McKinsey Data Governance Framework: Components & Steps

McKinsey’s published approach to data governance, set out in its 2020 article Designing data governance that delivers value, ties governance to business value: leadership attention, domain ownership, prioritization, a level of rigor matched to need, and iterative rollout. The article does not contain a four-component framework or a five-step method. This guide reads the article closely, then organizes its ideas into four practical components and five implementation steps, and labels which is which.

Score Your Governance Program

Answer a few questions on leadership, process, technology, policy, and outcomes. It scores each dimension, places you in a maturity band, and returns a sequenced 90-day plan. Read the skill.

Paste into a new chat

Use the skill at https://atlan.com/skills/governance-readiness-score.md to score our governance program. Ask me for whatever it needs.

Run once in a terminal

curl -fsSL --create-dirs \
  -o ~/.agents/skills/governance-readiness-score/SKILL.md \
  https://atlan.com/skills/governance-readiness-score.md

For an agent

curl -fsSL https://atlan.com/skills/governance-readiness-score.md

Human Agent ClaudeChatGPTGeminiCursorOther Copy

The conference for teams teaching AI their business

October 28 / 11 AM ET / Virtual. Join the leaders and builders defining the context layer, the missing infrastructure of the AI era.

Save Your Spot →

One point from McKinsey’s article frames everything that follows. It says technology such as data lakes and governance platforms can help but is not a cure-all, and that governance fails when it becomes policies handed to IT and followed by few. The fix it describes is organizational, and the rest of this guide stays there.

What does McKinsey’s data governance article actually say?

The article (McKinsey, June 26, 2020, by Bryan Petzold, Matthias Roggendorf, Kayvaun Rowshankish, and Christoph Sporleder) makes two moves: it describes a typical governance structure, then it names six practices for making governance create value.

The structure: three components

McKinsey describes a typical governance structure as three parts:

• A central data management office (DMO), typically led by a chief data officer, that sets overall direction and standards. An AI center of excellence is a related structure.
• Governance roles organized by data domain, where the day-to-day work happens. Data mesh and AI covers domain ownership once agents read across domains.
• A data council that connects the data strategy to the corporate strategy, approves funding, and resolves issues. The data governance council guide covers how to set one up.

The six practices

The article then lists six practices that turn that structure into value:

1. Secure top management’s attention. Business leaders need to buy in; the DMO engages the C-suite and a council steers governance toward business needs. The article also suggests tracking impact, such as the time data scientists spend finding and fixing data; the ROI of AI agent governance frames the same measurement for agents.
2. Integrate with primary transformation themes. Link governance to transformation work that already has CEO attention, such as digitization or ERP modernization.
3. Prioritize data assets and focus data leadership. Prioritize by domain and by data within each domain. Start with two or three domains, and treat critical data, which the article says is typically no more than 10 to 20 percent of an organization’s data, with the most care.
4. Apply the right level of governance. Take a needs-based approach. A global bank needs a heavier model than a regional technology company, and rigor can differ from one data set to the next.
5. Choose iterative and focused implementation. Tailor priorities to the domain and adapt quickly instead of waiting for a perfect solution.
6. Generate excitement for data. Invest in change management so people want to use data well, from role modeling by senior leaders to training and recognition.

What are the four practical components of data governance?

The four components below are this guide’s synthesis, not a list McKinsey publishes. They organize the article’s ideas into the pieces most programs need to staff and fund, and each maps back to the article.

1. Leadership and sponsorship

Senior leaders have to champion governance, so it reads as a strategic priority and gets resources. They should explain why it matters to the whole organization and back the governance team. This maps to McKinsey’s first practice and to the data council. Why data governance programs fail names a missing executive owner as a leading cause of failure, and who owns AI governance shows how the CAIO, CDO, and CTO divide the sponsorship.

2. Governance policies and procedures

The organization needs policies and procedures that define how data is managed: ownership, access control, quality, and security. They should be clear, concise, and consistent with the organization’s business goals. This maps to the article’s call to link governance to business use cases. The data governance policy and data governance framework guides show how to write them.

3. Data stewards

Stewards implement the policies. They work with business users and IT to keep data managed consistently and in line with rules, and they need a working knowledge of the data landscape. This maps to McKinsey’s domain roles: leaders pick domain owners and stewards from the business. Data stewardship is the practical guide, and agentic stewardship changes the job: agents do the volume work, and human stewards stay on the loop to approve.

4. Technology solutions

Technology can automate governance tasks and make governance manageable at scale. McKinsey’s caution is the useful part here: the article says technology alone does not replace clear ownership, prioritization, and accountability. Zero trust data governance is one stance technology can enforce. More broadly, technology can carry governed context to the places it is needed, including to AI agents. A data catalog built for AI is one example, and the context layer for data governance teams guide covers the rest.

What principles sit underneath the practices?

Four principles recur across McKinsey’s practices. The names are this guide’s shorthand.

• Alignment with business strategy. Governance should support the organization’s objectives and strategic goals (McKinsey’s practices 1 and 2).
• Prioritize critical data and domains. Focus first on the domains and assets that matter most to business priorities, transformation efforts, and regulatory requirements (practice 3).
• Apply the right level of governance. Match rigor to the business, regulatory environment, data complexity, and risk (practice 4). A data governance taxonomy can help decide which domains need which depth.
• A culture of data stewardship. Everyone should understand their role in the quality and security of data (practice 6).

How can organizations apply McKinsey’s approach in five steps?

The five steps are this guide’s translation of the article into a rollout order.

Step 1: Define the scope of data governance

Define the scope and prioritize the data that matters most, which follows McKinsey’s advice to start with two or three domains. Begin with an inventory: what data you have, where it lives, who owns and uses it, and what it is used for. Prioritize the data most critical to operations and strategy, such as customer, financial, and operational data. An AI readiness assessment applies the same prioritization to AI use cases.

Step 2: Identify key stakeholders

Identify who will be involved, and establish a data governance council with representatives from across the organization to oversee the work. A typical roster:

1. Data owners, who hold ultimate responsibility for a data set
2. Data stewards, who ensure quality and compliance
3. Data users, who rely on the data for their work
4. IT support, who provide the infrastructure for storing and managing data

Step 3: Develop data governance policies and procedures

With stakeholders identified, write policies that cover how data is created, collected, stored, accessed, shared, used, archived, and deleted. Cover quality standards, security measures, privacy requirements, and ethics guidelines. Check which regulations apply, such as GDPR or other data protection laws, and align the policies to them. The AI governance framework guide covers the AI-specific layer. Data lineage for AI and data contracts for AI turn parts of those policies into things you can check.

Step 4: Implement data governance controls

Put controls in place so the policies are followed. That can combine manual checks, such as audits and reviews, with automated checks such as validation rules and access controls in your data systems. Consider data governance tools to automate some of them. Role-based access control in a context platform covers access, and Data Quality Studio runs quality checks inside Snowflake, Databricks, and BigQuery.

Step 5: Monitor and improve data governance

Governance is an operating practice, not a one-time project, which matches McKinsey’s call for iteration. Review the framework regularly: track metrics such as data quality scores, run audits, and collect feedback from data users. Update it as needs, regulations, and good practice change. The data governance performance metrics guide lists which measures to start with, and the data governance lifecycle shows how the stages repeat.

What does McKinsey’s 2026 research add for AI?

McKinsey’s AI data readiness article, published June 23, 2026, extends the argument to AI. It observes that AI systems do not only consume data; they generate and reuse it constantly, and governance models built for periodic review struggle to keep pace with always-on workflows. It also says fragmentation across business units is making the chief data officer central to AI enablement, with a mandate that now includes tracing and governing data wherever AI systems operate.

That is a direct update to the 2020 structure. The council, the DMO, and the domain roles still matter. What changes is how fast the rules have to travel and who, or what, reads them. Data governance versus AI governance lays out the overlap, AI context governance for the CDO covers the expanded mandate, and metadata management for AI covers the layer underneath. McKinsey also notes that making data ready for AI means connecting structured and unstructured data into a governed foundation; structured vs unstructured data for AI covers the split, and the same idea is the core of AI-ready data and the AI-ready data checklist.

How does Atlan support data governance in the AI era?

Atlan is the context layer for AI, the infrastructure that makes enterprise AI accurate, trustworthy, and scalable. Governance is a function within that context layer. Before an agent acts, it needs to know what is classified as PII, which policies apply, who can access what, and what is certified. McKinsey’s practices decide who owns those answers; a context layer is where the answers live and how agents reach them.

Mastercard provides a current example of governance supporting AI-ready data at scale. In a 2026 customer story, Mastercard reported enriching more than 30,000 of its 100M+ assets, saving more than $6M and 6,000+ hours. The work builds on governance foundations: ownership, lineage, shared definitions, and data products. General Motors shows the same idea from the shift-left side. It governs data by design, before production, and it identified a $1 billion warranty opportunity with 45 to 60% less effort for each subsequent agent.

For teams choosing tooling to carry these practices, an AI readiness platform evaluation lists the questions to ask, and data catalog vs context layer explains why a catalog alone does not carry policy to an agent. Atlan stays neutral across Databricks and Snowflake.

Bringing it all together

McKinsey’s published approach gives organizations principles to adapt to their own priorities: executive attention, domain ownership, prioritization, needs-based rigor, and iteration. Applied well, they improve the quality, security, and usability of data, and with it decisions and efficiency. As more of the reading is done by agents, the rules need to live where agents can read them. Teams asking whether enterprises need a context layer between data and AI can start with the enterprise context layer implementation guide.

FAQs about McKinsey’s data governance approach

1. What is McKinsey’s approach to data governance?

McKinsey connects governance to business strategy through executive attention, domain-level ownership, prioritization, needs-based governance, and iterative implementation. Its 2020 article describes a structure of a data management office, domain roles, and a data council, plus six practices for making governance create value.

2. Does McKinsey define four governance components?

No. McKinsey describes three structural parts (a data management office, domain governance roles, and a data council) and six practices. This guide’s four components, leadership and sponsorship, policies and procedures, data stewards, and technology, are a practical synthesis of those ideas.

3. What are the five steps for applying the approach?

The guide translates the approach into five steps: define the scope, identify stakeholders, develop policies, implement controls, and monitor and improve. The steps are this guide’s own sequence, not a numbered method from McKinsey.

4. What does McKinsey say about technology in data governance?

McKinsey’s article says technology such as data lakes and governance platforms can help but is not a cure-all. Clear ownership, prioritization, and accountability still have to come first.

Sources

1. McKinsey & Company, “Designing data governance that delivers value.” June 26, 2020. https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/designing-data-governance-that-delivers-value
2. McKinsey & Company, “AI data readiness: The key to scaling impact.” June 23, 2026. https://www.mckinsey.com/capabilities/mckinsey-technology/our-insights/ai-data-readiness-the-key-to-scaling-impact