding dataset series, versioning properties and checksums. It stops at catalogue metadata, so ownership, support, quality rules and change policy still come from local governance and a data contract. In the United Kingdom the public infrastructure is mid-programme: data.gov.uk has been recast as the National Data Library, whose January 2026 progress update records a completed discovery phase, over 100 million pounds allocated, five pilots, and more detail promised in spring 2026.

The Data Management Capability Assessment Model from the EDM Council is the common instrument for asking how capable an organisation is, and DCAM v3 was announced in June 2025 with stronger coverage of artificial intelligence, cloud and governance. Its components run from data strategy and the business case through architecture, business data knowledge, quality management, governance and operations to analytics management. What makes an assessment worth running is the evidence standard: a named owner, approved definitions, lineage to the reports that use the data, quality rules, access and retention policy, and usage metrics.

Value is argued along three routes. Direct value sells data or a data product, and it needs the legal work first, because lawful basis, purpose limitation and the sharing agreement decide whether the revenue survives scrutiny. Indirect value changes the quality, timing or economics of internal decisions, and it is where most realised value sits. Risk reduction value is expected loss avoided, net of false positives and the cost of the control. The caveats are real: data is not on the balance sheet in most jurisdictions, and the income approach needs instrumentation to attribute a saving to an asset.

That is why the oil metaphor gets in the way, and it fails in three places. Oil is rival and consumed by use, whereas a dataset serves many purposes at once without depletion, so the question is reuse rather than extraction. Oil has a market price largely independent of the buyer, whereas a dataset's worth depends on the question asked of it. And data depreciates, so a record held past its purpose carries retention, breach and migration cost rather than latent optionality. The chief data officer agenda follows: name the outcome constrained by poor data, the asset that changes it, its owner, the missing control, and the measure read afterwards.