What data trust looks like in a regulated AI environment: lessons from the grid

The most consequential number in AI regulation right now is a date that moved. In May 2026, EU lawmakers agreed to push the high-risk obligations under Annex III, which cover credit scoring, employment screening, essential services, and critical infrastructure, from August 2, 2026, to December 2, 2027. It is not the only date in motion. Across the United States and other markets, AI rules that looked imminent have slipped their start dates, been redrawn, or stalled in court, while many more are still being written. The timelines are uneven, and they keep changing.

It would be easy to read those headlines as breathing room. The data leaders we talk to in regulated industries read them differently, and they are right to.

A Chief Data Officer at a global bank does not wake up hoping Annex III moves. They wake up asking whether the bank can deploy AI safely, scale it without surprises, and stand behind the outputs when an auditor or a CEO challenges them. The regulatory deadline matters, but it is downstream of those questions. A later deadline changes when a regulator will ask to see your evidence. It does not change what your AI needs to operate reliably. A model or an agent built on data you cannot stand behind produces outputs you cannot defend, whether or not an auditor is in the room. Building the capabilities that make data demonstrably fit for AI takes longer than any reprieve a regulator is likely to grant, which is what turns this extra time into build time rather than waiting time.

The energy sector learned that lesson early, under regulators who demanded continuous evidence of data quality years before AI reached the agenda. Their experience offers a working blueprint for every industry now standing up AI, so it is worth starting there before returning to what it means for your roadmap.

Does a later deadline mean you can wait?

No. Every major law firm tracking the EU’s revised timeline reached the same conclusion. The hard part of compliance was never the documentation template. The hard part is finding every place AI touches your data, classifying each use, and proving the data underneath it is sound. None of that gets easier by starting later. An organization that begins now has roughly 18 months to refine its foundation; an organization that waits has weeks to assemble one.

The pattern is global rather than regional. Gartner projects that AI regulation will reach roughly three-quarters of the world’s economies, and the supervisory direction holds consistent across them. Even where a specific statute has slipped, as Colorado’s AI law did when it was stayed and pushed into 2027, regulators have made clear that existing rules already apply to AI-driven decisions. Anti-discrimination law, fair-credit rules, privacy regimes, and sector regulators take an interest well before any dedicated AI act arrives. The enforcement clock slipped in places. The scrutiny clock did not.

There is a deeper reason to keep moving that has nothing to do with any regulator. AI in production rarely fails for a single reason. Model selection, retrieval, prompt design, and broken business processes all cause failures on their own. But many of the failures that reach a regulated decision trace back to data that was incomplete, inconsistent, or impossible to trust, and that is the failure mode a CDO is positioned to prevent. Gartner found that organizations succeeding with AI invest up to four times more, as a share of revenue, in foundational areas like data quality and governance than the organizations seeing poor returns. The capability a regulator will eventually ask you to prove is the same capability that determines whether your AI works at all. Build it for the second reason, and the first takes care of itself.

So the question for a CDO is no longer when the deadline falls. It is whether you can prove, on demand, that the data feeding your AI is reliable.

What data trust actually means when AI is in scope

Data trust is the confidence that the data feeding AI is accurate, governed, traceable, and fit for its intended use, backed by continuous evidence rather than assumptions. That confidence comes from operational capabilities rather than policy documents, and four properties carry most of the weight.

1. The first is quality enforced where data moves. Quality is enforced continuously across ingestion, transformation, and operational data pipelines, so flawed records are detected before they reach AI applications or downstream analytical workloads, rather than being discovered after they have already shaped a decision. 
2. The second is provenance you can reconstruct, meaning automated lineage that traces every record back through its transformations to its source system and produces a report in hours rather than a manual rebuild under deadline pressure. 
3. The third is fitness for purpose you can measure, a repeatable read on whether the governed data reflects the business context the system is meant to serve, backed by documented quality expectations rather than assumptions.
4. The fourth is evidence generated as a byproduct, where quality outcomes, remediation actions, lineage, and stewardship are captured automatically with timestamps so the audit trail builds itself instead of becoming a project each time someone asks for it.

None of these capabilities exists solely for compliance. Each one improves the reliability of AI while creating the evidence regulators increasingly expect. Organizations that build them once strengthen both outcomes, which is why the strongest data leaders stopped treating “ready for the auditor” and “ready for AI” as separate goals.

Lessons from the grid

Few industries make the case as cleanly as electricity, where a wrong answer about a physical asset carries consequences long before any AI is involved. Energy regulators across Europe and beyond increasingly require operators to treat data as a governed asset, with defined ownership, measurable quality, and an evidence trail. That requirement arrived alongside a broader shift in the sector, away from asset-heavy centrally managed networks and toward a more data-driven system built to support electrification and renewables. Both pressures push toward the same outcome: cleaner, more consistent data, and the ability to prove it.

For example, a major Central European energy company that generates, distributes, and trades electricity. Years before AI reached the top of the agenda, its data lived in scattered systems with no consolidated view, and key departments could not rely on their own records for reporting or daily operations. The result was inconsistent data, duplicated effort, and processes that ran on guesswork. The company rebuilt its foundation around master data management and continuous quality monitoring, creating a trusted, governed data foundation that its other systems could rely on, and it framed the program in terms every regulated business now recognizes: AI readiness and trust in data treated as one objective rather than two.

That starting point looks familiar to anyone in a regulated industry. Governance runs on spreadsheets and manual reconciliations, core systems return conflicting records so teams cross-check the same data in parallel and rediscover the same problems each quarter, ownership stays informal, and quality is a point-in-time snapshot rather than something anyone monitors. Under that model, an organization cannot evidence its regulator’s requirements, because the evidence does not exist in any durable form. The operators getting ahead replaced it with shared business definitions, automated quality across their domains, documented ownership, and continuously monitored scores. The same foundation that satisfies a regulator is what makes their AI ambitions credible.

Three lessons travel from the grid to any regulated industry. 

• Regulators want evidence rather than assertions, because a claim that your data is good carries no weight under audit while a timestamped, monitored, lineage-backed record does. 
• Trust is a continuous state rather than a snapshot, because regulated AI runs continuously and the data feeding it has to be monitored on the same basis. 
• And one foundation serves both compliance and AI, because the capability that satisfies a regulator and the capability that makes AI reliable are the same capability; treating them as two programs duplicates cost and slows both down.

The pattern reaches well beyond energy. A large US health insurer ingests hundreds of millions of medical records from outside sources and depends on that data for regulated quality reporting to public agencies, where an incomplete or inconsistent record that reaches a submission can trigger fines and threaten accreditation. It runs continuous quality monitoring to catch those records at the point of entry, before they reach a filing, which is the same principle the grid operators learned: intercept the problem in motion, before it shapes a decision or trains a model. Different regulator, different fine schedule, identical prerequisite. AI and the regulated decisions around it both need data the organization can stand behind.

What this means for your roadmap

If your industry sits inside the EU’s high-risk categories, a US state framework, or any of the regimes now reaching most of the world’s economies, treat the deferral as a funded runway and spend it on the capabilities that take longest to mature.

Embed quality controls where data moves, so problems get intercepted before they reach AI applications or regulated reports rather than only being checked where data rests. Automate lineage now, because reconstructing provenance across years of pipelines by hand is the task most likely to fail under deadline. Establish measurable trust indicators so a person or an AI agent can determine whether a dataset is fit for use at the moment of use rather than assuming it. And build the evidence trail into the pipeline so audit readiness becomes a standing condition rather than a fire drill.

These are the foundations that let you scale AI at the pace the business wants while staying defensible when scrutiny arrives. They also separate the AI programs that return value from the ones that stall. The deadline moved, but the work did not. The sectors that already had to prove their data to a regulator learned this first, and the organizations that follow their example will be the ones with something to show when the new dates arrive.