Catalog / Data Readiness for AI / PREP-004

Data ownership & stewardship roles for AI-relevant data

Name a responsible owner and steward for every data set and document collection that AI assistants read, so content approval, error fixing and questions about meaning have a human answer.

Quick win: proven, manageable effort, first results within weeks, low regulatory risk.

Parts needed to run it yourselfAgents & automation

An AI assistant is only as reliable as the documents and tables behind it, and nobody fixes a wrong price list if nobody owns it. This use case is mostly organisational: assign a named data owner (accountable) and data steward (hands-on) to each source an AI uses, record them in a simple register, and give them a small review rhythm. The AI part is optional and helpful: assistants can draft the register from the inventory and chase overdue reviews.

Problem & value

  • In most SMBs, "the data" belongs to everybody, so it belongs to nobody: outdated price lists, three versions of a process manual, a Teams site whose creator left in 2022. Humans work around this; an AI assistant (Copilot, Gemini, a RAG chatbot) repeats it confidently.
  • Typical failure: an employee reports a wrong answer and nobody knows who may correct the source, who approves the fix, or who explains what a column such as "Umsatz" really means.
  • Value: faster error fixing, fewer wrong answers, a clear contact for the DPO and IT, and a prerequisite for rollouts such as PREP-023. I have no verified quantitative benchmark for this; measure your own baseline (see KPIs).
  • Microsoft itself builds on this idea: in Purview, governance domain owners and data stewards are distinct roles, and Microsoft recommends at least two domain owners so a departure does not leave a gap [1].

Variants

  • SMB (10-250 staff): one-page register in Excel/SharePoint list; owners are department heads, stewards are power users or assistants.
  • Enterprise: domains (finance, HR, sales) with domain owners, Purview or a catalogue tool, quarterly attestations.
  • Developer / platform team: ownership as code (CODEOWNERS, owner field in the data catalogue) for datasets and prompt/knowledge repositories.
  • Public sector: register aligned with existing Verzeichnis von Verarbeitungstätigkeiten and Aktenplan; staff council involved early.
  • Private: not relevant.

How it works

  1. inventory (PREP-001)
  2. pick AI-relevant sources
  3. assign owner / steward / deputy
  4. role agreement
  5. register + review calendar
  6. alerts on stale content
  7. feedback loop from assistant errors (PREP-017)
  • Owner: accountable for content, approves who may access and use it (with IT), decides on retention. Steward: keeps content current, answers meaning questions, triages error reports. Custodian (IT): technical operation only.
  • Human-in-the-loop points: management signs off the role model; owners approve content for AI use; stewards decide on corrections. AI only drafts and reminds.
  • Optional AI: an LLM proposes owners from site activity and document authors; Copilot/Gemini summarises the review backlog. Humans confirm every assignment.

Data preparation

  • Source: the inventory from PREP-001 and Excel shadow systems from PREP-003; SharePoint/Teams sites, file shares, DMS (e.g. Paperless-ngx, DATEV Dokumentenablage), ERP master data.
  • Typical gaps: orphaned sites (owner left), sites with a single owner, shared mailboxes without responsible person, Excel files owned by one person, no definition of key terms (PREP-012).
  • Steps and effort (SMB): export the site/group owner list from M365 admin centre or Google Admin console (1-2 h); filter to AI-relevant sources (2-4 h); workshop with department heads (half a day); fill register and deputy column (1 day). Total roughly 3-5 person-days for 200 staff.

Implementation paths

Which path for whom

  • smb: A - owner policies and attestation exist in tools you already pay for; a register in Excel or SharePoint Lists is enough.
  • enterprise: A - Purview Unified Catalog or an existing catalogue; commodity function.
  • developer: C - open-source catalogues with owner fields.
  • public: C - self-hosted or sovereign-cloud catalogue; avoids procurement hurdles.

Path A - Buy (off-the-shelf)

  • Microsoft 365: SharePoint Advanced Management offers site ownership policies and, for inactive sites, owner attestation on whether the site is still needed [2]. Entra access reviews and Microsoft Purview Unified Catalog (domain owner, data steward, data product owner roles) [1]. Google Workspace: shared-drive manager role and Admin console reports.
  • Lightweight: SharePoint List or Excel register, Power Automate reminders (EU data boundary applies for EU tenants).
  • EU-hosted catalogue options: Collibra, Atlan and Alation are enterprise-priced; for SMBs a list is usually enough.

Path B - Build on cloud APIs

Rarely needed. If you want automation: n8n or Power Automate calls Microsoft Graph for site owners, asks an EU-region LLM (e.g. Azure OpenAI in an EU region, Mistral La Plateforme - EU-hosted) to draft the owner proposal, and sends tasks to the department head.

Path C - Self-host (open source)

  • OpenMetadata or DataHub (owner, steward, glossary fields), Nextcloud with group folders and a responsible person per folder, n8n for reminders, Paperless-ngx with owner/permission fields. Runs on a small VM (HW0/HW1); no GPU needed. Operations: about 0.5 day per month.

Path D - Custom training

Not applicable.

State of the art (2026)

  • Catalogues now ship owner/steward concepts, glossary, data quality and AI-readiness views (Purview Unified Catalog, DataHub, OpenMetadata). SharePoint tooling is explicitly tied to Copilot readiness: site-owner reviews, lifecycle policies and restricted discovery [2].
  • Limits: tools only enforce what people agree on. Failure modes: owners named but never acting, stewards without time allocation, registers that decay within months. Naming and availability of restriction features in SharePoint have changed repeatedly - check the current Microsoft Learn page before relying on a feature [2].

Shared resources & combinations

  • Shares the register with PREP-001/003 (inventory), PREP-012 (glossary owned by stewards), PREP-013 and PREP-017 (knowledge base and review cycles), PREP-023 (oversharing clean-up needs an owner per site), PREP-024/025 (classification and legal basis decided by owner with DPO).
  • Technical access governance stays in SEC-020; AI system governance in SEC-022.
  • Same Power Automate/n8n workflow engine as other back-office automations.

Effort, cost & KPIs

  • Path A: 3-5 person-days setup for an SMB, then about 1-2 h per owner per quarter. Licences usually already owned; Microsoft states SharePoint Advanced Management is included with a Microsoft Copilot licence (verify your licence).
  • Path B: add 2-3 days for a Graph + LLM workflow.
  • Path C: 3-6 days for a catalogue install and rollout.
  • KPIs: share of AI-relevant sources with named owner and steward (target 100 %); sources with a review in the last 6-12 months; median time to fix a reported wrong answer; orphaned sites count.

People & change

Involve early: management (mandate and time allocation), department heads as owners, power users as stewards, IT as custodian, DPO for personal-data sources, HR for role descriptions and workload (GUIDE-008).

Works council (only where one is elected): depends. Owner and steward assignments are role duties, not monitoring. However, attestation reports and activity-based reminders can log who reviewed what and when, which may make the system objectively suited to monitor behaviour under §87(1) no. 6 BetrVG. §90(1) no. 3 requires timely information when work processes are planned with AI; the BAG treats objective suitability as sufficient for §87(1) no. 6, and §80(3) counts an AI expert as necessary. A short works agreement helps; public bodies involve the Personalrat (GUIDE-004).

Data protection: no DPIA usually needed for the register itself (Art. 35 GDPR becomes likely for systematic evaluation of people, special categories or new technology at scale); DPO involvement where owners decide on personal-data sources; AVV (Art. 28 GDPR) with any hosted catalogue vendor (GUIDE-005, GUIDE-010).

AI literacy: under Art. 4 AI Act (as amended, since 27 Jul 2026), providers and deployers must take measures to support the development of staff's AI literacy (no guaranteed level); train owners and stewards briefly on how assistants use their content and how errors surface (GUIDE-006).

Communication and pilot: pick one department with a real assistant pain point (e.g. sales price lists), name owner and steward, run one review cycle, then roll out (GUIDE-009). Typical concern: "more work with no extra time" - allocate explicit hours (e.g. 2 h per month) and give deputies.

Humans in control: AI proposes, humans assign and approve.

Risks, regulation & compliance

  • EU AI Act: minimal risk. Clear data ownership supports the data governance expectations that apply to high-risk systems (Annex III duties apply from 2 Dec 2027 under the Digital Omnibus, Regulation (EU) 2026/1744), if you ever build one (GUIDE-014).
  • GDPR: owner/steward names are employee personal data - keep the register internal, minimal and tied to function roles. Accountability (Art. 5(2)) is easier with documented responsibility.
  • Risks and mitigations: role without mandate (management sign-off), single points of failure (deputy for each role), bureaucracy (cover only AI-relevant sources first), shadow AI use of unowned data (GUIDE-007).

Getting started

  1. Take the AI-relevant sources from PREP-001 (start with the top 10) and export current site/group owners.
  2. Define owner, steward, deputy in a one-page role description; have management sign it.
  3. Run a 2-hour workshop per department to assign names and a review interval (quarterly).
  4. Set up a SharePoint List or Excel register plus an automated reminder; turn on owner attestation for inactive sites if you use SharePoint Advanced Management.
  5. After one review cycle, check the KPIs and extend to the next sources.

Sources

  1. Microsoft Learn - Roles and permissions in Microsoft Purview data governance - https://learn.microsoft.com/purview/data-governance-roles-permissions
  2. Microsoft Learn - Get ready for Copilot with SharePoint Advanced Management - https://learn.microsoft.com/sharepoint/get-ready-copilot-sharepoint-advanced-management
  3. Microsoft Learn - SharePoint Advanced Management overview - https://learn.microsoft.com/sharepoint/advanced-management
  4. OpenMetadata documentation - https://docs.open-metadata.org/
  5. DataHub project - https://datahubproject.io/
  6. Regulation (EU) 2024/1689 (AI Act) - https://eur-lex.europa.eu/eli/reg/2024/1689/oj