Why Trusted Data Is the Foundation of Enterprise AI

AI projects stall on data, not on models

Most leadership conversations about AI still start with the model: which vendor, which size, which benchmark. The evidence points somewhere else.

In February 2025 Gartner reported that 63% of organizations either do not have, or are unsure whether they have, the right data management practices for AI, based on a third-quarter 2024 survey of 248 data management leaders. In the same release it predicted that through 2026, organizations will abandon 60% of AI projects that are not supported by AI-ready data. Seven months earlier, Gartner had predicted that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, naming poor data quality first among four causes.

Independent research says the same thing from the practitioner side. RAND interviewed 65 experienced data scientists and engineers for an August 2024 report on why AI projects fail. Of the five root causes it identified, one is that organizations lack the data needed to train an effective model, and another is underinvestment in the infrastructure to manage data and deploy models. The report also notes estimates that more than 80% of AI projects fail, about twice the rate of IT projects without AI.

Our argument in this article is narrower than "data matters", which nobody disputes. It is this: trusted data is not a property of a data estate. It is a property of a specific dataset for a specific use, and it has to be demonstrated, not assumed. Organizations that treat data readiness as an enterprise-wide cleanup to finish before AI begins will wait forever. Organizations that skip it ship confident wrong answers. The workable path is in between: certify the data each use case depends on, and build the foundation out of those certifications.

What untrusted data has already cost

The failures below were not caused by weak models. Each one came from data that was wrong, stale, inconsistent or miscalculated, and from the absence of controls that would have caught it.

Unity Software, 2022. On its first-quarter 2022 earnings call, Unity disclosed a fault that reduced the accuracy of Audience Pinpointer, its machine learning tool for targeting ads, and said it had lost the value of part of its training data, partly by ingesting bad data from a large customer. It estimated the impact at about $110 million of 2022 revenue. Management's own diagnosis was that the platform had been built more for growth than for resilience.

Citigroup, 2020 and 2024. In October 2020 the US Office of the Comptroller of the Currency fined Citibank $400 million, citing a long-standing failure to establish effective risk management and data governance programs. In July 2024 the Federal Reserve fined Citigroup a further $60.6 million, finding insufficient progress in remediating its data quality management problems, and the OCC added $75 million. Data quality became a supervisory matter measured in years and in nine-figure penalties.

Equifax, 2022. Between 17 March and 6 April 2022, a coding issue in a legacy on-premises environment, which was due to be migrated to Equifax's new cloud platform, affected how some credit scores were calculated. Equifax said underlying credit report data did not change, but fewer than 300,000 consumers saw a score shift of 25 points or more, and those scores were supplied to lenders while consumers were applying for credit. The source data was right. The derived data was wrong, and nothing downstream checked it.

Air Canada, 2024. A customer asked the airline's website chatbot about bereavement fares and was told he could apply for the discount after travel. Another page of the same website said the opposite. In February 2024 British Columbia's Civil Resolution Tribunal held the airline responsible for all information on its website, whether it came from a static page or a chatbot, and ordered it to pay damages. The decision does not establish whether the bot invented the answer or drew on inconsistent content. Either way, the organization had no controlled source of truth for its own policy.

The pattern across the four: the data failure was upstream, the damage surfaced downstream in a model, a score or an answer, and there was no point between the two where anyone verified fitness for use.

"AI-ready" means fit for a specific use

Gartner's definition of AI-ready data is useful because it rejects the idea of a single quality bar. Data is AI-ready when it is representative of the use case, including the patterns, errors and outliers the model will meet in production. Gartner stresses in the same release that AI-ready data differs materially from traditional data management. A fraud model needs the anomalies a reporting team would cleanse away. A forecast needs the history a migration project might have truncated.

The clearest regulatory statement of the same idea is Article 10 of the EU AI Act, which applies to high-risk AI systems. It requires training, validation and test data to be relevant, sufficiently representative and, to the best extent possible, free of errors and complete, in view of the intended purpose. It also requires documented governance practices: the origin of the data, preparation steps such as labeling and cleaning, the assumptions about what the data represents, an assessment of availability and suitability, bias examination, and identification of data gaps. Even organizations outside the Act's scope would do well to treat that list as a definition of done.

Three implications follow for leaders:

• Readiness is assessed per use case. The same customer table can be ready for churn analytics and unfit for credit decisions.
• Readiness decays. Data that was representative last year may not be after a product launch, a policy change or a system migration. It must be monitored, not certified once.
• Readiness needs evidence. "The data team says it is fine" is not evidence. Lineage, measured quality against stated thresholds, and a named owner are.

Structured and unstructured data fail differently

Most data quality practice grew up around structured data in rows and columns. Generative AI has moved the risk into documents, policies, emails, contracts and transcripts, where the failure modes are different and the controls are less mature.

For structured data, the familiar problems still dominate: business terms defined differently in different systems, keys that do not join, history overwritten without trace, and features computed by code nobody has tested since it was written. The Equifax case is a reminder that derived data needs the same scrutiny as source data.

For unstructured data, the hard problems are currency, authority and permission. A retrieval system will happily ground an answer in a superseded policy if the superseded version is still in the index. It will mix two documents that contradict each other, as Air Canada's website did. It may surface content to a user who should never have seen it, because the original file permissions were not carried into the index. None of these is a model defect, and none is fixed by a better model. Our comparison of RAG, fine-tuning and custom models explains why grounding approaches depend so heavily on the quality of the content they retrieve.

Certify data products, don't clean the estate

The instinctive response to all of this is a large, enterprise-wide data quality program that runs ahead of AI. These programs tend to stall, because they have no use case to define what "good enough" means and no business owner to pay for it.

The alternative is to make certification the unit of work. For each AI use case, identify the handful of data assets it depends on, test them against explicit criteria, and record the result where both the AI team and auditors can see it. Each certified asset becomes reusable by the next use case. Over time the trusted foundation is the sum of what has been certified, not a separate project.

The scorecard is deliberately short. A use case that cannot score at least "partial" on ownership, definition and lineage is not ready for production, however impressive the pilot. Our article on moving from AI experimentation to enterprise value describes the gates at which this check belongs. The detailed mechanics of rules, thresholds and service levels are covered in our companion article, A Practical Framework for Enterprise Data Quality.

The Gulf view

For Saudi public entities and the partners that handle their data, trusted data is already a compliance obligation. The NDMO Data Management and Personal Data Protection Standards include a full Data Quality domain, from prioritization and an initial assessment through to quality rules, monitoring, issue resolution and service levels, and the National Data Index assesses compliance on evidence. An entity that certifies data for AI use cases in the way described above is producing the same evidence the NDI asks for. Our NDMO implementation guide covers the build order.

Two regional data problems deserve explicit attention in AI readiness reviews. First, Arabic names and addresses are transliterated inconsistently across systems, so customer and citizen records that look distinct are often the same person. Entity resolution has to be tested on Arabic data, not assumed from tools tuned on English. Second, much institutional knowledge sits in scanned Arabic documents, where text extraction errors become retrieval errors. Both are data problems that no choice of model removes.

What to do in the next 90 days

1. List the data assets behind your top five AI use cases, in production or planned, and name an accountable business owner for each.
2. Score each asset on the trust scorecard. Treat "unknown" as "fail".
3. Stop or gate any use case whose critical data has no owner, no agreed definition or no lineage.
4. Audit your retrieval indexes for superseded documents, duplicates and lost permissions before the next generative AI release.
5. Add derived data to scope. Features, scores and aggregates need tests, not only source tables.
6. Publish certification status in your data catalog, so the next team can reuse certified assets instead of starting again.
7. Set a monitoring cadence for every certified asset, so readiness is re-proven rather than assumed.

Frequently asked questions

What is AI-ready data?

Data that is fit for a specific AI use: representative of the situations the model will face, including outliers and errors, with known lineage, agreed definitions, a named owner and ongoing monitoring. It is defined per use case, not once for the whole organization.

Why do AI projects fail because of data?

Because models amplify whatever they are given. Gartner predicts that through 2026 organizations will abandon 60% of AI projects not supported by AI-ready data, and RAND's interviews with practitioners identify lack of suitable data and underinvestment in data infrastructure among the leading root causes of failure.

Is data quality for AI different from traditional data quality?

Partly. Traditional quality work often removes anomalies; AI may need them, because they are what a fraud or failure model must learn. AI also adds concerns such as representativeness, bias, document currency and permissions in retrieval indexes.

Should we fix all our data before starting AI?

No. Enterprise-wide cleanups without a use case tend to stall. Certify the specific data each priority use case depends on, monitor it, and reuse the certified assets across later use cases.

Sources and further reading

• Lack of AI-Ready Data Puts AI Projects at Risk, Gartner, 26 February 2025. Survey of 248 data management leaders; 60% abandonment prediction.
• Gartner Predicts 30% of Generative AI Projects Will Be Abandoned After Proof of Concept, Gartner, 29 July 2024.
• AI-Ready Data Essentials to Capture AI Value, Gartner.
• The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed, RAND Corporation, August 2024.
• Unity Software Q1 2022 earnings call transcript, 10 May 2022 call.
• OCC penalty against Citibank, 7 October 2020; Federal Reserve penalty against Citigroup, 10 July 2024.
• Equifax Statement on Recent Coding Issue, Equifax, August 2022.
• Moffatt v. Air Canada, 2024 BCCRT 149, BC Civil Resolution Tribunal, February 2024.
• EU AI Act, Article 10: Data and data governance, Regulation (EU) 2024/1689.
• Data Management and Personal Data Protection Standards, v1.5, NDMO, SDAIA.