Practical lessons from the morning sessions: metadata reality, agent governance, and building demand for governance. 

ADG Summit is Australia’s biggest event for Data and AI Governance, run by DGX. On 20 August in Melbourne, we brought together 200+ delegates, more than 25 speakers, and our headline, gold and industry sponsors to share what works in the real world. 

This is Part 1 of the recap, covering the morning program.
Part 2 covers the afternoon sessions and the awards. 

Tim Moon opened by asking the room to look for a couple of gold nuggets rather than trying to absorb everything, and Conference Chair Chad Barendse set out why the agenda looked the way it did: AI has not created the governance problem; it has exposed the gaps that were already there. Here’s what stood out. 

Keynote: Real metadata architectures and what it means for AI use cases 

With Ole Olesen-Bagneux (Actian) 

Reference architectures never match reality. Ole’s case is for mapping the metadata repositories you already have across data, IT and information management, rather than drawing another diagram where everything points to one thing. He walked three real architectures built that way: FinOps, an application intake funnel, and metadata-fuelled AI. 

Key insights 

• Reference architectures are greenfield best practice and never match a real enterprise 

• Metadata repositories arrive in waves and overlap: CMDBs, catalogs, lineage tools, ISMS, quality systems 

• Map what exists, find the overlaps, match metadata across repositories (the MetaGrid) 

• Low-tech by design: spreadsheets, diagrams, a little scripting 

• Ignoring existing reality creates semantic debt, team conflict and non-adoption every time 

• Payoff: work faster, reduce cost, accelerate AI adoption 

Standout quote 

“Reference architectures provide greenfield best practices for metadata management, and these never match reality. Never ever. I’m willing to take a bet with any one of you.” 

Ole Olesen-Bagneux, Actian 

Keynote: The Governance Brain: Designing the Socio-Technical System for Autonomous AI 

With Kelly Bayer Rosmarin (Aigentsphere) 

Agents are neither deterministic software nor people, so neither existing governance model fits. Kelly made the case for a governance brain: visibility, control and accountability for every agent, run as a loop rather than a launch approval. Her real example of an agent locked out of PII that started asking customers for it directly got referenced by four later speakers. 

Key insights 

• Govern purpose, authority, accountability, context and assurance for every agent 

• Identity is three things: technical identity, accountability, authority, linked by delegation and evidence 

• Know Your Agent as an operating assurance model, not a deployment checklist 

• Human in the loop degrades: people are not motivated to check AI output at speed 

• Launch approval is point in time, risk is not 

• Start with an agent inventory, then KYA, then continuous monitoring 

Standout quote 

“We’re not being asked to manage static data and deterministic systems. We’re being asked to be the architects of trusted autonomy.” 

Kelly Bayer Rosmarin, Aigentsphere 

Panel: The Future of Data Governance in an AI World 

With Laura Omero (Standard Chartered), Raghavendra Rojkhird (Angle Auto Finance), Cameron Towt (Bupa). Moderator: Subhrajit Banik (DAMA Melbourne) 

Why governance suddenly has board attention, where AI governance sits, and what breaks when it splits from data governance. The panel converged on a different focus rather than a different discipline, and on an operating model that stops relying on herding reluctant stewards. 

Key insights 

• Frame the investment case as AI safety and anchor it to the regulator’s own words 

• AI raised the maturity bar and widened the scope: periodic manual quality checks no longer survive 

• AI governance closer to line two risk, data governance closer to the CDO, with unified oversight 

• Governance engineering: a rule in code is enforced, a rule in a PDF is aspirational 

• Use agents to set stewards up for success, not to replace design and accountability 

• Twelve months is enough to approve a framework, nowhere near enough to implement one 

Standout quote 

“Neither. You govern outcomes.” 

Cameron Towt, Bupa, asked whether data governs AI or AI governs data 

 

Keynote: Be the first call: Building demand for governance when nobody has to listen 

With Clare Kitching (Cambiq) 

How to build demand for governance when you have no formal authority, a small team and no exec cover. Clare mapped the cast you meet in every organisation, from the Builder to the Missing Exec, and what each one needs from you. The room added the cyber team, and from the floor, the Hidden Governor. 

Key insights 

• Governance is already happening somewhere in your organisation, badly, and that person will care 

• People do what gets their own priorities achieved 

• Map your cast, follow the energy, tier by value 

• Rebadge “owner” if the title is what people are avoiding 

• Aim for one win, then one number, then one story timed to the board cycle 

• Every organisation believes it is uniquely regulated and different 

Standout quote 

“Help one person achieve one priority next week and start to build that momentum.” 

Clare Kitching, Cambiq 

Fireside: Trusted AI starts with trusted data: quality, ownership and governance in practice 

With Zak Armstrong (Experian) and Belinda Toniolo (RACV) 

The practical view for teams not yet ready for agentic AI. Belinda opened with a show of hands on whose governance team is bigger than their AI team. Almost none, and that gap sets the strategy: targeting beats coverage. 

Key insights 

• Governance teams are outnumbered, so pick where the business will reach for AI first 

• AI ready means the data is fit for purpose, understood and at the right quality level 

• AI readiness means something different to cyber than it does to governance 

• AI cannot invent data you never collected 

• Governance is the enterprise-wide connection point, because business units look vertically 

• Number one deliverable upward: an honest statement of how ready the data actually is 

Standout quote 

“We’re business partners. We’re not back end of the technology team hiding in the corner.” 

Belinda Toniolo, RACV 

Panel: Practical AI Governance: What It Actually Takes 

With Fernando Mourão (Seek), Paola Oliva Altamirano (SmartyGrants), Bikram Choudhury (Accenture). Moderator: Paul Towers (Xinference) 

Beyond principles and policy documents, what governance looks like day to day. The shared answer: govern proportionately, lead with the problem rather than the tool, and start early enough that governance accelerates delivery instead of blocking it. 

Key insights 

• Policies and frameworks are the skeleton, not the governance 

• Not every use case needs equal governance: fast-track low risk, scrutinise high risk 

• Lead with the problem, because much AI demand is workflow friction that needs a dashboard 

• Allow experimentation on mock data, never client data, then bring it back into process 

• Design for testability: ship the agents that test your product agents first 

• Treat an agent like a hire: role, probation, evaluation, ongoing management 

• Start governance early and it accelerates, add it later and it slows you down 

Standout quote 

“People precede processes, and processes precede technology. I spend about seventy percent of my time talking to people.” 

Fernando Mourão, Seek 

Keynote: Strategic privacy engineering for low-debt data governance 

With Phillip Ward (Canva) 

Compliance gaps modelled as debt. The principal is the gap between what customers expect and what your systems actually do, the interest is a tax on growth, and it compounds daily whether you act or not. Phil shared the five principles his team uses to prioritise the backlog at Canva. 

Key insights 

• Momentum first: prioritise work that makes everything after it faster, and put fires last 

• Avoid new fires: change tomorrow’s default before remediating yesterday’s gaps 

• Empower allies: get into the engineering handbook, not just the policy library 

• Automate assessments, because survey-based compliance is stale on arrival 

• Decoupling: teams describe their system, you deploy policy as code 

• Regulators are lenient about legacy on a backlog, not about systems built after your policy 

• Name the real cost of debt: initiatives you cannot green-light and deals you slow down 

Standout quote 

“Every time I see a Google Form link, I cringe. It is compliance theatre. Just say the emperor’s naked.” 

Phillip Ward, Canva 

That’s the morning. Part 2 covers the afternoon program: governance engineering, AI security and MCPs, an executive perspective from UniSuper, human centred governance, semantic layers, and the awards.