How to govern and risk-tier your enterprise data before deploying RAG

What does it mean to govern data before RAG?

Most enterprise AI projects put a model on top of your documents. The system reads your files, stores them in a searchable form, and pulls the right pieces into the model when someone asks a question. The technical name for that pattern is retrieval-augmented generation, or RAG.

Governing it before RAG means doing three things to every source first. You inventory it, so you know what you have. You risk-tier it, so you know how sensitive it is. Then you pass it through a gate, so only governed data gets indexed. Inventory, then tier, then gate. The order matters, because each step depends on the one before it.

This is the work that happens upstream of the model. The demo always works before the governance does, which is why teams skip it and pay for it later.

Why does RAG amplify ungoverned data?

RAG inherits the state your data is already in. Point it at a governed corpus and it answers from cleared, traceable data. Roughly 80 to 90% of enterprise data sits in unstructured files [6]. Point it at an ungoverned shared drive and it does the same thing faster, retrieving, logging, and quoting from files that no one classified or permissioned. Ungoverned in, ungoverned out.

The reason is structural. Retrieval does not check whether a document should have been included. It selects whatever matches the question and hands it to the model, which answers with confidence either way. So an unclassified contract, a stale policy, or a file full of personal records becomes a fluent answer to whoever asked.

That is also where the leak forms. The sensitive data exposed at query time was admitted at indexing time, when nobody governed it. The two leak vectors in RAG, ingestion and inference, both trace back to this upstream gap. Governing first is what makes those downstream controls enforceable.

Step 1 - Build a source-inventory register

You cannot govern what you have not listed. A source-inventory register is a single record of every source an AI system will read, captured before anything is indexed.

Record 5 things for each source. What it is, in plain terms. Where it lives, including remote sites and shared drives. Who owns it. What sensitive information it holds. How often it changes. The hard part is what teams call dark data, the unstructured files that hold hidden personal or regulated information no one has cataloged.

This is not a nice-to-have. Inventory and classification with an assigned owner is already a named control: ISO 27001 lists it under Annex A 5.12 [7], so most enterprise security programs already carry the obligation regardless of industry. For financial entities it is law, not just a standard - under DORA, firms must identify, classify, and document all of their information assets, and review that record at least yearly. The register is how you meet that duty and, separately, how you decide what the AI is even allowed to see.

Step 2 - Risk-tier every source

Once you know what you have, rank it by risk. The more sensitive the data and the wider its exposure, the higher its risk. The tier you assign drives every downstream control. A 4-tier scheme covers most enterprises, and you tier the source, not just the document.

Public

Data already cleared for the outside world: published reports, marketing pages, open filings. Low sensitivity. It can be indexed with light controls, and it is the safest place to prove the system works.

Internal

Operational data meant for staff but not outsiders: process docs, internal wikis, routine email. It needs access controls so the AI does not surface internal material to the wrong team, but it carries no regulatory duty on its own.

Confidential

Commercially sensitive data: contracts, deal terms, board material, pricing. A leak here is a business injury. This tier needs permissioned retrieval and full lineage, so you can prove after the fact exactly what the AI read and surfaced.

Regulated

Anything carrying personal, financial, or health data under a named law: PII, PHI, transaction records. This is the highest tier. It requires redaction or masking before indexing, the tightest access rules, and an audit trail a regulator would accept. Start your classification here, because this is where the cost of getting it wrong is largest. The standard four-tier scheme names this top level Restricted; we call it Regulated to put the legal trigger that defines it front and center.

Step 3 - Pass each source through the pre-RAG governance gate

Tiering tells you how careful to be. The gate is what you actually enforce. A source may be indexed only after it clears 6 checks. A confidential or regulated source that fails any one of them does not go in.

One honest distinction. The duty to inventory, classify, and assign an owner is what the standards and laws above require. The six-check gate below is our synthesis of how to apply that duty at the moment an AI indexes a source - a practitioner sequence, not a clause you will find in ISO 27001, DORA, or the EU AI Act.

Classified by tier

The source has a tier on the register, and the tier is attached to the data, not kept in a separate spreadsheet the pipeline ignores.

Owner assigned

A named person owns the source and answers for what it contains. Without an owner, no one can approve, correct, or retire it.

Access rights written into the chunk

When a document is split into chunks, the small passages the system searches over, the permission travels with each chunk. Otherwise the index forgets who was allowed to see what.

PII redacted or masked at ingestion

Personal and health data is removed or masked as the file is loaded, before it reaches the searchable store. Cleaning it after it is indexed is far harder, because one file has already become many copies.

Lineage tracked across copies

One source becomes extracted text, chunks, embeddings (the numeric form the system searches on), an index, and logs. Lineage records that chain, so every answer traces back to the page it came from.

Retention and deletion set

Each source has a rule for how long it is kept and how it is deleted everywhere it was copied. Deleting the original is not deletion if the data still lives in the index.

Which regulations put classification on your desk?

Most write-ups stop at the mechanics, but a compliance officer owns the next layer. Five rules point the same way: the duty on a source follows it into every derived copy.

The EU AI Act

The EU AI Act sorts AI systems into 4 risk tiers, from minimal to prohibited. Its obligations follow the system and your role. Running something internally does not exempt it.

EDPB Opinion 28/2024

The European Data Protection Board says a model trained on personal data isn't automatically anonymous - it counts as anonymous only when pulling that data back out is "insignificant" [1]. And that holds for every form the data takes. An index or an embedding that still carries the original information counts as personal data too, with the same duties. The obligation follows the data; it doesn't stop at the original file.

NIST AI 600-1

The US National Institute of Standards and Technology released its Generative AI Profile in 2024. It names data privacy and information security among 12 risk areas. Those areas tie AI governance to controls you already run.

India's DPDP Rules

India notified its Digital Personal Data Protection Rules in November 2025. Its core duties phase in over the following years. Firms handling Indian personal information already have to classify and protect it.

DORA

For financial entities, DORA has been in force since January 2025. Its Article 8 requires firms to "identify, classify and adequately document all ... information assets and ICT assets" [5], unstructured files included. Classification is not optional housekeeping here. It is a named legal obligation.

The pre-RAG governance discipline at a glance

The register tells you what you have. The tier tells you how careful to be. The gate is what stops an ungoverned source from ever reaching the model.

Do you have to build this yourself?

You can. It means months of inventory, classification, permissioning, and lineage work layered on top of the AI, and most teams underestimate it because the model demo lands long before the governance does.

The other path is to put the governance on a layer that already does the hardest parts. A foundation data layer keeps your data inside your own cloud and traces every answer to its exact source - which page, which section, which word - so the moment you govern a source, you can prove what the AI did with it. SageX is that layer, with five live, revenue-generating deployments behind it. The inventory, the tiers, and the gate are yours to set; the containment and lineage that make them enforceable come built in.