Data Ownership, Stewardship and Custodianship for AI

Overview
Every AI system is, at its core, a data system. The quality, legality, security and ethical acceptability of an AI model are inherited directly from the data used to train, tune, validate and operate it. The ISACA Advanced in AI Security Management (AAISM) body of knowledge therefore places data ownership, stewardship and custodianship squarely inside the AI Governance and Program Management domain: if nobody is clearly accountable for the data feeding an AI system, no amount of technical control downstream can make the system trustworthy. This guide explains why the topic matters, what each role means, how the roles operate across the AI lifecycle, and how to recognise and answer exam questions on the subject.

Why Data Ownership, Stewardship and Custodianship Matter for AI

1. Accountability cannot be delegated to an algorithm. Regulators, auditors and courts hold people and organisations accountable, not models. When an AI system produces a biased, inaccurate or privacy-violating result, the first questions asked are: Who owned this data? Who approved its use for training? Who was responsible for its quality? Clear role assignment answers those questions before an incident occurs.

2. AI amplifies data problems. A single mislabelled record in a spreadsheet affects one row. A systematically mislabelled training set affects every prediction the model ever makes, at scale, often invisibly. Governance of data roles is the primary mechanism for catching errors, bias and contamination upstream.

3. Legal and regulatory exposure. Privacy laws (GDPR, CCPA/CPRA, and many others), the EU AI Act, sector regulations (HIPAA, GLBA, PCI DSS) and intellectual property law all presume that someone in the organisation can demonstrate lawful basis, purpose limitation, consent, retention limits and provenance for data. For AI, this extends to training data, fine-tuning data, prompts, retrieval corpora and model outputs.

4. Data is shared across many hands in AI programs. Data scientists, ML engineers, MLOps platform teams, cloud providers, third-party model vendors, annotation contractors and business units all touch the same data. Without explicit ownership, stewardship and custodianship assignments, control gaps appear at every handoff.

5. Model artefacts are data too. Trained weights, embeddings, feature stores, prompt libraries and evaluation datasets are high-value, often sensitive assets. They can leak training data (membership inference, model inversion), embody trade secrets, and be poisoned or stolen. Someone must own and protect them.

What the Roles Are

The three roles are frequently confused, and the exam tests the distinctions carefully. Think of them as decide, define/ensure and do/protect.

Data Owner
Who: Typically a senior business executive or business unit leader whose function generates or depends on the data (e.g., the VP of Customer Operations for customer records; the Chief Medical Officer for clinical data).
Accountability: Ultimately accountable for the data asset. The owner decides the business value, approves classification, authorises access, approves permitted uses (including whether the data may be used to train or fine-tune an AI model), accepts residual risk, and is answerable to regulators and executive leadership.
Key AI decisions: Is this data approved for AI training? For which purposes? May it be shared with an external model provider? What retention and deletion rules apply to it and to derived artefacts? What is the acceptable risk tolerance for bias or inaccuracy in this use case?
Remember: Ownership is about accountability and decision rights, not about possessing the servers or doing the technical work. Owners do not usually configure controls themselves.

Data Steward
Who: A subject-matter expert, often within the business or a data governance office, who works on behalf of the owner.
Responsibility: Responsible for the day-to-day quality, meaning and proper use of data. Stewards define and maintain metadata, data dictionaries, business glossaries, quality rules, lineage documentation and labelling standards. They monitor compliance with the owner's policies, resolve data quality issues, coordinate with legal/privacy on consent and lawful basis, and act as the escalation point for data definitions and fitness-for-purpose questions.
Key AI activities: Validating that a training dataset is representative and fit for the intended model purpose; documenting dataset provenance (datasheets for datasets, data cards); setting annotation and labelling quality standards; tracking whether consent covers AI use; checking for sensitive attributes and proxies that could drive bias; maintaining lineage from raw source through feature engineering to model versions.
Remember: Stewardship is about quality, meaning, standards and oversight of use. The steward does not own the data and does not operate the storage infrastructure.

Data Custodian
Who: Typically IT, infrastructure, database administration, cloud platform or MLOps teams; may also be an external cloud provider or AI vendor acting as a processor.
Responsibility: Responsible for the technical safeguarding, storage, processing, transport and availability of the data. Custodians implement the controls the owner approves and the steward specifies: access control, encryption, backup and recovery, logging and monitoring, secure deletion, environment segregation, and secure handling of model artefacts, feature stores and vector databases.
Key AI activities: Securing training pipelines and data lakes; enforcing least privilege on datasets, notebooks and model registries; protecting model weights and embeddings; ensuring secure data transfer to annotation vendors or cloud training environments; implementing retention and deletion for training snapshots; logging access to sensitive datasets and prompts.
Remember: Custodianship is about implementing and operating technical controls on behalf of the owner. Custodians do not decide classification or approve new uses of data; they execute the decisions of others.

Related Roles You Must Distinguish
Data Subject: The individual the personal data is about; holds rights (access, erasure, objection to automated decision-making) but is not an organisational role.
Data User / Consumer: Anyone who accesses and uses the data for a business purpose, including data scientists building models. Users must follow owner-approved purposes and steward-defined standards.
Data Controller and Data Processor (privacy law terms): The controller determines purposes and means (closely maps to the organisation acting through the data owner); the processor acts on the controller's instructions (often an external custodian such as a cloud or AI-as-a-service provider). Exam questions sometimes blend governance roles with privacy-law roles; keep the two vocabularies separate but aligned.
AI Model Owner / Product Owner: Accountable for the AI system or use case as a whole. The model owner may differ from the owners of the datasets used to train it, which is precisely why formal data use approval between owners is required.
Chief Data Officer / Data Governance Council: Sets the enterprise framework, policies and standards within which owners, stewards and custodians operate; arbitrates disputes over ownership of shared or derived data.

How It Works Across the AI Lifecycle

1. Framework and policy. The organisation establishes a data governance framework (often aligned to ISACA COBIT, DAMA-DMBOK, ISO/IEC 38505 or ISO/IEC 42001 for AI management systems). The framework defines the three roles, their decision rights and a RACI matrix. For AI, the policy explicitly addresses training data approval, synthetic data, third-party and web-scraped data, model artefacts and AI-generated outputs.

2. Inventory and classification. Every dataset intended for AI use is inventoried and assigned an owner. The owner approves classification (e.g., public, internal, confidential, restricted; plus personal data, special category, regulated). Classification drives which controls the custodian must apply and whether the steward must perform additional checks (e.g., consent review, de-identification).

3. Use authorisation. Before a data scientist pulls a dataset into a training pipeline, the data owner must approve the specific AI purpose. This is where purpose limitation is enforced: data collected to process orders is not automatically approved to train a marketing propensity model. Cross-domain use requires the originating owner's approval, often documented in a data sharing or data use agreement.

4. Quality, provenance and lineage. The steward ensures the dataset is documented: source, collection method, time period, known gaps, labelling process, sensitive attributes, licensing and consent status. Lineage is tracked so that any model version can be traced back to the exact data snapshot, enabling impact analysis when data is later found to be erroneous, poisoned or subject to an erasure request.

5. Technical safeguarding. The custodian secures the data at rest, in transit and in use within the ML environment; segregates development, training and production; protects feature stores, vector databases and model registries; manages secrets and keys; and logs access. For external AI services, the custodian role is shared with the vendor under contract, and the organisation must verify the vendor's controls (SOC 2, ISO 27001, ISO 42001 evidence, data processing agreements, prohibitions on using customer data to train the vendor's foundation models).

6. Derived data and model artefacts. Features, embeddings, trained weights, evaluation sets and generated outputs are new data assets. Governance must assign ownership (usually to the model or product owner, with inherited constraints from source data owners), classification and retention. A model trained on restricted data is itself a restricted asset.

7. Retention, erasure and unlearning. Owners set retention periods; stewards track them; custodians execute deletion. For AI, erasure is complicated because personal data may be embedded in model weights. Governance should decide in advance whether retraining, machine unlearning or output filtering will be the response to erasure requests, and who is accountable for executing it.

8. Monitoring and audit. Stewards monitor data quality drift and misuse; custodians monitor technical control effectiveness; owners receive reports and accept or remediate risk. Internal audit assesses whether roles are actually performed as documented, not just assigned on paper.

9. Third parties and the supply chain. When data moves to annotation vendors, cloud training services or foundation model providers, ownership does not transfer. The organisation remains accountable; the vendor becomes a custodian (processor). Contracts must specify permitted use, security requirements, breach notification, sub-processor restrictions, return/destruction and audit rights.

Common Failure Patterns (Frequently Tested)
Orphaned data: Datasets with no assigned owner are used for training by default, so nobody has approved the purpose or accepted the risk.
IT as de facto owner: Because IT stores the data, the business assumes IT owns it. IT cannot judge business value, lawful purpose or acceptable bias, so decisions go unmade.
Steward without authority: Stewards identify quality or consent problems but have no escalation path to an owner who can halt training.
Data scientists self-approving use: Convenience leads to repurposing data without owner authorisation, violating purpose limitation.
Unowned model artefacts: Weights and embeddings are copied freely between environments because no one classified them.
Assuming the cloud provider is accountable: Shared responsibility is misunderstood; the organisation forgets it remains the controller/owner.

Exam Tips: Answering Questions on Data Ownership, Stewardship and Custodianship for AI

Tip 1 – Map the verb in the question to the role. If the question asks who approves, authorises, accepts risk, classifies or is ultimately accountable, the answer is almost always the data owner. If it asks who defines quality rules, maintains metadata, documents lineage or provenance, ensures fitness for purpose or monitors compliance with data standards, think data steward. If it asks who implements, configures, encrypts, backs up, operates or technically protects, think data custodian.

Tip 2 – Accountability stays with the business, not with IT or vendors. Any option that places ultimate accountability for AI training data with the IT department, the cloud provider, the AI vendor or the data science team is usually a distractor. These parties may be responsible for tasks, but accountability for the data asset rests with the business owner, and accountability for the AI use case rests with the model or product owner.

Tip 3 – Ownership does not transfer when data is shared or outsourced. If a scenario involves sending data to an annotation vendor or a foundation model API, the correct answer will typically emphasise that the organisation remains accountable and must impose controls contractually, with the vendor acting as custodian or processor.

Tip 4 – Look for the governance answer over the technical answer in this domain. Because this topic lives in AI Governance and Program Management, when a question asks for the best or first step, options such as 'assign a data owner', 'establish a data governance framework', 'obtain owner approval for the AI use' or 'define roles and responsibilities' usually outrank purely technical fixes such as 'encrypt the dataset' or 'implement DLP'. Technical controls are necessary but follow from governance decisions.

Tip 5 – Watch for 'first', 'most important', 'primary' and 'best' qualifiers. ISACA questions often present several plausible actions. When ownership is unclear, the first step is to identify and formally assign the owner, because every subsequent decision (classification, use approval, control selection) depends on it. When ownership is already clear but data is being misused, the primary issue is usually lack of owner authorisation or purpose limitation, not a missing technical control.

Tip 6 – Distinguish governance roles from privacy-law roles. If the question uses controller/processor language, answer in those terms (controller determines purpose and means; processor acts on instructions). If it uses owner/steward/custodian language, answer in those terms. Recognise that the business owner typically acts on behalf of the controller, and external providers typically act as processors and custodians.

Tip 7 – Treat models, features and outputs as data assets. Questions may ask who should classify a trained model or who approves reuse of embeddings. Apply the same logic: the model or product owner (constrained by the source data owners) is accountable; the steward documents lineage; the custodian (MLOps/platform) protects the registry.

Tip 8 – Repurposing requires re-approval. A scenario in which data lawfully collected for one purpose is used to train a model for a different purpose is testing purpose limitation and owner authorisation. The correct response involves obtaining owner approval (and often legal/privacy review of consent or lawful basis) before training proceeds, not simply documenting the use after the fact.

Tip 9 – Stewards need authority and an escalation path. If a scenario describes a steward who found bias or consent problems but training continued anyway, the governance gap being tested is the lack of defined escalation to the owner or the lack of authority to pause the pipeline, not the steward's technical competence.

Tip 10 – Eliminate options that confuse possession with ownership. 'The team that stores the data', 'the system administrator', 'the cloud provider' and 'the data scientist who downloaded it' are classic distractors for ownership questions. Possession or technical access never equals ownership.

Tip 11 – Think RACI. Owner = Accountable (A). Steward and Custodian = Responsible (R) for their respective duties. Legal, privacy, security and the AI governance committee are often Consulted (C). Data users and model owners are Informed (I) of policies and approvals. If an answer option would make two parties accountable for the same data asset, it is likely incorrect; accountability should be singular.

Tip 12 – Read scenario questions for the actual problem, not the symptom. A model leaking personal data is a symptom; the root governance cause might be that training data was never classified (owner failure), never checked for personal data (steward failure) or never access-controlled in the feature store (custodian failure). Choose the role whose duty maps to the described gap.

Worked Examples

Example 1: A data science team wants to fine-tune a large language model using historical customer support transcripts. Who should approve the use of this data for that purpose?
Reasoning: Approving a new use is a decision right. The business executive accountable for customer support data is the data owner. Answer: the data owner of the customer support data (with privacy/legal consulted). Distractors: the head of data science (a data user), the CISO (consulted on risk, not owner of business data), the cloud provider (custodian).

Example 2: An internal review finds that the training dataset for a credit model contains inconsistent labels and undocumented source systems. Which role is primarily responsible for addressing this?
Reasoning: Quality rules, labelling standards, metadata and lineage documentation are stewardship duties. Answer: the data steward. The owner is accountable overall and must be informed, but the steward performs the remediation and documentation.

Example 3: An organisation uses an external AI platform to train models on confidential data. Which statement is MOST accurate regarding accountability?
Reasoning: Outsourcing does not transfer ownership. Answer: the organisation remains accountable as owner/controller; the provider acts as custodian/processor and must be bound contractually and verified through assurance evidence.

Example 4: An AI security manager discovers several datasets in the data lake used for model training have no identified owner. What should be done FIRST?
Reasoning: Without an owner, no classification, approval or risk acceptance is valid. Answer: identify and formally assign data owners for the datasets before further use, then proceed to classification and use authorisation. Distractors such as 'encrypt all datasets' or 'restrict access to the data lake' are useful but not first; they are custodian actions that should follow owner decisions on classification and access.

Example 5: Who should be responsible for implementing encryption and access logging on the model registry that stores trained weights derived from restricted data?
Reasoning: Implementation of technical controls is custodial. Answer: the data/platform custodian (MLOps or infrastructure team), implementing requirements set by the model owner and informed by the restricted classification inherited from the source data.

Quick Reference Summary
Owner: Accountable. Decides value, classification, permitted use (including AI training), access authorisation and risk acceptance. Senior business role. Ownership never transfers through sharing or outsourcing.
Steward: Responsible for quality, metadata, definitions, lineage/provenance, labelling standards, consent tracking, fitness for purpose and monitoring compliance with owner policy. Needs authority to escalate and pause.
Custodian: Responsible for technical protection and operation: storage, access control, encryption, backup, logging, secure deletion, pipeline and model registry security. May be internal IT/MLOps or an external provider under contract.
AI-specific extensions: Training, tuning, validation and retrieval data; prompts and outputs; features, embeddings and weights; synthetic and third-party data; erasure and unlearning; purpose limitation for repurposed data; supply chain custodianship.
Exam mindset: Governance before technology; accountability with the business; verbs reveal roles; possession is not ownership; outsourcing does not outsource accountability; assign the owner first.

Mastering these distinctions allows you to answer not only direct definitional questions but also the scenario-based items that dominate the AAISM exam, where the correct answer depends on recognising which governance role has failed and which role must act.