2.1. The Changing Landscape of Information Governance in AI-Enabled Systems

The rapid diffusion of data-driven AI-enabled systems has reshaped the scope of IG. As organisations increasingly operate through distributed, model-centric, and data-intensive architectures, governance challenges extend beyond conventional data management towards accountability, privacy, transparency, reliability, and lifecycle traceability. This shift is visible in healthcare, Industry 4.0, urban mobility, and cyber-physical environments, where heterogeneous and high-velocity data intensify governance complexity and magnify the risks of automated decision-making [5, 27–29]. Privacy threats are no longer confined to explicit identifiers, because AI systems can infer sensitive attributes from anonymised data, thereby challenging lawful use, integrity, and control of information [1, 30, 31]. Cloud-based LLMs and multi-agent generative AI further intensify these concerns by introducing opaque decision pathways and cross-organisational data flows [18]. Within this landscape, IG in AI-enabled systems is operationalised through interdependent functions designed to sustain trustworthy and compliant operation, including privacy protection, accountability and transparency, data quality assurance, regulatory compliance, and risk management. These functions are supported by technologies such as homomorphic encryption, differential privacy, federated learning, blockchain-based provenance, and XAI [14, 27, 32, 33]. AI has also become an enabler of governance by automating information extraction, document classification, audit preparation, and sensitive-content detection through natural language processing (NLP), machine learning (ML), and LLM-based workflows [34–37]. Accordingly, governance is no longer only imposed on AI infrastructures from outside, it is increasingly embedded within the infrastructures, pipelines, and workflows through which AI systems operate.

2.2. Human-Centred Governance and the Implementation Gap

Despite the growth of technical governance mechanisms, the reviewed literature repeatedly shows that AI-enabled IG cannot be reduced to privacy technologies, audit tools, or compliance checklists. Governance is enacted through people who define acceptable risk, interpret model outputs, allocate accountability, translate legal requirements into workflows, and decide when automated systems should be trusted, challenged, or constrained. This human-centred dimension is especially visible in high-stakes contexts, such as clinical decision support, public administration, and legal or auditing environments, where domain experts, managers, regulators, auditors, and affected communities mediate between technical system behaviour and institutional responsibility [16, 38–42]. The implementation gap therefore concerns not only the absence of governance tools but also the absence of clear role architectures, escalation pathways, cross-functional competencies, and feedback loops through which governance can adapt as AI systems evolve. Prior work identifies developer-centric bias as a persistent weakness because responsible AI tools often emphasise technical builders while underrepresenting organisational leaders, domain specialists, users, and communities affected by AI decisions [42]. A human-centred IG perspective responds to this gap by treating governance as a socio-technical practice distributed across technical, managerial, legal, ethical, and operational actors. This provides the basis for examining IG as a capability that must be learned, maintained, and reconfigured rather than as a fixed compliance routine.

2.3. Dynamic Capability Theory and Information Governance

Dynamic capability theory distinguishes adaptive organisational capabilities from ordinary operational routines. Teece et al. conceptualise dynamic capabilities as the capacity to integrate, build, and reconfigure internal and external competences in response to rapidly changing environments [20]. Eisenhardt and Martin further argue that dynamic capabilities consist of identifiable processes, such as product development, strategic decision-making, and alliancing, whose value depends on how they help organisations adapt under changing conditions [21]. Teece later specifies the microfoundations of dynamic capabilities as sensing, seizing, and reconfiguring [22].

This distinction is important for the present review because not every governance routine is dynamic. Codified policies, audit forms, and compliance workflows may stabilise organisational behaviour, but they become dynamic capabilities only when they enable organisations to detect changing AI-related risks, convert those signals into governance action, and reconfigure technical, procedural, and human resources. In AI-enabled IG, sensing includes detecting data quality failures, privacy leakage, model drift, accountability gaps, and regulatory change. Seizing includes embedding privacy-preserving architectures, explainability tools, audit mechanisms, and role allocations into AI workflows. Reconfiguring includes revising governance structures, professional competencies, and workflow responsibilities as technologies and institutional expectations evolve. This framework anchors the review’s claim that IG can function as a dynamic capability rather than merely as a static compliance instrument.

2.4. Previous Works

Prior studies on AIG define governance as a multidimensional system aligned with organisational strategy and ethical principles [23, 24]. Related reviews have mapped AI governance principles, responsible AI tools, ethical frameworks, and general data governance mechanisms [24–26, 42]. However, these reviews tend to emphasise either broad governance themes, ethical principles, or data governance concepts while offering limited synthesis of how operational IG functions, AI technologies, human roles, and competencies interact as a dynamic organisational capability. The present study therefore focuses on implementation-oriented IG within data-driven AI-enabled systems and positions human agency, technical enablers, and organisational adaptation as interdependent elements of governance. As shown in Figure 1 and Tables 1 and 2, prior research is concentrated in theoretical, ethical, or techno-centric domains, while implementation-oriented work remains fragmented across sectors and often focused on developer-centric tools. Consequently, a major gap persists in integrating procedural IG implementation, non-technical actors, and hybrid competencies within a unified socio-technical governance perspective across the AI lifecycle.

Figure 1

Strategic mapping of research maturity and target novelty area.

4.1. Mapping IG Functions

Studies identify five recurring IG functions across the AI data and model lifecycle: accountability and transparency, data quality and integrity, ethical and privacy-by-design governance, compliance and audit assurance, and security and risk management. Across the reviewed sectors, the most consistently emphasised functions are accountability, data quality, and privacy-oriented governance, reflecting shared concerns with traceability, reliability, and lawful data use in increasingly distributed AI environments. Accountability and transparency are typically operationalised through model explanation tools, provenance capture, and process documentation that support reviewability and post hoc justification [70–72]. In parallel, data quality and integrity are treated as foundational to institutional trust, with studies highlighting metadata governance, audit trails, and alignment with FAIR and International Organization for Standardization (ISO) standards to preserve accuracy across the lifecycle [10, 73, 74]. Ethical and privacy-by-design mechanisms further reinforce these functions by embedding fairness, consent, and explainability into both design-time and run-time governance through approaches such as federated learning, differential privacy, and institutional review board (IRB)-aligned oversight [13, 31, 75].

The remaining functions, namely compliance and audit assurance, and security and risk management, most often appear as mechanisms that institutionalise and sustain these core governance priorities under sector-specific constraints. In healthcare, IG functions are closely tied to patient safety, privacy protection, and visible human oversight; in industrial settings, they are oriented towards operational resilience, real-time monitoring, and document or process traceability; while in public administration, they are linked more strongly to auditability, regulatory legitimacy, and formal accountability structures [19, 29, 76, 77]. Across these contexts, compliance is commonly enacted through data protection impact assessments (DPIAs), telemetry, and human-in-the-loop controls aligned with General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), or the European Union (EU) AI Act, whereas security and risk management support prevention, detection, and response through access governance, anomaly detection, privacy budgets, and tamper-evident controls [17, 78–80]. However, the literature also reveals unresolved tensions, particularly fragmented accountability structures, uneven governance maturity, and persistent trade-offs between transparency, confidentiality, and operational efficiency in distributed deployments [9, 15, 35, 81]. Table 6 summarises the thematic mapping of these IG functions, while the complete study-to-theme mapping is provided in Table S1.

4.2. Mapping AI Technologies Supporting Information Governance

Studies identify six recurring technological clusters that support IG in AI-enabled systems: privacy-preserving collaboration through federated learning, ethical and responsible AI design in machine-learning operations (MLOps), AI–blockchain integration, ML for anomaly detection, deep learning for information extraction, and AI-driven risk assessment. Across the literature, the dominant patterns are privacy-preserving collaboration, governance-by-design in MLOps, and infrastructure-level traceability, indicating that AI-enabled IG is increasingly operationalised through distributed, auditable, and privacy-aware architectures. Federated learning and related privacy-enhancing technologies are the most frequently reported enablers, supporting model training without raw data exchange through differential privacy, homomorphic encryption, secure multiparty computation, and adaptations for heterogeneous environments [31, 81, 84, 85]. Ethical and responsible AI design complements these mechanisms by embedding fairness-aware learning, explainability, accountability-by-design, and continuous monitoring within MLOps pipelines, while AI–blockchain integration strengthens provenance, consent automation, and decentralised trust across organisational boundaries [11, 12, 29, 83, 86–88].

The remaining clusters, namely anomaly detection, information extraction, and AI-driven risk assessment, mainly function as operational tools for monitoring, multimodal oversight, and adaptive security response. Their emphasis varies by context: anomaly detection is more prominent in transactional and infrastructure-heavy settings, information extraction in document-intensive and multimodal environments, and risk-assessment tools where policy verification and threat propagation require continuous tracking [9, 70, 79, 89, 90]. Across sectors, however, the literature highlights persistent tensions, including scalability and latency constraints in federated and blockchain-based systems, performance-interpretability trade-offs in fairness-aware and explainability-driven models, and the limited generalisability of monitoring tools across governance contexts [2, 28, 72, 91]. Taken together, these findings suggest that AI technologies increasingly embed governance logic within the technical infrastructure of AI systems rather than merely supporting it from the outside. Table 7 summarises the technological clusters supporting information governance, while the complete study-to-theme mapping is provided in Table S2.

4.3. Mapping Human Roles and Responsibilities in AI-Driven Governance Systems

The literature identifies five recurring role clusters in AI-enabled IG: ethical and governance oversight, technical development and validation, policy and regulatory frameworks, quality assurance and traceability, and system design and workflow integration. Across these clusters, the most dominant patterns are ethical oversight, technical validation, and regulatory coordination, showing that human involvement in AI governance is distributed across strategic, operational, and technical layers rather than concentrated in a single role. Ethical oversight remains central because developers, ethicists, and domain experts jointly sustain fairness, transparency, and professional accountability through human-in-the-loop arrangements, particularly in high-stakes contexts, such as healthcare and justice [31, 73, 94–96]. Technical development and validation roles support this oversight through reproducible architectures, fairness testing, drift detection, and privacy-preserving controls, while policy and regulatory roles translate ethical principles into enforceable mechanisms through legal obligations, consent requirements, and escalation pathways [17, 29, 36, 85, 97–99].

The remaining clusters, namely quality assurance and traceability, and system design and workflow integration, mainly function as operational mechanisms that embed governance into daily practice. Quality assurance roles emphasise audit trails, lineage records, and verification controls, whereas workflow integration roles embed governance requirements into development & operations (DevOps) and MLOps processes through interpretable interfaces and privacy-oriented system design [19, 30, 83, 86]. Their importance varies by context: regulated sectors prioritise traceability and formal accountability, while deployment-intensive settings emphasise integration and operational continuity. Across sectors, however, the literature highlights persistent tensions between rapid technical innovation and slower ethical or regulatory review as well as challenges in maintaining clear accountability across multiple actors and layers [1, 6, 8, 77]. Taken together, these findings suggest that human roles in AI-enabled IG are best understood as an interconnected governance architecture rather than a set of isolated responsibilities. Table 8 summarises the human roles and responsibilities in AI-driven governance systems, while the complete study-to-theme mapping is provided in Table S3.

4.4. Mapping Competencies and Skill Sets within the AI-Enabled IG Domain

The reviewed studies identify five recurring competency clusters for governing AI-enabled information systems: ethical and governance literacy, collaborative and legal awareness, technical and analytical proficiency, experimental and evaluation skills, and human-centred socio-technical competence. Across these clusters, the most dominant capabilities are governance literacy, technical–analytical proficiency, and cross-functional legal collaboration, indicating that effective IG depends on the ability to connect ethical principles, regulatory requirements, and system performance in practice. Governance literacy is central because professionals must translate fairness, accountability, and privacy into operational controls, while technical–analytical proficiency supports system design, monitoring, validation, and the use of privacy-enhancing and explainability tools [10, 17, 89, 97, 99]. Collaborative and legal awareness further enables coordination across disciplines and jurisdictions, particularly in relation to GDPR, consent, and cross-border data governance [15, 18, 86, 102].

Experimental and evaluation skills, together with human-centred socio-technical competence, mainly appear as operational capabilities that sustain governance in practice. These include auditing privacy-utility trade-offs, testing robustness, calibrating trust, and aligning system design with organisational and cultural contexts [3, 11, 33, 70, 81, 103, 107]. Their relative emphasis varies by sector: regulated environments prioritise legal literacy and auditability, whereas deployment-intensive settings stress technical validation and operational resilience. Across contexts, however, the literature reveals a persistent tension between rising governance complexity and the limited availability of professionals able to bridge compliance, engineering, and human-centred implementation. Taken together, these findings suggest that competency in AI-enabled IG is best understood as a hybrid capability architecture rather than a set of isolated skills. Table 9 summarises these competencies and skill sets, while the complete study-to-theme mapping is provided in Table S4.