New AI rules ask you to govern data you never classified. The bill comes due first.

The new AI obligations are written as if every organization already knows what data it holds, where it came from, and whether it is fit for purpose. Most do not. That gap is not a strategy problem. It is a classification project deferred for a decade.

What happened: the rules now assume a data inventory. The EU AI Act's Article 10 requires high-risk systems to train, validate, and test on data sets governed for relevance, representativeness, bias, and — to the best extent possible — freedom from error, applying from 2 August 2026. The voluntary, widely adopted NIST AI Risk Management Framework encodes the same expectation across its Govern and Map functions: name accountability, then document each system's context.

Why it matters: each requirement presumes work that precedes AI. You cannot certify a training set as representative of a population you never defined, screen it for bias against categories you do not record, or attest to lineage you never captured. Phrased as an AI control, the prerequisite is plain classification, ownership, and lineage — the inventory that never got a budget line absent a deadline.

What it reveals about the field: data nobody would classify for governance turns urgent the moment a regulation attaches a date and a penalty. The readiness assessment, the model card, the bias audit each wrap one question: did anyone ever know what the data was. AI did not create the obligation, only the deadline that priced the deferral.

What to watch: watch which budget the work lands in. If "AI readiness" funds the classification and lineage effort governance could never get approved alone, the regulation worked as a forcing function. If it funds only documentation asserting a control nobody built, the bias audit will surface what the missing catalog implied.