What Is the Data Actually Licensed to Do?

In "Speed Is Not a Strategy" I laid out the flight envelope for enterprise AI: the boundary of data quality, lineage, consent, and control inside which AI initiatives stay safe to operate. The first decision inside that envelope, and the one most often skipped, is whether the data was ever licensed to do what you are now asking it to do.

Consent Was Written for a Narrower World

Most consent language, contractual terms, and regulatory permissions in enterprise data estates predate the AI use cases now being built on top of them. A customer who agreed to have their data used to fulfil an order did not necessarily agree to have that same data train a model that influences pricing, risk scoring, or personalisation decisions for thousands of other customers.

This is not a technicality. It is the difference between operating inside the envelope and outside it. And unlike a flight envelope, there is no instrument panel warning you when you cross the line. The warning arrives later, usually from a regulator, a journalist, or a customer complaint.

Running the Purpose Alignment Audit

The practical starting point is a purpose alignment audit, and it needs three things to be worth doing:

The right people in the room. This cannot be a data team exercise run in isolation. Legal, privacy, and the business owner of the original data collection all need a seat, because the question is not "can we technically access this data" but "were we ever given permission to use it this way."

A use-case-by-use-case mapping. Generic statements like "we have consent to use customer data" are not evidence. Evidence looks like a mapping of specific AI use cases against the specific consent, contract clause, or lawful basis that covers each one, with gaps flagged rather than assumed away.

A standing process, not a one-off review. Purpose alignment is not a project you complete once before a big AI launch. New use cases get proposed continuously, and each one needs to pass through the same check before it reaches production data.

What Evidence of Alignment Actually Looks Like

When a regulator, auditor, or board member asks whether a given AI use case is properly licensed, "we believe so" is not an answer. The evidence trail should show the specific consent or contractual basis relied upon, the date it was reviewed against the current use case, who signed off, and what happens if that basis changes or expires. Sign-off should be recorded against a role, not a person, because roles survive reorgs and career moves and individuals do not. That is the accountability question at the heart of governance debt, and it gets its own full treatment when we look at failure mode ownership in Part 4. If you cannot produce that trail today, you do not yet know whether you are inside the envelope or outside it.

Where This Leaves You

If you cannot produce clear evidence of purpose alignment, you do not yet have permission to proceed, no matter how ready the model is or how much pressure exists to ship. That is not a governance team being obstructive. It is the first decision in the framework doing its job.

The second decision is close behind it, and it is arguably harder to get right: even where the data is properly licensed, can you actually prove where it came from and what happened to it along the way? That is lineage, and it is where most organisations discover that a wiki page is not evidence.