Data Questions to Ask Before Funding Your Next AI Initiative

Investment committees and executive sponsors increasingly approve AI projects with a value case that ignores the data risk. When these projects produce incidents, the post-mortem usually surfaces the same finding: data-level questions were not asked before funding.

Key Takeaways

• Close to seven in ten breached organizations lack governance policies for managing AI or spotting unapproved use (IBM Cost of a Data Breach Report 2026, 600+ organizations), up from the 63% that had no AI governance policy or were still developing one in the 2025 edition (n=600 breached organizations)
• 92% of the organizations that reported an AI security incident were missing role-based access, multifactor authentication and similar controls on their AI models and applications (IBM Cost of a Data Breach Report 2026), down from 97% in the 2025 edition
• 53% of surveyed IT and business decision makers say their organisation has encountered a critical cybersecurity issue or incident during an M&A deal that put the deal in jeopardy (Forescout, The Role of Cybersecurity in M&A Diligence, June 2019, n=2,779). That is a share of respondents, not a share of deals
• Read the other way, only about three in ten breached organizations have governance policies for managing AI or spotting unapproved use (IBM Cost of a Data Breach Report 2026, 600+ organizations); the equivalent complement in the 2025 edition was 37%

Do We Know Where the Sensitive Data AI Will Touch Lives?

This is the first question, and the answer is either yes, with a document to show, or no. There is no third option. If the project team cannot produce a data map or lineage diagram for the data their AI use case will process, the project is being approved without the information required to assess it. For how data discovery is the prerequisite for any AI deployment, this question is Step 0.

The follow-on question for management is: what is our plan to produce this before integration. If the plan is "during implementation," the funding decision has been made without evidence.

Which AI Use Cases Intersect with Regulated or Client Data?

Every AI project in a regulated industry (financial services, healthcare, telecommunications, energy) needs a direct answer. For any use case that touches regulated data, four sub-questions apply:

If any of these cannot be answered before funding, the project's timeline needs to include the work to answer them, and the committee should budget for it explicitly rather than assume it disappears into implementation. For how four EU frameworks converge on these data obligations, the regulatory mapping is increasingly complex.

What Contractual and Regulatory Exposures Do We Create If Agents Misbehave?

AI agents take actions. Some of those actions, when they go wrong, will produce contractual liability. A sales agent that sends messages to customers is operating under the company's brand and commitments. A procurement agent that places orders is entering contracts. A support agent that answers questions is making factual claims the customer may rely on.

The committee question is not whether these things will go wrong. They will. The question is what the exposure looks like when they do. Specifically: what is the maximum contractual liability per incident, what is the regulatory exposure under consumer protection or financial services rules, what is the reputational exposure, and what is the insurance position. For how deal teams should evaluate these same risks in acquisition targets, the questions apply with equal force to internal AI investments.

If the answer is "we have not thought about this," the project should not be funded until it has been.

What the Committee Does With the Answers

The goal is not to block AI investment. It is to fund AI investment with the same rigor applied to any capital allocation decision. A project with clear data, regulatory, and contractual answers is ready to be funded. A project without them is a request to approve a plan, not a decision.

Applied consistently, this discipline produces a portfolio of AI investments where the committee can tell the board, quarter over quarter, what the aggregate exposure is. That is the artifact the board should be asking for.

The AI Investment Committee Checklist includes the regulatory exposure matrix by industry and the data-readiness scoring template.