The rise of AI has changed standards for federal data leadership.
Under the new Chief Data Officer core competency model from the Federal CDO Council, data leaders are tasked with understanding AI as it relates to their specific mission and taking the lead on securing data strategies and governance.¹
While structured databases remain indispensable for daily service delivery, the actual evidence behind agency decisions lives in unstructured data. Because AI models rely on this exact content to learn and automate work, files like policy memos, official correspondence, case materials, and contract obligations are suddenly thrust into the center of the CDO’s data strategy.
Translating this updated competency model into mission success requires a clear roadmap.
Key takeaways
- Agency records have become part of the infrastructure that AI uses to answer questions and initiate work
- AI needs content with clear ownership, appropriate classification and metadata, defined permissions, and verifiable provenance
- Governed workflows empower teams to use AI while protecting sensitive information and preserving accountability
Federal AI readiness starts with trusted agency records
Federal Chief Data Officers have long held responsibility for data quality, access, security, and use. Now that mandate is all the more crucial.
Systems increasingly draw answers and recommendations from material that sits outside databases (policies, correspondence, case files, grants, etc.), and federal data leadership is on the hook to ensure governance. Data strategies must govern the documents that hold policy, evidence, history, and operating context behind mission decisions.
The National Archives and Records Administration (NARA) echoed this point in August guidance on applying the Federal Records Act to AI materials. NARA tells agencies² to consider how the definition of a federal record applies to AI “inputs, outputs, data, audit trails, software, and other materials.”
The memo is deliberately narrow, addressing records-management requirements, rather than AI governance or ethics. Still, it brings an essential records question into the AI conversation: When information supports government work, what must an agency preserve and manage?
For CDOs, the answer lies in a governance operating model. It means close work with records officers, mission owners, privacy and security leaders, legal counsel, and Chief AI Officers. Their shared responsibility is to ensure agency records remain both usable for AI and aligned to critical policies.
AI needs the right agency context
Preparing unstructured data for AI requires content classification, metadata, and a clear basis for use. Content that supports an answer should be relevant, authorized, and traceable back to the record that established it.
An AI system working from a policy file, case record, or investigative packet must understand more than text on a page. It needs document context — that is, whether a file is final or draft, authoritative for the question at hand, and available to the requesting person. It also needs to operate within the record’s access and retention requirements.
Meanwhile, the pressure to use AI keeps rising. In 2024, 11 agencies (whose inventories the U.S. Government Accountability Office (GAO) reviewed) reported 282 generative AI use cases, up from 32 in 2023.³ The use cases included information access and program support, and agency officials also described policy, technical resource, and budget constraints.
Authority matters as much as context
Context alone does not make content fit for an AI workflow.
Attributes like ownership and retention status help an agency establish defensible answers. They show which source a system used, whether that source was current, who could access it, and what happened next. This is where content governance improves oversight.
Regulatory bodies are already enforcing this need for strict document oversight. For example, under NARA’s guidance for records stewardship, agencies may dispose of AI-related federal records only under a NARA-approved records schedule.² Lifecycle status matters before an AI workflow begins, during its use, and after the agency has acted on its output.
When information sits in a central repository, federal data leaders can establish a governed path to authoritative content. And agencies can keep record ownership, permissions, metadata, and retention controls intact across any tool.
Manual review reaches its limits
Human review remains vital for high-stakes determinations, but adding reviewers to establish what is authoritative and ready for AI use across millions of files isn’t sustainable at scale.
Teams manage decades of records alongside live operational content. They have to protect personal information and controlled unclassified information, follow records schedules, and respond to scrutiny from oversight bodies. In a March 2026 report, GAO found that agencies don’t always have the tools and resources needed to protect privacy as they use AI, and that government-wide guidance does not fully address the privacy risks and challenges its expert panel identified.⁴
Automation has a role here. It can help classify material, extract metadata, route exceptions, and apply defined controls at the point where content enters or moves through a workflow.
Teams should be responsible for decisions that require judgment, such as approving a release, resolving an exception, or determining whether a source is authoritative for a particular use. Content-based security and governance controls give agencies a way to apply that discipline across people, applications, and AI agents.
Follow one defensible workflow
A defensible AI workflow begins with a controlled set of data.
AI-assisted search or summarization may help locate relevant material and surface relationships across files, but each result should retain a link to its source record. Subject-matter experts validate material, legal and privacy reviewers address sensitive content, and the responsible official records the final approval. The agency preserves the review path alongside the response.
This type of workflow gives oversight teams a way to move faster without losing the facts that make a response defensible. It creates a practical standard for other AI-assisted processes: scope the authoritative sources, preserve the governing context, route exceptions to people, and maintain an audit trail.
A practical charge to federal CDOs
Federal CDOs do not need to solve every AI use case at once. They can begin by bringing unstructured data into the governance operating model.
Start with a high-value workflow that depends on policies, records, case materials, or correspondence. Identify the authoritative sources and the owners responsible for them. Set metadata, classification, access, and retention rules that make those sources useful and defensible. Define the points where human judgment remains mandatory, and measure whether the workflow gives teams faster, better-supported decisions.
The agency record holds the context behind government work. Treating it as governed AI infrastructure helps agencies build answers that staff, oversight bodies, and the public can examine and trust.
Explore how Box supports federal content workflows
