How do you make enterprise information ready for AI?

Key takeaways

• AI is only as powerful as the information it can access. Whatever tool you choose answers from what it can reach, so the state of your information decides how accurate and how safe its answers are.
• Gartner predicts that organisations will abandon 60% of AI projects unsupported by AI-ready data through 2026.
• Malaysia’s Personal Data Protection Department has proposed an AI and Personal Data Protection Framework. Its draft asks organisations to check, before using an outside AI system, whether personal data will be reused for model training and where it will be stored or processed.
• The same four checks apply whichever AI or repository you use: organised, accessible, governed and protected.
• Docuflo serves as the information governance layer between your enterprise information and AI.

Why does AI readiness start with your information, not the AI tool?

Every enterprise AI tool, whether an assistant, a chatbot over your own documents or an automated agent, works from the information it can retrieve. If that information is outdated, duplicated, scattered or shared too widely, AI repeats the problem faster and at a larger scale. As we put it on our AI strategy page: the problem is not AI capability. It is information readiness.

Research firm Gartner found the same gap. In a survey of 1,203 data management leaders in July 2024, 63% of organisations either did not have, or were unsure whether they had, the right data management practices for AI. Gartner also notes that data “is often collected in siloes across various repositories, multiple systems and platforms”, which describes where many enterprise documents sit today.

“Above all, if the data has issues, then the data is not ready for AI.”

Source: Gartner, Lack of AI-Ready Data Puts AI Projects at Risk, 26 February 2025

What does AI-ready information look like?

Before you expose information to AI, check it against four properties. They sit on top of the five properties of governed information we work with (trusted, accessible, connected, structured and secure), and each line below needs an owner in IT, records management or compliance.

How do you stop AI from surfacing information people should not see?

Start with permissions, because many enterprise AI tools answer from whatever the user is already allowed to open. Microsoft, for example, states that its Copilot “only surfaces organizational data to which individual users have at least view permissions”. An overshared folder therefore becomes an overshared answer, whichever vendor’s AI reads it.

1. Review who can open what. Remove company-wide sharing from folders that hold contracts, HR files, customer records or board papers, and set access by role.
2. Separate personal and sensitive data. Mask it in test and analytics copies, as described on our data masking page, or keep it out of the AI’s reach altogether.
3. Log every access. An audit trail shows which records were opened, by whom and when, which is what compliance and risk teams ask for before they approve an AI use case.
4. Stop sensitive data from leaving. Malaysia’s draft AI and personal data framework names data loss prevention controls that detect and block unauthorised transfer of personal data, including identifiers, to external AI models or APIs, and access to AI systems on a need-to-know basis.

What does Malaysia’s proposed AI and personal data framework ask of organisations?

On 5 October 2026, the Personal Data Protection Department (JPDP) opened Public Consultation Paper 1/2026 on a proposed AI and Personal Data Protection Framework under the Personal Data Protection Act 2010 (Act 709), with comments due by 23 October 2026. It is still a draft, published in Malay. It covers AI built in-house, bought off the shelf, customised, or embedded in SaaS platforms and APIs. The points that bear on information readiness:

• Before acquiring, integrating or using an outside AI system, carry out due diligence, including whether personal data will be stored, reused or used for model training or fine-tuning, and whether it will be processed or transferred across borders (section 20.2).
• For cross-border transfers, weigh the country where personal data will be stored or processed and who may have access to it (section 22.3).
• Protect personal data throughout AI processing: collection, transmission, storage, use, access and disposal. Measures can include access controls, encryption, and logging and monitoring of access (sections 32.3 and 32.4).
• Keep personal data processed through AI accurate, complete, not misleading and up to date (section 34.1).

These sit alongside Malaysia’s National Guidelines on AI Governance and Ethics, launched by the Ministry of Science, Technology and Innovation in September 2024. They are voluntary, and their third principle, privacy and data security, focuses on protecting personal information from misuse. For banks, insurers and government agencies, these come on top of the sector rules they already follow.

How do privacy, security and data sovereignty shape where your AI runs?

Data sovereignty is the question of where your information is stored and processed, and who controls it. For large enterprises and regulated industries such as financial services, it is a deciding question when choosing AI tools. Before any outside AI service touches your records, get clear answers to four questions:

1. Where will our data be stored, and where will it be processed?
2. Who at the provider, or at any provider it uses, can access it?
3. Will our data be kept, reused, or used to train or fine-tune models?
4. What happens to our data when we stop using the service?

Organisations that need to keep documents on infrastructure they control can host Docuflo’s enterprise version on premise. For organisations that want greater control over how their information is processed and consumed by AI, we also offer our Docuflo Private AI module.

Where does Docuflo fit between your information and AI?

AI is only as useful as the information it can access. When enterprise information is scattered across systems, outdated or poorly governed, AI may deliver incomplete or unreliable answers.

Docuflo provides the trusted information foundation that connects enterprise content with AI. It helps organisations organise, secure, govern and retrieve information so that both people and AI can work with the right content under the right access permissions.

• Organised and searchable. Centralise documents with classification, metadata indexing, version control and AI-powered document intelligence to make information easier to manage and retrieve.
• Accessible across systems. Find information through enterprise search, semantic AI search and integrations with other business systems. Docuflo Inventa supports federated search across connected repositories, subject to configured permissions.
• Governed throughout its lifecycle. Apply document retention policies, manage versions and maintain audit trails to support information accountability, compliance and defensible records management.
• Protected by design. Enforce access controls and appropriate security policies to protect sensitive information. Features such as encryption and Data Loss Prevention (DLP) help strengthen information security and support compliance requirements.
• Ready for AI. Use Docuflo’s AI capabilities, including semantic search and document summarisation, to extract value from enterprise content. With the Docuflo Copilot Connector, organisations can also make authorised Docuflo content available to Microsoft 365 Copilot, subject to the integration and permission configuration.

The principle is simple: AI is the interaction and intelligence layer; Docuflo provides the trusted information foundation behind it. By bringing enterprise content together with search, governance and security, Docuflo helps organisations build a stronger foundation for reliable, responsible and scalable AI adoption.

Frequently asked questions

Do we need Microsoft 365 or SharePoint to make our information AI-ready?

No. Neither Microsoft 365 nor SharePoint is required to establish an AI-ready information foundation. Docuflo can manage and govern your documents independently, with APIs to integrate with other business systems. If your organisation uses Microsoft Copilot, the Docuflo Copilot Connector provides an additional option to access authorised Docuflo content through Copilot.

What does AI-ready data mean?

It is information organised, accessible, governed and protected well enough for AI to use without spreading errors or exposing what it should not. Gartner describes proving AI readiness as “a process and a practice based on the availability of metadata to align, qualify and govern the data”, and stresses that it is not a one-off project.

Is Malaysia’s AI and personal data protection framework already in force?

Not yet. When we wrote this in October 2026, it was a proposed framework in a public consultation by the Personal Data Protection Department, with comments due by 23 October 2026. The Personal Data Protection Act 2010 (Act 709) already regulates the processing of personal data in commercial transactions; the draft framework explains how its requirements apply when that processing goes through AI systems.

What should we ask an AI vendor about our data?

Ask where your data will be stored and processed, who can access it, whether it will be kept, reused or used to train or fine-tune models, which other providers are involved, and how it is returned or deleted when the service ends. Malaysia’s draft AI and personal data framework covers the same points for outside AI systems.

Sources

1. Gartner: Lack of AI-Ready Data Puts AI Projects at Risk (26 February 2025)
2. Personal Data Protection Department: Public Consultation Paper 1/2026, AI and Personal Data Protection Framework (in Malay)
3. MyGOV: National Guidelines on AI Governance and Ethics (AIGE)
4. Personal Data Protection Department: Personal Data Protection Act 2010
5. Microsoft: Data, Privacy, and Security for Microsoft Copilot

Talk to InfoConnect

We have provided information and content management solutions since 1994, from our head office in Petaling Jaya, Selangor. To talk about document management, workflow or data governance for your organisation, contact our sales team.

Email sales@infoconnect.com.my Call +603-7722 2001 Contact page

Existing customers can reach our support team at support@infoconnect.com.my.