The Shift-Left Timeline for Embedding Governance by Design

For decades, we’ve been doing data governance backwards – build first, govern later.

It worked well enough because data operations were generally centralized and the people tasked with managing governance had the right context. They knew how systems were built and who to go to when they broke.

But AI has flipped that on its head.

AI doesn’t know context, but it acts as if it does – confidently answering questions without truly understanding what’s being asked of it. It can spell disaster for teams who blindly trust its outputs, or for the models that sit unused because they can’t be trusted.

With more human and machine users accessing more data more quickly, the “govern later” approach isn’t just inefficient, it’s a liability – and not just in the regulatory sense. Poor foundational governance blocks your ability to scale AI enterprise-wide.

At Atlan Re:Govern 2025, over 20 leaders from some of the world’s largest and fastest-moving companies weighed in on how this shift is impacting their teams – and how they’re navigating it. Because even at organizations as large as General Motors, “our data governance team is never going to be an army of people in every, every stretch of the globe.”

“The traditional quality model really puts data governance at the end in a very reactive mode,” explained Sherri Adame, Enterprise Data Governance Leader at General Motors, during Atlan Re:Govern. “So once things were deployed and released into production, we would start saying, ‘Okay, how do we govern this data? Tell me what this data is.’”

So, what’s the solution to governing exponentially more data assets for a constantly expanding user base? Shifting left, so that governance and context are embedded from the start – not as an afterthought. Here’s how experts from across industries have done it.

---

What “Shift Left” Actually Means #

Before we get into the “how,” let’s do a quick primer on the shift-left methodology. Shifting left refers to moving governance upstream in the development cycle – essentially treating it as a foundational feature, instead of a box to check.

Embedding governance as systems are being built ensures that it works as intended from the start – so you can avoid retrofitting or retooling later.

“With the introduction of AI, at the pace and at the velocity that is being interjected into how we do work, we really need to shift left and move all of that governance up front through the collection of metadata, so that we can be proactive and insert governance really at the beginning of the lifecycle,” said Sherri Adame during Re:Govern.

Yes, this requires data teams to fundamentally rethink how data flows through their organization. But the effort is worth the outcome.

Shifting left provides the opportunity to finally govern data the way it’s supposed to be done: collecting metadata upfront, certifying the design immediately, understanding privacy impacts, and being ahead of any data demand that may arise.

But the key to shifting left in a way that’s actually sustainable is aligning systems, processes, and people. At the end of the day, getting buy-in from the data users themselves is just as important as how that data is governed and used. Here’s how to do it in 12 months.

---

The Shift-Left Timeline #

Based on our customers’ successful implementations, here’s what realistic progress looks like.

Months 1-2: Choose High-Impact Domains to Start the Process #

“Pick and choose your battles, whereby you can achieve very quick wins such that you can get the juices going, get the wheels turning,” advised Gu Xie, Head of Data at Group 1001, during Re:Govern. “Once people start to adopt it and start using it, then you’ll find that the innovation naturally flows through.”

The key to getting started is choosing domains where success is viable and valuable, but failure won’t halt the initiative. And since nothing stops progress like imposing arbitrary systems, it’s critical to meet teams where they are.

At GM, this means lowering the barrier to entry by ingesting metadata in the formats teams already use – YAML, protobuf, CSV, JSON, model cards, or dataset cards.

“When I started three years ago, I would have said, I’m hunting these people down,” said Sherri Adame of GM. “But now it’s three years later, and essentially everyone knows we lead with governance.”

Quick tips:

1. Get buy-in from high-impact domain teams and recruit an executive sponsor to help make sure the initiative is a priority.
2. Document existing processes and work with teams on how to integrate governance within them.
3. Create a RACI to set clear expectations but allow teams to move at their own pace, with regular check-ins to monitor progress.

Remember, this phase is about proving the model works, not scaling it. As you get results and iterate, you can continue to add domains and use cases.

Months 3-5: Implement Governance Checkpoints #

Here’s what every governance stakeholder knows: people don’t follow policies just because they exist; they follow them when failing to do so blocks their work.

What does that have to do with shifting left? If data producers know their assets won’t make it to production unless they meet governance standards, they’re more likely to embed them early on.

At GM, for instance, code cannot be promoted to production without passing governance tests. The system performs automated checks to ensure metadata aligns with standards: If it passes, it gets certified and ingested into the internal metadata repository; if not, promotion is blocked.

No exceptions, no workarounds.

What to ask:

1. Where do data producers make decisions that affect downstream quality and trust?
2. Which governance requirements do teams consistently skip or forget?
3. What may break downstream if incomplete data made it to production?

What to do:

1. Identify points in your CI/CD pipeline when governance checks should occur.
2. Create metadata templates for common formats (YAML, protobuf, CSV, JSON, etc.), and data contract templates for SLAs and quality expectations. See our guide here.
3. Set up automated validation scripts that check for metadata completeness and flag missing context.
4. Build PII-free workspaces for development so users can get to work instead of waiting on data…

No one wants to have to retrofit metadata after the fact. Save yourself the headache by ensuring the required checks are clear and integrated into existing processes. In the long run, that will make development processes faster and more performant.

Months 6-8: Reevaluate Decision-Making Processes #

When shifting governance left, GM made a bold move: they replaced their steering committee – which had become more backward-looking than forward-looking – with an advisory board with domain-level representation.

This can be the tipping point between the status quo and the new era of data governance. Giving your processes a fresh set of eyes – literally – can help push things forward in practical and outside-the-box ways.

When the people who are in the weeds day in and day out are calling the shots, they’re more likely to make informed decisions than the people who are watching from afar.

GM’s advisory board follows a 20/20/20 agenda:

• The first 20 minutes are for reviewing metrics and new policies.
• The next 20 minutes is for demonstrating new capabilities.
• The final 20 minutes is for sharing real-world experiences.

This keeps meetings tight but progressive – the right metrics and discussion points are covered, with room for learning and collaboration.

What to ask:

1. Is our steering committee really working in service of a shift-left governance approach or is it a review board?
2. Who are the people that we need to help direct the next phase of embedded governance?
3. What inputs will make advisory board meetings most effective?

What to do:

1. Identify the key stakeholders to participate in the advisory board.
2. Establish a cadence for meeting and delegate agenda items.
3. Solicit feedback from stakeholders and their teams to iterate and improve.

This is where shifting left moves from an initiative to a way of working – one that empowers the teams responsible for it.

Months 9-12: Measure (and Gamify) Metadata Completeness #

Call us crazy, but governance can be fun (seriously!). Just take a page out of GM’s book.

They turned metadata completeness into a competition by:

• Setting a point target on completeness scores
• Putting criteria in place to gain points to reach that target
• Publishing metrics so teams can see exactly how they stack up against their peers

With every metric visible – and accountability and pride on the line – GM’s engineering teams stepped up.

“Engineering teams…want to be the best team,” said Sherri Adame of GM. “They want to show off their dataset. They want to have good data that’s easy to use. So teams like that scoring mechanism.”

What to ask:

1. What are the criteria for metadata completeness?
2. What metrics are most important and applicable across domains?
3. What is our course of action to address low scores and incomplete metadata?

What to do:

1. Audit top-performing data assets to identify similarities and use them as benchmarks.
2. Build and share metadata completeness dashboards that are accessible across teams.
3. Incentivize teams to compete by offering public recognition and prizes.

Year 2+: From Shifting Left to Optimizing #

This is when, in GM’s words, “assets governed just exploded.”

The foundation is solid, the teams are engaged, and the focus shifts from implementation to optimization. Governance becomes invisible, not because it’s not there, but because it’s everywhere, built into how everyone works.

---

Change Management Strategies for Shifting Left #

Shifting left may be technical in theory, but in practice it requires a focused change management framework. Adoption relies on starting small, getting buy-in, and committing to continuous learning (see the core metrics here).

“When we began modernizing, when we began this journey, we were very deliberate,” said Fabien Thiaucourt, SVP of Data Governance and Enablement at Mastercard, during Re:Govern. “So we didn’t start with tools. We started with outcomes for specific people.”

Here are the steps he and other leaders follow to manage shift-left transitions.

Make Governance a Shared Responsibility #

Let’s face it: governance gets a bad rap. But making it a shared responsibility and focusing on how it helps teams succeed – instead of what it requires – can help flip the script.

“Governance cannot succeed in isolation,” said Vivek Radhakrishnan, SVP of Governance Engineering at Mastercard. “The theme of how we’ve gotten so far… is product and tech working hand-in-hand to make it happen.”

When there’s a shared goal around governance, the steps to shift it left feel less like an imposition and more like a team sport. This is where the gamification aspect comes in handy.

Don’t Let Perfect Block Progress #

“Everyone makes mistakes,” said Vivek Radhakrishnan of Mastercard. “Gather feedback and pivot. Don’t wait for the perfect playbook.”

Organizations that succeed with shift-left governance don’t wait until every process is defined, every rule is airtight, or every exception is accounted for. They move early, learn fast, and refine constantly.

It works because real-world governance is messy.

Teams evolve, architectures shift, tools change, and new AI use cases emerge constantly. The most effective teams treat governance like any other modern development practice: agile, collaborative, and fast-iterating.

Treat every iteration as data, giving you answers about why things break and how to adapt.

Connect Governance to Business Outcomes #

It’s the question every leader asks before making a decision or investment: What’s the business impact?

If you can’t answer that question, let’s face it – your project won’t be prioritized. It might not even make it past the concept stage.

During Re:Govern, Rahul Bahkshi, VP of Data and Technology at New York Life, emphasized that governance outcomes must be linked to business outcomes, so that the why behind governance is clear – and important – to everyone who deals with data.

“When you link governance outcomes to your business goals, governance becomes a driver of speed and confidence, not bureaucracy,” he said. “The other way to think about this is the cost of not getting it right. Those consequences can carry a far greater business and reputational cost than the investment that it takes to get governance right from the get go.”

Tie governance to real business risks and outcomes. Recruit an executive sponsor. Quantify wins early and share them often. Because when the business outcomes are clear, governance becomes something people want to adopt, not something they’re forced to follow.

---

Starting Your Shift-Left Governance Process #

The companies winning with AI aren’t those with the best models. They’re the ones who’ve embedded context and trust – in the form of governance – into their development process from day one.

Shift-left governance is about making the right path the easiest path, so governance isn’t an afterthought or a point of friction, but a foundational part of the architecture that enables smarter, faster, more trustworthy systems, processes, and decisions.

GM proved you can govern millions of assets without an enormous team of data stewards. New York Life showed that governance can be seen as an enabler – not a blocker – when it’s tied to business outcomes. Mastercard demonstrated that good governance actually accelerates innovation, flipping their data scientists from wrangling data 80% of the time to innovating with it 80% of the time.

The playbook is here. The patterns are proven. The technology exists. The only question is: How quickly can you shift left? Because with the pace of AI, ungoverned data isn’t just a risk – it’s a competitive disadvantage. But those who get it right will be set up to move faster and go further, finally getting true value from their data and AI investments.

Learn more from Gartner about data governance maturity models here.

---