4 October 20265 min read
Starting data governance: where to begin, who you need and how long it takes
A practical route from first conversation to governance that runs itself — the stages, the roles and an honest timeline. Plus what Gartner's 2026 Magic Quadrant does and doesn't tell you about tools.
By Srini Vankeepuram · Architecture, Engineering & Data Leader
Most organisations start data governance in the wrong place: with a tool. A catalogue gets bought, a few hundred tables get scanned, and six months later nobody is using it — because nobody was ever made responsible for what the data means.
I've seen governance from three sides: running governance due-diligence workshops with financial services, professional services and retail clients as a pre-sales architect; building the data steward model behind a single customer view at Allianz UK; and leading metadata curation for payment platforms at Discover. The lesson is the same from every side: start with a business problem, not a platform.
Where to start: one question
Ask: which decision, obligation or customer outcome is going wrong because of data? A regulator's report you can't trace. Customers counted twice. An AI use case blocked because nobody trusts the training data. That answer tells you your first data domain, your sponsor and your first measure of success.
- Regulatory pressure (GDPR, KYC, PCI DSS, BCBS 239) — start with the data the regulator asks about.
- Customer experience — start with customer data: duplicates, addresses, consent.
- AI readiness — start with the data your first AI use case depends on, and who may use it.
The five stages
Governance isn't a project with an end date. But it does have stages, and each one has to earn the next.
- 01 · Weeks 0–6DiscoverFind the business problem worth solving first.
- Pain points and the data behind them
- A sponsor who owns the outcome
- Maturity baseline
- First domain chosen
- 02 · Months 1–3MobiliseSet up who decides what — before any tool.
- Charter and principles
- Governance council
- Owners and stewards named
- Success measures agreed
- 03 · Months 3–9ProveMake one domain demonstrably better.
- Critical data elements defined
- Business glossary
- Quality rules and a scorecard
- Issue and change process
- 04 · Months 9–18ScaleRepeat the pattern; now bring in tooling.
- More domains onboarded
- Catalogue and lineage
- Policies turned into controls
- Quality dashboards
- 05 · Year 2–3, then ongoingEmbedGovernance becomes how delivery works.
- Governance by design in every project
- Automated controls
- AI and data product governance
- Federated ownership
Notice where the tool appears: stage four. By then you know your owners, your definitions and your rules — so the tool automates a working process instead of becoming a very expensive spreadsheet.
The roles you need
Governance is an operating model, not a team. Most of the people in it already have day jobs; governance makes part of that job explicit. Three tiers work for most organisations.
Strategic
Sets direction, funds it and settles disputes.
- Executive sponsorOwns the business outcome and clears the way.
- Governance councilSenior data owners who approve policies and resolve conflicts.
- CDO or head of dataLeads the programme and reports progress to the board.
Tactical
Turns direction into policies, standards and priorities.
- Data ownersBusiness leaders accountable for a domain — customer, product, finance.
- Governance officeA small team running the framework, metrics and communications.
- Data architectModels, standards and lineage across systems.
- Privacy, risk and securityMake sure policies meet regulatory and security obligations.
Operational
Does the daily work that keeps data trusted.
- Business data stewardsDefine terms, set quality rules and work the review queue.
- Technical stewardsImplement controls, lineage and fixes in the platforms.
- Data quality analystsMeasure, investigate and report on quality.
- AI governance leadApplies the same rules to models and agents: sources, thresholds, oversight.
Two of these matter more than people expect. Data owners must sit in the business, not IT — if IT owns the data, the business will never own its quality. And stewards need time in their job description, not goodwill: at Allianz UK the stewards both worked the review queue and sampled what the system merged on its own, and that sampling is how we knew the rules still held.
How long it takes
- First visible value: three to six months, in one domain, if you start from a real problem.
- A working foundation — operating model, glossary, quality scorecards across the priority domains: twelve to eighteen months.
- Governance that's embedded in how projects are delivered: two to three years.
- Done: never. Like security, it's a capability you run, not a project you finish.
The fastest programmes aren't the best funded. They're the ones that pick a narrow first domain, show a measurable improvement — fewer duplicates, a report that reconciles, a model that can be approved — and use that to earn the next domain.
Tools: what Gartner's 2026 Magic Quadrant says
In January 2026, Gartner published its Magic Quadrant for Data and Analytics Governance Platforms, evaluating 15 vendors. As publicly reported, they were placed as follows.
| Quadrant | Vendors |
|---|---|
| Leaders | Alation, Atlan, Collibra, IBM, Informatica |
| Challengers | BigID, Microsoft |
| Visionaries | ServiceNow |
| Niche Players | Ab Initio, Alex Solutions, Ataccama, DataGalaxy, OvalEdge, Precisely, Solidatus |
Gartner's commentary points the same way as this article: away from static catalogues towards automated, AI-ready governance across structured and unstructured data. It expects that by 2027, 60% of governance teams will prioritise unstructured data to deliver generative AI use cases.
A quadrant measures vendors, not fit. How I'd use it:
- Start from your estate. If you're largely on Microsoft, its own governance tooling may be enough for stages two and three. If you run IT on ServiceNow, its new governance offering deserves a look.
- Start from your first problem. If it's finding and protecting sensitive data for privacy, that's a different shortlist from building an enterprise catalogue.
- Treat Niche Players seriously for specific jobs. Several are strong in data quality, lineage or regulatory reporting — I delivered GDPR and KYC solutions on Pitney Bowes Spectrum, now part of Precisely.
- Run a proof of concept on your own data, with your own stewards, before you sign. The demo is never the hard part.
Five mistakes to avoid
- Buying the tool first. Tools automate a process; they don't create one.
- Boiling the ocean. Governing every domain at once guarantees governing none of them well.
- Letting IT own it. Technology supports governance; the business owns the data.
- Policies without stewards. A policy nobody operates is a document, not a control.
- No measures. If you can't show quality improving, the funding stops — and it should.
Start with the decision that's going wrong, not the platform you'd like to buy.