This blog post accompanies the latest episode of What Counts?, hosted by Lee Karas and Maura Dunn. Listen to the episode or play it on our podcast page.
Made for This Moment
Artificial intelligence dominated nearly every session at ARMA InfoCon 2026 in Savannah, Georgia. For information governance and records management practitioners, the key takeaway was clear: AI is not a replacement for governance, but a test of it. Principles like accountability, transparency, retention, disposition, and traceability form the foundation AI needs to succeed. Without them, AI tools remain shiny, unmanaged risks.
However, many practitioners encounter a familiar problem. While governance principles are essential to AI success, information management professionals are often left out of the room where AI decisions get made.
Confidence Is Not Accuracy
Generative AI tools operate with high confidence regardless of whether their answers are correct. Conflicting data, legacy drafts, and unstructured file stores trip AI up because the software lacks context. This issue highlights a core records management requirement dating back to 3000 BC, when the King of Ur used clay tablets to create records both parties to a transaction could trust.
Modern organizations still require trustworthy records, but AI can generate plausible content from nothing. Information governance practitioners provide the context, traceability, and accountability that automated tools lack.
Rethinking Retention and Disposition
Data volumes outgrew traditional records management controls long before AI arrived. Managing prompts, outputs, and massive file repositories using rigid manual rules is no longer practical. A central question from the conference is whether retention and disposition must shift from absolute control to a good faith effort based on risk assessment and confidence levels.
If 100 percent control over digital content is no longer possible, governance programs should stop promising it. Practitioners should evaluate trade-offs, document risk transparently, and focus on defensible disposition.
IT Secures It, Privacy Limits It, Governance Proves It
The conference sessions provided a simple way to divide operational responsibilities:
- IT secures it: IT manages system architecture, security controls, and access permissions.
- Privacy limits it: Privacy teams set boundaries on data collection, retention, and acceptable use.
- Information governance proves it: IG establishes context, validation, and compliance framework rules.
This framework extends to modern technical deployments. Sessions on tools like Microsoft Purview showed how organizations govern what AI assistants like Copilot can access. File plans, sensitivity labels, and records categories remain essential tools for managing data access and visibility.
What to Do Next
To prepare your information governance program for AI integration, focus on these practical actions:
- Join the AI conversation: Connect with IT, legal, and risk management teams to ensure governance requirements are included in AI planning and vendor reviews.
- Update core classification controls: Review file plans, sensitivity labels, and permissions in systems like Microsoft Purview to control what AI systems can index.
- Adopt risk-based retention standards: Document retention decisions around acceptable confidence levels and operational risk instead of promising total control.
- Assess your program baseline: Take the free 8-question assessment using the IG Navigator to evaluate your current governance standing, and access our template library for operational governance tools.