AI Without Good Data Is a Very Expensive Mistake

A company can purchase one of the most capable AI models available and still get disappointing results. The reason may have little to do with the model.

The organization is asking sophisticated technology to reason over unreliable information. That is a data problem disguised as an AI problem.

AI makes information problems visible

Imagine asking an employee: "What is our return policy?" The employee checks three internal documents. One says 30 days. Another says 45. A third says premium customers receive 60 days. Nobody knows which document is current.

AI does not resolve that governance problem automatically. It can retrieve the wrong policy faster.

When organizations say, "The AI gave the wrong answer," the first question should sometimes be: "Did the company itself have a reliable answer?"

Fragmentation creates hidden costs

Business information often lives across CRMs, ERPs, spreadsheets, email, SharePoint, cloud drives, ticket systems, databases, PDFs, personal folders, and employees' heads.

The fragmentation becomes tolerable because experienced employees learn where to look. AI exposes the architecture.

If an assistant is expected to answer questions across the company, it must know which sources are authoritative, which version is current, who has permission to see what, how entities are matched, and how conflicts are resolved.

That is information architecture. Not model intelligence.

Duplicate records produce contradictory realities

A customer appears twice in a CRM. One record lists an old address. Another contains the current phone number. A third system contains the correct contract.

Humans may notice the inconsistency. An automated system may confidently act on whichever record it retrieves.

Duplicate data therefore moves from being an administrative nuisance to an automation risk. The more actions AI is allowed to take, the more important master-data discipline becomes.

Historical data can encode historical mistakes

Businesses often assume more data improves AI only if the data is useful.

Historical information may contain poor classifications, inconsistent definitions, outdated policies, biased decisions, missing fields, measurement changes, or behavior the company no longer wants to reproduce.

Training or evaluating a system on those records can institutionalize old problems.

NIST emphasizes data availability, suitability, representativeness, and measurement as part of AI risk evaluation. The question is therefore not merely: How much data do we have? It is: Do we have the right data for this decision?

RAND's failure research points upstream

RAND researchers interviewed 65 experienced data scientists and engineers about AI-project failures. Among the leading causes identified were poor understanding of the problem, lack of necessary data, and focusing on fashionable technology instead of solving the needs of intended users.

That sequence matters. The organization should determine what decision needs improvement, what information the decision requires, whether that information exists, and whether it can be trusted. Only then should management decide what AI system to build or buy.

Permissions are part of data readiness

A technically effective AI assistant may become a security problem if it retrieves information a user should not see.

Suppose an employee asks: "What are we planning to pay the candidate interviewing tomorrow?" The answer may exist inside the company. That does not mean the employee should have access to it.

Traditional enterprise systems often enforce permissions at the application level. An AI knowledge layer can cross multiple applications. Permissions therefore need to survive the integration.

The goal is not for AI to know everything. The goal is for each user to receive appropriate access to the information required for that user's work.

Privacy changes what may be used

Organizations also need to know what information they are sending to models and vendors. That can include customer data, employee data, financial records, health information, source code, contracts, strategic plans, trade secrets, and intellectual property.

OWASP lists sensitive-information disclosure as a significant LLM-application risk.

Data governance must therefore answer: Which AI tools may employees use? What information may be entered? Is data retained? Is it used for model training? Where is it processed? Who can access logs? How is sensitive information filtered? What happens when an employee uses an unapproved tool?

These are operating questions, not theoretical cybersecurity questions.

Shadow AI is partly a management signal

IBM's 2025 breach research found substantial AI-governance gaps among the breached organizations it studied. It reported that 20% of the 600 organizations experienced breaches linked to shadow AI.

Shadow AI can be treated purely as an employee-compliance problem. That misses half the issue.

Employees often adopt unauthorized technology because the sanctioned process is slower than the work demands. Management should control the risk. It should also investigate the demand.

If employees repeatedly use external AI to summarize documents, search information, or draft communications, they may be revealing legitimate productivity opportunities that the company has not addressed safely. Governance should therefore contain both restrictions and approved alternatives.

Legacy systems can determine AI feasibility

A business may have valuable data locked in a decades-old system with limited APIs, poor documentation, inconsistent fields, and expensive vendor support. The project may still be feasible. But the implementation budget needs to reflect reality.

Sometimes the correct AI recommendation is: Do not implement AI yet. Modernize the data environment first.

That may sound disappointing. It can be the higher-return decision because the modernization improves many future use cases instead of forcing a costly integration for one experiment.

What an AI data-readiness assessment should examine

• Availability: Does the information required for the use case exist?
• Accuracy: How often is it wrong?
• Completeness: What percentage of relevant records contain necessary fields?
• Consistency: Do systems define customers, products, transactions, and statuses the same way?
• Timeliness: How quickly is information updated?
• Authority: Which source controls when systems conflict?
• Access: Can the proposed AI system retrieve the data technically?
• Permission: Should it?
• Lineage: Can the organization identify where important information came from?
• Security: What new exposure is created?
• Ownership: Who is responsible for keeping the information correct?

Many AI projects should stop at this stage until the answers improve. That is not failure. It is avoiding an expensive one.

Retrieval does not fix governance

Modern AI systems can use techniques such as retrieval-augmented generation, or RAG, to search approved company information before answering. This can make enterprise AI far more useful.

But retrieval does not magically determine which document deserves to be trusted. If the source repository contains five contradictory policies, a better search system merely finds contradictions more effectively.

Content governance still matters.

Data cleanup should have its own economic case

Executives should also resist the opposite mistake: spending millions trying to perfect every company database because "AI needs clean data." That can become another technology program without a business outcome.

Clean the data required for prioritized use cases. If customer-service automation depends on 15 specific information sets, fix those. If forecasting depends on three years of sales and inventory data, validate those.

The AI strategy should focus data investment. It should not become an excuse for endless transformation.

Good AI begins with organizational truth

The most useful way to think about AI readiness is not whether the company possesses advanced technology. It is whether the organization can reliably answer questions about itself.

What happened? What is happening? Which information is authoritative? Who owns it? Who may access it? What does this field mean? What process produced it?

If the organization cannot answer those questions, AI may amplify ambiguity. Before companies build intelligent systems on top of their information, they should make the information worth reasoning over.

Comdatus Consulting perspective: A data-readiness review should happen before sophisticated implementation. Sometimes the most valuable AI recommendation is a data, process, or systems project that makes future AI investments viable.