When businesses audit their AI, they most often find a data problem

The AI audit has quietly turned into a data audit

When businesses audit their Artificial Intelligence (AI) systems, often it isn’t the problem with their AI models or governance frameworks that raises red flags, but the quality of the underlying data.

This trend is confirmed by the recent Ernst & Young LLP (EY US) AI Risks and Governance survey. The study, published in 2026, asked over 200 senior AI decision-makers at US-based companies with annual revenues exceeding $1 billion how they govern AI.

The findings show that 98% of the businesses interviewed that run an annual formal AI assurance review encountered significant AI-related challenges, with data quality problems topping the list:

• 57% reported data quality issues,
• 48% discovered model drift
• 39% identified some forms of shadow AI.

But these data quality issues aren’t limited to major businesses with substantial resources, deep knowledge, and robust governance frameworks. In fact, similar problems may extend to medium-sized businesses that haven’t evaluated their AI systems.

In this article, we explore why AI governance discussions often focus on models, ethics and acceptable use policies, while AI audit outcomes reveal that bad data is the most critical issue. Additionally, you will discover what you should implement before any AI system reaches the review stage.

Data is where AI most often breaks down, not models or policy. Here is why

Your AI system’s effectiveness is fundamentally tied to the quality of the data it is built upon. Here are four key reasons why data often appears as the weakest link in AI systems.

1. Inherited poor data quality. AI systems reflect the condition of the data they are fed. For instance, if you feed your AI systems duplicate customer records or outdated pricing tables, those flaws will inevitably extend to the AI outputs. Imagine a manufacturing business using outdated supplier data to train its inventory management AI-based tool. The system may overestimate stock levels, leading to unnecessary production hiccups.
2. Amplified errors. When AI encounters inconsistent definitions across departments or unlabelled sensitive information, it replicates these issues with confidence that can mislead users. For example, a healthcare provider uses an AI tool to analyse patient data. If one department defines low-risk cases differently than another, the AI tool might misclassify patients, leading to incorrect treatment prioritisation and dissatisfaction.
3. Model drift. AI models can perform poorly if changes in data go unnoticed due to a lack of ongoing monitoring. For instance, a retailer’s AI recommendation engine may suggest products that no longer align with customers’ preferences because the underlying customer data wasn’t updated regularly enough.
4. Shadow AI. Ranked as the fourth most widespread problem, shadow AI can lead to the loss of sensitive data from your business’s controlled environments. To give you an idea, when your employees use their personal AI software (e.g., an unauthorised AI chatbot) for processing customer data, they put your business at risk of data leaks without your knowledge.

That’s why a staggering 72% of senior AI executives polled by EY expressed deep concern over their inability to trace data lineage and inputs for their critical AI decision models.

They understand that if you cannot fully explain what data your AI was fed and trained on, you cannot effectively govern or trust its insights. That’s why any AI governance strategy that prioritises models over data is bound to fail.

Finding the problem after deployment can cost you dearly

Once an AI system is integrated into workflows and becomes essential for both your staff and customers, discovering data issues can significantly impact your business’s operations.

The findings from EY underscore the level of disruption and consequences of a post-deployment assurance review:

• 64% of businesses that conducted such reviews had to make significant changes to at least 25% of their AI systems.
• 29% of the respondents reported pausing a quarter or more of their AI tools.
• 25% of the leaders interviewed had to stop at least a quarter of their systems entirely.

But these are just a few of the direct consequences of investing time and money in frameworks built on shaky foundations.

• 36% of respondents faced AI incidents or failures with significant material negative impacts, including data loss, financial damage, operational disruptions, brand damage and loss of customer trust.
• 47% of businesses admitted to bypassing AI governance processes during urgent deployments, indicating a dangerous trend where speed overshadows comprehensive data quality checks.

Post-deployment assurance review’s impact: a practical example

Consider a financial services business that deployed a faulty AI-driven fraud detection system that flagged genuine transactions as fraudulent. The tool caused significant customer dissatisfaction.

After identifying the issue during a review, the business will have to spend considerable time and money to fix the flawed system.

The solution: run data checks from the start

To avoid wasting resources, run comprehensive data checks from the start. Although the purpose of assurance reviews is to identify issues that need remediation actions, by conducting these data checks before the system goes live, you turn these reviews into an effective validation process.

By adopting this proactive stance, businesses can avoid costly rebuilds and ensure that the system’s integrity is solid from the very beginning.

3 essential foundations to implement before your AI system reaches review

Before rolling out any AI system, establish the three foundational data elements below. These essential components will help you identify and mitigate potential issues early on, ensure effectiveness, and reduce compliance risks and reputational damage.

1. Data Ownership

Each dataset should have a designated business owner in addition to the team that hosts it. The owner is responsible for the dataset’s accuracy, permissible uses and eventual retirement.

For example, if your business operates in the healthcare industry, appoint a Health Information Officer to own and regularly review the accuracy of patient information and its compliance with data protection laws such as the General Data Protection Regulation (GDPR).

Verify your data ownership

As a leader, check that the business owner of the data:

• Has clear documentation of ownership for every dataset.
• Runs regular checks on the dataset to confirm its suitability for use.

Ask questions like:

• “Who owns the data behind this system?”
• “When did they last confirm it was fit for purpose?”

2. Data Lineage

Businesses must be able to trace the origin of the data and understand how it has been transformed. They also must have the capability to identify the systems that utilise the data and the decisions it supports.

For instance, if your business is a financial institution, you must maintain detailed data provenance for transaction information. Transparency and accountability are paramount to ensure compliance with financial regulations, support audits, and align with frameworks outlined in the European Union (EU) AI Act.

Verify your data lineage

Assess whether your business:

• Has comprehensive mappings of data flow from source to end-use.
• Maintains easily retrievable documentation for any challenge regarding the data origin or usage.

Pose questions like:

• “Can we trace the journey of this data from collection to application?”
• “What documentation is in place to validate data transformations?”

3. Quality Thresholds

The business should establish clearly defined, measurable standards for data completeness, accuracy, consistency and timeliness that must be met before utilisation, alongside a protocol for addressing shortcomings. Data accuracy is crucial for compliance with regulations such as the UK GDPR.

For example, if you sell products or services online, implement rigorous quality checks to ensure product data is accurate and up to date. This will help you reduce return rates and improve customer satisfaction.

Verify your quality thresholds

Check if your processes:

• Include specific numerical benchmarks for data quality.
• Encompass an established remediation process when data does not meet the defined standards.

Raise questions like:

• “What are the current quality thresholds for our datasets?
• “What steps do we take if data quality falls below acceptable levels?”

By addressing data ownership, lineage and quality before deploying an AI model, you strengthen your systems and operational effectiveness while fulfilling your compliance obligations.

For instance, the accuracy principle in the UK GDPR requires that data is accurate and up to date. Similarly, the EU AI Act imposes rigorous data governance requirements for high-risk systems, further highlighting the importance of these foundational elements in mitigating regulatory risk.

Transition from an annual review to continuous assurance

Given the dynamic nature of data, an annual check is bound to uncover issues post-implementation, often long after they have influenced your critical business decisions.

So, if your business still relies on yearly reviews as its main control mechanism, keep those assessments as safety nets. Then, transition to a more frequent, proactive approach: continuous assurance.

This shift is crucial for effective data governance.

How can you set up continuous assurance?

To implement a robust framework of continuous data assurance:

• Deploy automated data quality monitoring tools. Implement state-of-the-art automated systems that continuously check data quality against clearly predefined thresholds. This will help you spot issues before they escalate.
• Adopt real-time alerts. Establish alerts for when data inputs drift from expected patterns. This early warning system allows for timely interventions and reduces risks.
• Ensure you have ongoing visibility. Monitor the AI tools your employees are using. Understand what data they share and where, and ensure the information aligns with your business’s established security protocols. This helps you prevent data leaks and increase compliance.

Stay on top of the tools used by your staff and on data security with Acora.

As underscored in EY’s survey, keeping up with which AI tools your employees are using and whether they are utilising them securely enough to avoid data leaks can be extremely challenging.

• 69% of businesses have already recognised their lack of internal expertise in evolving AI governance controls.
• 63% have cited difficulties in designing and implementing such controls.

Furthermore, the same survey discovered that businesses leveraging agentic AI face additional unique challenges:

• 49% reported that their AI governance frameworks had not been updated to address these new risks.
• 26% are unable to detect unauthorised AI agents operating internally, increasing the danger of potential data misuse.

In this complex context, data integrity becomes paramount, especially as agents operate autonomously and with minimal human oversight. That’s why, Acora’s managed data and AI services help customers stay vigilant about their user activity and data security.

High-quality data is essential for maintaining effective AI governance and protecting business interests. By embracing continuous assurance, you will stay ahead of the curve, guaranteeing the security and integrity of your data in real-time.

Build AI on solid foundations that pass reviews

The AI audit has evolved into a comprehensive data audit, emphasising the need for robust data readiness before deployment. Businesses that prioritise data readiness as a preliminary step rather than a remediation action post-review can deploy AI solutions faster, minimise system pauses and cut remediation costs.

By placing data readiness at the forefront, they can ensure smoother transitions and greater transparency.
This is where Acora steps in as your trusted partner. We specialise in helping businesses lay down these foundational elements before AI systems go live, paving the way for successful implementations.

This includes:

• Evaluating data readiness,
• Establishing clear data ownership,
• Mapping out data lineage
• Defining quality thresholds to provide leaders like you with continuous visibility into your AI operations and data flows.

So, next time you go to your leadership meeting, ask the following critical question: “If our AI systems underwent a review tomorrow, would we be able to clearly demonstrate where their data originated, who is responsible for it, and whether its quality meets established standards?”

If you and your team are unsure how to answer, address these foundational elements as a priority. Contact Acora today to ensure the future stability and integrity of your AI initiatives.