Generative AI moves data in flight to models and back, creating new risk points. In a Data Science Connect webinar, ADP's Amber Eshelman and Orlando Insight Group's Henry Clavo explained how to keep sensitive data out of LLMs, build a stewardship culture and future-proof governance.
Key takeaways
- AI changes the risk points. Data in flight to and from a model needs controls that traditional governance for data at rest didn't cover, Eshelman said.
- Don't reinvent the framework. NIST, ISO and the EU AI Act give organizations a baseline to compare against and close gaps.
- Layer your protections. No-training agreements, two-way scanners, third-party model checks and developer tokenization each catch what another misses.
- Stewardship belongs to everyone who touches data. Buy-in comes from solving business teams' problems, not broad top-down messages.
- Build to the strictest rules. One global program designed around the EU AI Act and GDPR keeps teams ready for new laws.
Traditional data governance was built for structured data sitting at rest. Generative AI sends data in flight to a language model and back, and that changes where the risks are. In the Data Science Connect expert panel webinar "Building Trust in AI: Data Governance and Data Management for Generative AI," Amber Eshelman, Senior Director of Global Data Governance at ADP, and Henry Clavo, founder of Orlando Insight Group, discussed how organizations should adapt. Brian Mink, co-founder and president of Data Science Connect, moderated.
Eshelman's starting point was simple: "Define what risk for AI looks like at your organization," she said, because it differs from traditional data uses.
How is AI governance different from data governance?
Eshelman described data management as the operationalization of data governance. Governance sets the rules, policies and best practices, and data management follows them when data is collected, accessed, stored and processed.
AI adds new risk points, she said. Data now moves to a model and returns, so teams have to identify where those risk points are, put controls at each one and protect data in transit. Clavo framed governance as a framework of rules, roles and accountability, with data management covering the life cycle of the information an organization stores.
Where should organizations start with AI governance?
Clavo said to start with the intended use. Will the data feed text generation, and what will the output look like? Industry matters too, since healthcare and financial services carry their own protection requirements. It all begins, he said, with officers, data stewards and analysts working out the strategy together.
Eshelman's first recommendation was "do a lot of reading." She pointed to the NIST AI framework, ISO's AI certification and laws such as the EU AI Act, and said organizations don't have to invent a program from scratch. Compare those frameworks with your own program, find the gaps and close them.
She also recommended an AI ethics council to decide what the business considers acceptable and unacceptable risk, and to set guardrails up front.
How do you keep sensitive data out of AI training models?
An attendee asked how to protect sensitive data from being consumed by AI training. Clavo recommended keeping data inside the protected environment and using locally hosted models rather than sending sensitive information to an outside API. The key, he said, is to "make sure that your data doesn't leave the protected environment."
Eshelman was blunt. "Don't ever let any large language model use your data to train," she said, adding that providers will make that agreement and it can be enforced. She described several layers on top of that:
- Two-way scanning: custom-built or purchased scanners that strip sensitive data on the way into a model and check the response coming out
- Third-party checks: scanning outside models and data sets for security threats before they enter the environment, or isolating them in an air-gapped setup
- Developer responsibility: tokenizing or removing sensitive information in prompts before it reaches the model, then adding it back afterward
"Security is not just a one shot deal, you've got to have layered security," she said. If a threat gets past one layer, the next should catch it.
How do you build a data governance culture?
Data quality depends on tools, stewards and focus, Eshelman said. Teams need tools to set quality rules, thresholds and alerts, and trained data stewards embedded in the business. They also need to be selective about what they monitor. "If everything's important, nothing's important," she said.
To win buy-in, she advised sitting down with business teams, listening for the data problems behind their complaints and translating them into fixes. "Almost everything is a data problem if I'm being honest," she said. A single broad message from the top rarely lands, in her experience, and stewards need time from their leaders to do the work. Her view of stewardship is wide: "If you touch the data, you are a steward of that data."
Clavo said silos often come from business and technology teams working separately. He recommended bringing stakeholders from legal, compliance and marketing into the same meetings, assigning stewards to document their data, and investing in workshops and training.
How do you monitor AI systems and future-proof governance?
Eshelman said monitoring begins with a clear definition of AI. Generative AI drew the attention, but she noted that the EU AI Act covers machine learning and predictive models too. From there, organizations need an inventory of AI systems and projects, controls matched to each one, and risk tiering so low-risk use cases don't consume the same effort as high-risk ones.
Models also change. What was deployed can behave differently in three or six months, so teams should watch for drift in accuracy, toxicity and bias.
On future-proofing, Eshelman recommended a single global program built to the strictest rules, such as the EU AI Act and GDPR, then dialed back where they don't apply. That way a new state or city law doesn't force a scramble. Clavo suggested organizing systems by processes, data models and AI applications so changes can be made quickly.
Eshelman compared the moment to the early days of antivirus software, when threats felt constant until protections became routine. "You can't do AI without governance," she said. Her closing advice was to balance being "an enabler and a protector."
Continue the conversation in 2027
Data Science Connect has 24 free live webinars on its 2027 schedule across four series: the AI × Enterprise Panel Series, AI Demo Days, Agentic AI Showcases and the Plug & Play Series. See the webinar schedule for upcoming sessions. Governance leaders can also meet peers in person at The AI Enterprise Conference on Tuesday, August 31, 2027, at Pier Sixty in New York City.
Frequently asked questions
How is AI governance different from traditional data governance?
Eshelman said AI governance must cover data in transit to and from models, not just structured data at rest, and start by defining what AI risk means for the organization.
How do you keep sensitive data out of AI training models?
The panel recommended keeping data in a protected environment, refusing to let LLM providers train on your data, using two-way scanners and tokenizing sensitive fields before prompts reach a model.
How should companies future-proof AI governance?
Eshelman advised building a single global program to the strictest regulations, such as the EU AI Act and GDPR, then dialing back where rules don't apply.
Why does AI monitoring need to be ongoing?
Models can behave differently after three or six months, so teams should watch for drift in accuracy, toxicity and bias rather than set and forget.
Watch: Building Trust in AI: Data Governance and Data Management for Generative AI on YouTube
Event: Webinars · More coverage: Webinars insights
