AI data governance is the system of policies, controls and records that makes the data behind an AI system traceable, quality-assured and defensible under audit. For high-risk AI in the EU, it becomes statutory on 2 December 2027: Article 10 of the EU AI Act requires documented governance of training, validation and testing data - explicitly including annotation and labeling. Effective AI data governance produces evidence at the moment data is touched, not reconstructed afterwards.
Four layers: provenance (where data came from, under what rights and lawful basis), preparation (how it was cleaned, annotated, enriched - by whom, under which guidelines), quality (measured accuracy and agreement, examined for bias per cohort), and custody (who accessed what, when, with tamper-resistant records). Most organizations govern the first layer and improvise the rest - which is precisely where audits fail.
EU AI Act Article 10 makes data governance a legal obligation for high-risk systems from 2 December 2027, naming "annotation, labeling, cleaning" as governed operations. HIPAA audit-trail rules, SOC 2 change-management criteria and ISO/IEC 42001 Annex A.6 ask overlapping questions. India’s DPDP Act extends the accountability chain to every processor from 13 November 2026 - the nearest deadline. The union of these demands defines the working governance baseline.
Data governance programs typically stop at the warehouse: cataloged sources, access controls, lineage into the lake. The annotation stage - where humans and models decide what each record means - usually runs on ungoverned tooling: no versioned guidelines, no per-cohort agreement measurement, no annotator identity records. The stage that most directly shapes model behavior carries the least evidence.
Governed annotation means: versioned ontologies and guidelines; role separation between annotator, verifier and auditor enforced by configuration; inter-annotator agreement scored per cohort against a contracted threshold (above 0.90 for evidence-grade work); immutable logging of every action; and per-dataset evidence export. Each element maps to a specific Article 10 clause - governance you can hand to a regulator, not a policy PDF.
Buyers have started asking annotation vendors governance questions directly: Which guideline version applied to this record? Who labeled it, with what credentials? What was kappa on the geriatric cohort? Can we have the audit log? Vendors built for throughput answer with process claims. Governance-built vendors answer with exports. The difference is visible in one demo.
Agreement between two annotators, corrected for the agreement expected by chance. κ = 1 is perfect; κ = 0 is no better than chance. Regulated annotation QA contracts above 0.90.
Read More
How consistently independent annotators label the same data. High IAA evidences that labels reflect a shared, documented standard rather than individual opinion.
Read More
Reliability for any number of annotators, tolerant of missing data, across nominal, ordinal, interval and ratio labels - the general case where kappa handles exactly two.
Read More
The policies, controls and records that make an AI system’s data traceable, quality-assured and defensible - spanning provenance, preparation (including annotation), measured quality, and custody.
For high-risk AI systems in the EU, yes - EU AI Act Article 10 makes documented data governance statutory from 2 December 2027. Sectoral regimes (HIPAA, DPDP from 13 November 2026) and frameworks (SOC 2, ISO/IEC 42001, NIST AI RMF) impose overlapping requirements.
Article 10 names annotation and labeling explicitly: guidelines must be versioned, processes controlled and role-separated, quality measured per cohort, and records kept in exportable, tamper-resistant form.
AI governance covers the whole system lifecycle, risk management, human oversight, and transparency. Data governance is its foundation layer: without defensible data records, downstream governance claims about model behavior have nothing to stand on.
Neither term implies the other is optional. A model can have excellent risk management documentation and still fail an audit if the training data behind it lacks a defensible governance record; the reverse rarely happens, since strong data governance tends to surface gaps in broader AI governance rather than mask them.
LabelFort provides IAA scores per cohort, audit trails for every action, & evidence exports aligned with EU AI Act Articles 10 & 12. You can review these features on your own data in an evidence-grade proof of concept.
Certifications & readiness
