A data and AI strategy is the written record of what your organisation has decided about its data and what it will let AI do with it. It is not a list of ambitions.
What Is a Data and AI Strategy? Do You Need a Separate AI Strategy, and Who Should Write It
By James Cotton · Last updated · Sources checked · 11 min read
Part of our topic guides on AI Governance & Data Strategy and AI Skills for Business.
By James Cotton, Founder, iO-Sphere
What a data strategy is, and what Gartner did with the AI one
IBM, which sells data products, defines a data strategy as "a detailed plan for using data to improve decision-making, optimize business processes and achieve business goals". The Open Data Institute, in a 2021 blog post, said it "should direct how an organisation develops and resources its internal and external data infrastructure and data culture in support of its business strategy".
The post added that "Culture, people and organisational change are rarely featured". Gartner, a commercial analyst firm, says on its page Key Success Factors in Any Data and Analytics Strategy that the strategy "defines the what and the why of the organization's data analytics program", and that the operating model, how it is carried out, comes after.
Gartner lists the usual gaps as "data and analytics talent, data literacy and data governance policies". It treated AI in a separate guide, by Pieter den Hamer, in October 2025. There, AI strategy "centers on a vision for what the strategic impact of AI will be on your organization" and must "prioritize the portfolio of AI initiatives through which actual business value is realized".
Its essentials end on "Assign clear accountability for AI governance." Data is already inside it: "Data and technology readiness" is one of the capabilities to assess, and data and analytics is named among the "neighboring" strategies that AI strategy has to realign with.
On 28 August 2026 Gartner wrote of one strategy for all three. Its article How to Create a Data, Analytics and AI Strategy That Delivers Business Value treats data, analytics and AI as one strategy, "D&A/AI", which "must be tightly aligned with business priorities and designed to adapt as those priorities evolve". Its four phases run from establishing enterprise context to implementing feedback loops for continuous refinement.
What UK government documents said a strategy should cover
The National Data Strategy, published on 9 September 2020 by the Department for Digital, Culture, Media & Sport (DCMS), was written for the country, with five missions. What an organisation can borrow is its four pillars: data foundations, data skills, data availability and responsible data.
The first pillar wanted data "fit for purpose"; the fourth wanted it used "in a way that is lawful, secure, fair, ethical, sustainable and accountable". Between them they cover what data to trust and what use to allow.
Two later public sector documents named the data strategy. The Data Sharing Governance Framework of May 2022 asked senior leaders to make opening up non-sensitive, non-personal data "a priority of your data strategy". A blueprint for modern digital government, published by the Department for Science, Innovation and Technology (DSIT) and the Government Digital Service in January 2025, listed "data and sourcing strategy" among strategies set across functions.
The AI Playbook for the UK Government, published by the Government Digital Service on 10 February 2025 for civil servants and government organisations, told an organisation that lacked them to establish six structures. The first was an "AI strategy and adoption plan: a clear statement of the way that you plan to use AI within your organisation".
The others included AI principles, an AI governance board and AI training. The structures "do not need to be fully mature before your first project", the Playbook said, and an organisation setting them up could "reuse support structures already in place for other technologies".
So a UK government document did ask for an AI strategy and adoption plan, for the organisations it addressed. It leans on data throughout. Use cases "must be led by business and user needs, pain points and inefficiencies, not what the technology can do", and governance is needed "because of the risks related to lawfulness, security, bias and data".
Buyers drafting requirements for AI were told to "highlight your data strategy and requirements". A use cases register, for capturing use cases and choosing which to explore first, sat on a second list of things to consider.
In January 2026 GDS, inside DSIT since the July 2024 machinery of government change, published with DCMS guidelines for making government datasets ready for AI, written for public sector dataset publishers. Their definition reads: "Data is a foundational property that determines whether an AI system performs well and aligns with business needs." Their four pillars were based on the Open Data Institute's framework for AI-ready data.
The Open Data Institute, a non-profit with a stake in the argument, says its work was "used widely to inform" those guidelines, and states its position in one sentence: "AI systems depend heavily on high-quality, well-governed data."
The decisions a strategy records
Read side by side, the sources ask a strategy to record decisions rather than ambitions. Each row below is something a named person can be held to, with the documents on this page that ask for it.
| Decision | What gets written down | Where the sources ask for it |
|---|---|---|
| What data you will hold and trust | The data the organisation depends on, and the condition it must be kept in | National Data Strategy, data foundations (2020); the AI-ready datasets guidelines (2026) |
| What uses you will allow | Which uses of data and AI are approved, and which come first | The Playbook's AI strategy and adoption plan and use cases register (2025); Gartner's portfolio of AI initiatives (2025) |
| What risk you will accept | The risk carried for each use: lawfulness, security, bias, data | Gartner, "Proactively manage risk" (2025); the Playbook's governance section (2025) |
| Who answers for each | A named owner for the strategy and for each use | Gartner, "Assign clear accountability for AI governance" (2025); the chief data officer role profile (2024) |
| How you will know | The measures, who sees them and how often the strategy is revisited | Gartner's feedback loops (2026); Duty 5 of the governance standard ST0967, in the section on it below |
A row with no owner is an ambition. The AI decisions sit in the second and third rows, beside the data uses, where an organisation's approvals and risk appetite already live.
Who writes data strategies, by the role descriptions and the law
IBM's answer is that "In many organizations, a chief data officer (CDO) is responsible for creating and guiding a data strategy", while in others "senior executives, data scientists and data engineers might collaborate on building a data strategy."
The chief data officer role profile in the Government Digital and Data Profession Capability Framework (published October 2024, updated August 2025) asks the holder to "define a vision and strategy for data that enables the organisation to achieve its objectives", to "lead the organisation in implementing the data strategy", and to "ensure the organisation uses data ethically and complies with data standards and regulations".
The roles it says could lead there include data governance manager and data analyst. Gartner adds a warning about method: "Avoid the mistake of crafting a D&A strategy in isolation with a small team" and then selling it to the rest of the business. One person holds the pen; the people who use the data shape the decisions.
The data protection officer's part is set by UK GDPR Article 39: "to inform and advise" the organisation of its obligations, "to monitor compliance" with data protection law and its own policies, and, where asked, to advise on the data protection impact assessment, the assessment of a processing operation's risk.
Since 30 September 2026 the Article names the Information Commission, formerly the Information Commissioner's Office (the ICO), after S.I. 2026/386 replaced "the Commissioner" with "the Commission".
Article 38(6) lets the DPO "fulfil other tasks and duties", provided the organisation ensures they "do not result in a conflict of interests". The Article does not mention strategy. Our inference is that a DPO who wrote the strategy would then be monitoring compliance with their own decisions, which is the kind of conflict that sentence asks an organisation to rule out.
ISO's own summary of ISO/IEC 42001 lists leadership, and AI policy and objectives, among the requirements of an AI management system; certification against it is voluntary.
What the governance standard asks of the person who does this work
ST0967 is the standard our Data & AI Strategy programme runs on, so what follows describes the occupation we train people for.
Skills England's register lists ST0967, Data protection and information governance practitioner, the standard behind the data protection and information governance apprenticeship, at Level 4 and approved for delivery, with a funding band, the register's maximum funding for it, of £10,000; the employer's share of that turns on the apprentice's age and on whether the employer pays the levy.
The standard's overview: "Provide regulatory and technical advice providing assurance to key stakeholders and regulators." The occupation summary reads as a planning brief. The practitioner "will contribute to the annual work plan and assist in the planning and organisation of IG, ethics and DP activities", and "will support the senior team in the development and delivery of operational and strategic information requirements". They "develop briefings for senior leadership".
Four of the duties map onto the table above. Duty 1 is contributing to "the development of policies and guidance". Duty 3 is training stakeholders up to "senior management and the board of directors". Duty 5 is presenting "key risk, trend and performance indicators", and Duty 11 is keeping policies current "in line with technology advancements, legislative and social changes".
The knowledge, skills and behaviours (the KSBs, the statements an apprentice is assessed against) carry the same shape. K4 covers "recommending appropriate risk treatment or mitigation", and K16 is "horizon scanning for future changes and developments in relation to data legislation and case law interpretation".
S11 is to use data "to inform risk assessment and make judgements on actions to take". Skills England marks thirteen statements as mandatory in every assessment, K4, S11 and K16 among them. The assessment plan asks, under AO2, for mitigation "aligned to organisational risk appetite and priorities", and assessments must include "at least one Project".
What gets in the way once the strategy is written
The AI Adoption Research was commissioned by DSIT from IFF Research and Technopolis Group: a telephone survey of 3,500 UK private sector businesses with at least 5 employees, fieldwork 12 February to 2 May 2025, plus 100 qualitative interviews. Gov.uk published it on 28 January 2026 under the Department for Business, Innovation, Science and Trade and DSIT.
Its summary finds that businesses using or planning AI "are actively incorporating it into their future strategies". Among the rest, adoption "was frequently reactive, driven by external pressures such as client demands or industry trends, rather than internal strategic vision."
All businesses were asked what prevents or prevented them adopting AI. The top answers were "We have not identified a use for AI in our organisation" (71%) and limited AI skills, expertise or knowledge (60%). That is the second row of the table, left blank.
Businesses already using AI (700) were asked what hinders or has hindered wider adoption: 54% named limited skills and 23% data complexity, rising to 39% among large businesses. Of businesses that cited data complexity as a barrier, 70% rated it significant. The report's explanation: "Without clean, centralised data, AI models cannot perform accurately."
DSIT's UK Business Data Survey 2026, published in June 2026, found that 17% of businesses that use AI had a policy or guidelines on it. Among those that had one, 62% said it included guidance on AI access to their business's data and files.
Give it to whoever already answers for the data
We would give the strategy to whoever already answers for the organisation's data: a chief data officer where there is one, and where there is not, the most senior person already accountable for it. They write it with the people who use the data, and the DPO advises on it and then monitors it, as Article 39 sets out.
Data & AI Strategy (Level 4) runs on ST0967 and shares the standard by design with Data & AI Governance (Level 4), with a strategy or a governance emphasis. The Data & AI Strategy apprentice's project is governance work on their own organisation, a data protection impact assessment on its AI use, for example. We build custom leadership programmes for a team that has to write one this year.
What the person who holds the pen needs is the work ST0967 describes: planning, briefing the senior team, weighing risk against appetite, reporting indicators and scanning for changes in data law. For AI, Skills England's AI leadership unit sets out the same task: an AI strategy written down and explained in line with the organisation's goals, values and risk appetite.
Where nobody yet does that work, train someone who will, through training for managers or an apprenticeship that trains to the standard.
Frequently asked questions
When must an organisation have a data protection officer?
A public authority, or an organisation whose core activities involve large-scale regular and systematic monitoring or large-scale processing of special categories or criminal convictions data, must designate a data protection officer under Article 37(1); courts and tribunals acting judicially are exempt. Once designated, the DPO takes no instructions on those tasks under Article 38(3) and cannot be dismissed or penalised for performing them.
What is the difference between a data strategy and a data governance framework?
The strategy makes the decisions; the governance framework is how authority over the data is exercised day to day so those decisions hold; DAMA International defines data governance as the exercise of authority and control over the management of data.
Who should sign it off?
The board, we would say, because the strategy sets risk the organisation as a whole carries. Article 38(3) of UK GDPR already requires the DPO to "directly report to the highest management level", so the body that signs the strategy is the one that hears the DPO's view of it. The questions a board should ask about AI are a reasonable test before signing.
Do we need a separate AI governance board?
Either arrangement met the AI Playbook's test for government organisations in 2025: it said to manage governance of AI "through an AI governance board or AI expert representation on an existing governance board". For an organisation with one strategy, AI expertise on the board that already oversees data keeps the decisions on AI governance in the same place as the decisions on data.
Want to turn governed data into strategy?
Our Level 4 Data & AI Strategy programme turns data management and governance into board-level decisions, funded through the Growth & Skills Levy.