The hidden cost of not governing data

Why many Chilean companies are accumulating two debts at once: AI value that goes uncaptured and growing regulatory exposure.

1The investment no one wants to prioritize

Few companies would say out loud that they do not mind operating with unreliable data. Almost every board acknowledges that the quality, ownership, security and traceability of information matter. But acknowledging something is not the same as funding it, and data governance remains one of the hardest business cases to get approved.

The reason is well known. It requires investing in people, processes, architecture and organizational change; its costs fall on a corporate budget, and its benefits are spread across many areas and several years. Against a commercial project that promises revenue or an operational initiative that shows immediate savings, data governance almost always loses the fight for capital. So it gets postponed, done piecemeal or limited to whatever some regulator requires, on the assumption that it can be sorted out later, when the company is more mature or a need arises that justifies it.

Artificial intelligence is dismantling that assumption. While AI lives in pilots, a company can live with messy data: a small team cleans it by hand and the prototype works. The problem appears when AI goes into operation. Poor quality lowers the reliability of the models, the lack of accountable owners leaves decisions with no one answering for them, fragmented architectures make every integration more expensive, and the lack of traceability makes it impossible to explain where a piece of data came from and how it was transformed.

At the same time, Law 21.719 changes the way companies are held to account for personal data. It is no longer enough to declare that it is protected: companies have to be able to prove it and respond to people within concrete deadlines.

Two challenges that companies used to manage separately are starting to converge. The capability needed to scale AI is, to a large extent, the same capability needed to comply with the law. Whoever postpones one postpones both. That is the thesis of this article: postponing data governance does not save an investment; it accumulates two debts.

2Chile: acknowledging is not being prepared

There is no single measurement in Chile of how many companies have data governance. There are surveys that look at related dimensions (data maturity, personal data protection, quality, AI readiness) with different samples, questions and definitions. Their figures cannot be added up or compared directly. But, read together, they point in the same direction.

The first Data Security and Protection Survey by the School of Economics and Business (FEN) of the University of Chile (2025, 1,107 responses) found that only 29% of companies have a formal data protection program with a clear strategy. Just 25% reach an advanced level of privacy maturity. Most revealing is how they actually operate: 41% handle people’s requests about their data (access, rectification, deletion) with slow, manual processes, and 44% do not train their teams regularly.¹

Surveys on AI show something similar. The AI Maturity Index Chile 2026 by Forbes Chile and Kyndryl, which surveyed 50 executives from about ten industries, recorded an average data maturity of 2.98 out of 5. A third of the executives point to data quality and governance as the main barrier to scaling AI, and barely one in ten says they have data ready to feed models in production.² Deloitte’s ConvergencIA study, focused on large companies, found that only 25% ensure the quality of their data proactively and continuously.³

The most optimistic figure comes from the survey by CustomerTrigger, the Santiago Chamber of Commerce and Experian (2025): 51% of leaders place their company at an advanced or very advanced level in the use of data.⁴ It is a self-assessment, and the gap between this and the operational indicators in the other studies is, in itself, a finding.

For all their differences, the figures draw a pattern: Chilean companies already recognize data as a strategic asset, but they are not yet building the capabilities to manage it consistently. That gap weighs more now, because many are approving investments in generative AI, predictive models or agents while still operating with diffuse accountability, uneven quality controls and little traceability. They invest in the intelligence layer before the foundation that intelligence depends on.

This is not about demanding a complete data governance transformation before starting any AI project. It is about making data maturity part of the evaluation of each initiative (its feasibility, its scalability and its return), rather than discovering it once the budget is already committed.

3The cost of postponing

Why does it keep getting postponed? Because the cost of not doing it does not show up in any spreadsheet: it stays hidden inside other projects.

An example with numbers makes it visible. It is an illustrative case, with explicit, rounded assumptions; it is not the measurement of a real company.

The case. A consumer finance retailer, with its own credit card and more than a million customers, is planning five AI initiatives for the next two years: application credit scoring, collections prioritization, churn prevention, personalized offers and a customer service assistant. All of them use personal data from the same customers. The investment committee has two paths.

Path A: postpone. Each project sorts out its own data. Preparing the data costs each one USD 250,000 and adds five months before it goes into operation. Separately, to comply with Law 21.719, the company commissions a personal data inventory and a process for responding to people’s requests about their data for USD 400,000.

Path B: build a common foundation. The company invests USD 700,000 in shared capabilities, including running them for the two years: a data catalog, accountable owners by domain, quality rules, a personal data inventory and lineage (a record of where each piece of data comes from and how it was transformed). It builds them together with the first project, which still bears the full cost of preparing its data. From the second project on, that preparation costs USD 80,000 and takes two months. Since the inventory already covers much of what the law requires, completing compliance costs USD 120,000.

It is also assumed that each initiative generates USD 40,000 a month in benefits once in operation, so every month spent preparing data is value that is not captured.

In direct spending on data, the two paths are almost tied: A spends 1,250 and B, 1,270. That is why a committee that evaluates project by project approves A: in the first year, the common foundation shows up as an additional USD 700,000 with no visible return. The difference appears when you add what the spreadsheet does not look at: the time each project loses preparing data, and a compliance inventory that repeats the data mapping each project already did on its own. With those two elements, postponing costs the company about USD 740,000 more over two years, and the break-even point comes, at the latest, with the fourth project.

Of that difference, about USD 480,000 comes from capturing the value of the projects sooner and USD 280,000 from not repeating the compliance work; the common foundation spends USD 20,000 more on data. Even if each initiative generated half the assumed benefit, the common foundation would still save about USD 500,000.

There is a third cost the table does not measure. On Path A, the scoring model is built on data without documented lineage. If a rejected customer asks how the decision was made, the company will struggle to explain it, and that, as we will see, is no longer just a technical problem.

The assumptions are debatable, and each company will have its own. What matters is the structure of the calculation: the business case for data governance is not won on its direct savings, but by adding the value of what it enables and the cost of what it forces you to duplicate. And with one discipline: never count the same benefit twice.

4Two debts that reinforce each other

AI Leadership Debt through the lens of data

In Beyond AI-First I proposed the concept of AI Leadership Debt: the gap that builds up when the potential of the technology advances faster than leadership’s capacity to understand it, govern it and turn it into value.⁵ I described it through five observable signals. Data governance is one of the places where those signals are seen most clearly:

1. Initiatives with no financial indicator. Data projects are approved as “enablers”, without anyone defining what result they should move, and that is why they are the first to be cut.
2. No one is accountable end to end. IT runs the systems, each area uses the data and no one answers for its quality. Every AI project negotiates access from scratch.
3. Leaders cannot tell what AI can do from what it appears to do. A model is expected to make up for data that was never put in order, or AI is dismissed because “the data is no good” without measuring how much it would cost to fix it.
4. Finance does not separate realized from estimated benefit. Without traceability between the data, the decision and the result, there is no way to attribute value, and data governance remains a cost with no demonstrable return.
5. Tools no one approved. Teams upload customer data to external generative assistants because they have no governed alternatives. Under the new law, that stops being just a security risk.

Not every data problem is leadership debt. Technical failures, changing requirements and operational complexity exist even in well-run companies. The difference lies in whether persistent limitations can be traced back to decisions about priorities, investments and responsibilities. When the same data problem holds back one project after another and no one has the mandate to solve it, that is also a decision, even if no one made it explicitly.

The regulatory debt: what changes with Law 21.719

Law 21.719 thoroughly reforms Chile’s personal data protection regime, takes the European regulation (GDPR) as its reference and creates the Personal Data Protection Agency, with powers to supervise and sanction.⁶ Three of its elements connect directly with data governance and with AI.

People’s rights are honored with processes, not documents. The law establishes the rights of access, rectification, erasure, objection, portability and blocking, and sets a deadline of 30 calendar days to respond. To answer an access request, the company has to know which systems hold that person’s data, for what purpose it is processed, with whom it is shared and who is responsible for each piece. If that data is scattered across disconnected applications, spreadsheets and vendors, the deadline becomes hard to meet. With 41% of companies handling these requests manually today, the problem is concrete.¹

Automated decisions become regulated. The new Article 8 bis recognizes the right not to be subject to decisions based solely on the automated processing of personal data, including profiling, when they produce legal effects or significantly affect the person. A model that approves or rejects a loan, sets a price or prioritizes a collections case may fall into that category. To operate it, the company needs to know what data the model used, where it came from and how to intervene with human review. In other words, it needs lineage, traceability and accountable owners: data governance.

Sanctions stop being symbolic. The law classifies infringements as minor, serious and very serious, with fines of up to 5,000, 10,000 and 20,000 UTM (Chile’s monthly tax unit; the last is about CLP 1.45 billion, close to USD 1.5 million) and, for repeat offenders that are not small companies, fines of up to 2% or 4% of annual revenue. More than the amount, what matters is the change in logic: the previous regime was hardly enforced; the new one has a dedicated regulator and a public register of sanctions.

It is worth being precise about one distinction. The law sets obligations; data governance provides the organizational and technical capabilities that make it possible to meet them. Not every good data management practice is a legal requirement, and the controls needed depend on what data each company processes and for what purpose. But it is hard to meet the response deadlines for data subject rights or explain an automated decision without an inventory, accountable owners and traceability.

When the two debts multiply

Readiness surveys show the size of the challenge. In 2025, PwC Chile and Fundación Generación Empresarial found that only 13% of companies considered themselves “very prepared” for the law and that more than half had not appointed a data protection officer.⁷ In August 2026, LemonTech (127 organizations) reported that 72% do not feel prepared and that four in ten have no protocols for reporting breaches; even among large companies, no more than 36% say they are ready.⁸

AI makes that picture worse, because every new model adds processing activities, integrations and automated decisions. AI does not create a regulatory gap on its own, but it amplifies the data weaknesses that already existed. That is why the two debts do not just add up: they multiply. AI’s regulatory exposure depends on how many automated decisions affect people, how likely it is that the company cannot explain them and how much each failure costs. AI increases the number of automated decisions. Weak data governance keeps the probability of not being able to explain them high, and worsens it with every integration without documented lineage. And reoffending makes each failure more expensive. When those factors grow at the same time, exposure grows much faster than the number of projects. With governed data, the same expansion of AI makes exposure grow much more slowly.

The law’s entry-into-force date has been under discussion. For a board, that changes when the obligations apply, not what they are. Using any additional time to keep postponing would reproduce the same pattern that created the current gap. The useful question is how to use the time to build capabilities that serve both compliance with the law and the scaling of AI.

5Governing without bureaucracy

Does every company need a large corporate data office, an expensive platform and a multi-year program? No. Part of data governance’s bad reputation comes from associating it with implementing the whole DAMA-DMBOK, the reference body of knowledge, when that framework does not require every organization to have the same structures. A mining company that uses optimization models with sensor data needs, above all, reliability and lineage for its process variables. A bank with millions of customers also needs a personal data inventory and traceability for its credit models. A healthcare provider developing clinical decision support works with sensitive data and needs strict controls on access, purpose and consent.*

Data governance fails both through underinvestment (fragmented responsibilities, poor quality, expensive remediation) and through overengineering (committees that become bottlenecks and oversized platforms). It should be designed around the decisions and risks the company needs to manage, not around the idea that more maturity means more complexity.

Centralized, federated or hybrid?

The second question is how to distribute responsibilities. In a centralized model, decisions and standards are concentrated in a corporate team. In a federated one, business areas take on part of the responsibilities within common policies. Hybrid models combine both. They are often presented as opposing philosophies, but the practical question is more concrete: which decisions need consistency across the whole company and which need to stay close to operations.

Consider a group with businesses in mining, energy, logistics and financial services. Privacy policies, information classification and security must be common: if each business defines its own, the risk belongs to the whole group. But the quality rules for a mining process variable require knowledge that a corporate team does not have. The answer is not to decentralize on principle, but to assign decision rights well:

The table is a starting point, not a recipe. And federation is not cheaper by definition: it requires capabilities in each area, common standards and mechanisms for resolving conflicts. Poorly implemented, it merely redistributes the fragmentation. The economic question is not which model is superior, but which one delivers the necessary controls and capabilities at a reasonable cost for that organization.

6From data to value: where it gets lost along the way

Traditional data governance indicators (completeness, catalog coverage, time to access, compliance with standards) describe the state of data management. They are necessary, but they do not explain how that investment reaches the income statement. For that, you have to look at the whole chain.

In Beyond AI-First I presented AI Value Realization Theory (AVRT), a framework in development that describes how the intelligence AI produces turns into results: AI → intelligence → decisions → actions → operational results → business value → reinvestment → capabilities.⁵ Data governance does not replace that chain; it sets the conditions under which it operates. Poor-quality data produces unreliable intelligence. Without clear accountability, decisions are delayed. With fragmented architectures, actions do not scale. And without traceability, neither the value generated nor the legitimacy of an automated decision can be demonstrated. That is why the same technology performs differently in two companies: access to AI does not guarantee capturing its value; what determines it is the organization’s capabilities.

How to read a conversion funnel

To locate where value is lost, that framework uses a conversion funnel. The idea is simple: you count the cases that enter the first stage and how many remain at each later stage. As with a kitchen funnel, a lot goes in at the top and less comes out at the bottom. The width of each band is proportional to the number of cases, so a glance is enough to see at which step the biggest loss occurs.

The funnel is measured with three rates, calculated per period on the same process:

• Decision conversion: decisions made divided by the relevant alerts the AI generated.
• Action conversion: actions executed divided by decisions made.
• Value conversion: actions with an effect measured against a baseline divided by actions executed.

Let’s go back to the consumer finance retailer and its collections prioritization model. In a typical month, the model identifies 200 customers with a significant risk of delinquency. The collections officers decide to work 110 of them (a decision conversion of 55%): the rest go unattended because the contact data is unreliable and no one wants to spend effort on doubtful cases. Of those 110 decisions, 80 are executed (an action conversion of 73%): the rest are lost because no one is accountable for loading the new strategy into the collections system. And of the 80 actions, only 48 have a measured effect (a value conversion of 60%), because without traceability between the alert, the collection effort and the payment, the result cannot be attributed.

The funnel is, at bottom, a system in series: value arrives only if every stage works, and the rates multiply (55% × 73% × 60% = 24%, which is 48 out of 200 alerts). The same happens upstream, in the data that feeds the model. If a model uses 20 sources, each correct 95% of the time and with independent errors, the probability that all of them are correct at once is just 36%; with sources at 99%, it rises to 82%. The reliability of a chain falls exponentially with every link that is not governed, and that is why improvements that seem small in each source completely change the final result.

The funnel also shows something data indicators alone do not: in this case, each of the three losses has a data governance cause (quality, ownership and traceability), and the biggest one is at the first stage. That is where an investment in data governance has the most visible return. Better data governance does not create value by itself; it creates the conditions for AI’s value to reach the bottom line.

7What to do now

In the case in section 3, waiting cost USD 740,000 over two years. To overcome the historical difficulty of funding data governance, the business case should start with three questions: what the company is required to do, what capabilities it needs for its AI strategy and which investments solve several needs at once. Legal obligations and minimum security requirements are not rejected for having an unattractive return. The third question is the one that opens up the best opportunities: a personal data inventory built to comply with the law can become, with little additional effort, the foundation of a catalog that speeds up every AI project. Or it can end up as a document no one ever opens again. The difference is a design decision.

Figure 5 organizes that work into five steps. The last one is the most often skipped: measuring realized value, not promised value, and the conversion funnel is one way to do it.

For a board, the conversation changes if, instead of only asking how much data governance costs, it asks itself five questions:

1. How many of our AI initiatives are preparing their own data separately, and how much is that costing us in money and in months?
2. Who, by name and title, is accountable for the quality of our customers’ data?
3. If a customer asks for access to their data tomorrow, can we answer within 30 days without an extraordinary effort?
4. Which models make or influence decisions that significantly affect people, and can we explain what data they use to do it?
5. Does our plan for Law 21.719 build capabilities that AI will also use, or is it an isolated compliance project?

For years, data governance was treated as a necessary but expensive function: immediate costs, indirect benefits and an implementation that could wait. That reasoning holds up less and less when the same company wants to scale AI and faces a law that requires it to demonstrate how it handles people’s data. Not every company needs a complete transformation, and complying with the law is not a financial optimization problem. But postponing is also a decision, and its costs need to be put on the table.

The cost of governing data shows up in today’s budget. The cost of not doing it shows up later, spread across AI projects that fall behind, value that is not captured, duplicated investments and regulatory exposure. That is why the question for the board is not only how much it costs to govern data, but how much it is costing us to keep operating without the capabilities our AI strategy and the law demand.

References

1. School of Economics and Business (FEN), University of Chile. Primera Encuesta de Seguridad y Protección de Datos en Chile (2025). Reported in Portal Innova.
2. Forbes Chile and Kyndryl. AI Maturity Index Chile 2026. Forbes Chile, BrandVoice, August 25, 2026.
3. Deloitte Chile. ConvergencIA: Impacto y transformación de la IA en organizaciones en Chile. Reported in Ex-Ante.
4. CustomerTrigger, InsightLab, Santiago Chamber of Commerce and Experian. El uso de los datos Data-Driven 2025. Diario Financiero, March 28, 2025.
5. Barrientos, C. (2026). Beyond AI-First: Turning Artificial Intelligence into Business Performance; AI Value Realization Theory: executive brief. claudiobarrientos.com
6. Law No. 21.719, regulating the protection and processing of personal data and creating the Personal Data Protection Agency. Library of the National Congress of Chile (bcn.cl/leychile).
7. PwC Chile and Fundación Generación Empresarial. Encuesta de Protección de Datos Personales (2025). pwc.com/cl
8. LemonTech. Readiness study for Law 21.719 (August 2026; 127 organizations). Portal Innova, September 14, 2026.

* Declaration of interest: the author is a co-founder of Oncoger.ai, a company that applies artificial intelligence in oncology.