AI Transformation · Authority
Who Owns the Decisions Hidden in Corporate Memory?
Stripping the names answers the privacy question and leaves the harder one untouched.
Key Takeaways
- De-identification resolves privacy and does not touch this. Remove every name from a decade of threads and decisions and what remains is a record of how the organization exercises judgement, which is valuable, transferable, and governed by almost nobody.
- The live question is secondary use: information gathered for one purpose being used for another that nobody agreed to, because nobody was asked. A ticketing system bought to route tickets is not the same instrument as a corpus for training the routing judgement.
- Four decisions need owners before they need answers: which corpora are eligible, whether derived models may leave, how long the record is kept now that retention and training value pull against retention and risk, and what the workforce is told.
What is actually in the record
An organization's accumulated internal correspondence is not primarily a store of facts. It is a store of judgement: which exceptions were granted and which refused, how a hard call was framed before it was made, what argument persuaded, which risks were named and which were treated as not worth raising. That is the substance of how the organization decides, and until recently it was inert because nothing could read it at scale.
Its inertness was doing a great deal of governance work that nobody had to design. When a corpus cannot be used, no policy is needed about using it. That condition has ended, and most organizations are discovering the absence of the policy rather than the presence of a problem.
Why privacy is the wrong frame
Privacy law is comparatively mature and it governs personal data about identifiable people. It does its job here, and having done it, the interesting question is entirely unaddressed. A fully de-identified corpus of a decade of procurement decisions carries no personal data and considerable value, and the decision to train on it belongs to nobody in particular.
Helen Nissenbaum's framework of contextual integrity is more useful than a consent frame for this. Information carries norms from the context in which it was shared, and moving it into another context can violate those norms even where nothing is disclosed to anyone. An engineer writing candidly in a design review was operating under the norms of a design review. Those norms did not include being the training data for a system that will later constrain how design reviews are conducted.
The observable consequence
When people conclude that the internal record is training data, the record changes. Candour in writing declines, hard calls move to conversations that leave no trace, and the corpus quietly becomes less useful for the purpose that motivated using it. That effect requires no policy announcement to start, only a plausible inference, and it is not reversible by clarification.
Four decisions that need an owner
Which corpora are eligible
Not all internal records are the same. A ticket queue, a legal matter file, an HR case record and a design review carry different expectations from the context they were created in. Deciding eligibility corpus by corpus, in advance, is cheaper than deciding it once an incident has made it urgent.
Whether derived models may leave
A model trained on internal judgement is a durable extract of it. Whether it can be sold, transferred in an acquisition, shared with a vendor, or reach a vendor incidentally through fine-tuning is a distinct decision from whether the training was permitted, and the two are almost always conflated.
How long the record is kept
Retention policy was written when holding data was purely a liability. Training value now pulls the other way, and the two pressures meet in a policy nobody has revisited. An organization deleting at seven years for risk reasons may be discarding its most valuable asset, and one keeping everything for training value has assumed a risk it never priced.
What the workforce is told
The legal answer in most employment arrangements is that work product belongs to the employer. The practical question is whether people learn about this from a policy or from noticing. Which they do is unrelated to the legal position and closely related to whether the senior practitioners whose judgement made the corpus valuable stay.
Where this shows up unexpectedly
In an acquisition, because a model derived from internal judgement transfers with the entity and is rarely enumerated in diligence, so a buyer may acquire a capability nobody priced or a liability nobody disclosed. In a vendor relationship, because fine-tuning arrangements can move derived value outward through terms that were negotiated as infrastructure. And in retention, where a policy written purely as risk management now sits against a countervailing interest that did not exist when it was drafted.
None of those is exotic. All three are ordinary corporate events that now have an unowned decision inside them.
The Four A's reading
This is Authority over an asset the organization did not know it had. Every other authority question in this series concerns a decision someone is making; this one concerns a decision nobody is making, about a resource that accumulated as a by-product. The failure mode is not a bad choice but a default: the first team with access and a plausible use case sets the organization's position, and it becomes precedent before anyone with standing to decide has been asked.
It reaches Alignment through the consequence above. An organization whose people believe their written judgement is training data will produce less written judgement, and the loss is invisible because what stops being written leaves no record of having stopped.
About the Author
Dan Flynn
Creator of The Four A's of Organizational Readiness™ · Enterprise Transformation Executive · Author, Builders Build
Dan Flynn has spent thirty years inside federal, defense, and commercial organizations: diagnosing the invisible conditions that determine whether capable people produce extraordinary results. He is the creator of The Four A's of Organizational Readiness™ framework, has reached more than 11,000 professionals across corporate, civic, and national security contexts, and took a federal data platform from one release every six months to seventy-two every two weeks by changing organizational conditions: not people.
His book, Builders Build: The Four A’s of Organizational Readiness™, is forthcoming.