Data Governance Practices for Risk Management in Artificial Intelligence Implementation: A Systematic Literature Review

Organisations across finance, healthcare, public administration, and manufacturing have made artificial intelligence a central part of their operations. Yet a practical problem remains unsolved: practitioners still lack systematic, evidence-based guidance on which data governance practices reduce the risks that AI deployment brings. The existing literature addresses AI governance frameworks and responsible AI principles, but at a level of generality that offers limited operational value. No previous systematic literature review has assembled an empirically validated catalogue of data governance practices oriented specifically toward AI risk management. This study addresses that gap directly. Drawing on peer-reviewed empirical research published between 2020 and 2026, we followed the Kitchenham and Charters protocol and PRISMA 2020 guidelines, searched six electronic databases, and arrived at a final corpus of 21 high-quality studies. From these, we extracted and classified 96 data governance practices across eight domains: Data Infrastructure and Architecture Governance (D1), Data Lineage, Traceability and Auditability (D2), Data Quality and Integrity Risk Management (D3), Algorithmic Accountability, Explainability and Bias Control (D4), Data Privacy and Security Governance (D5), Regulatory Compliance and Legal Alignment (D6), AI Risk Assessment and Governance Framework (D7), and Organizational and Socio-Technical AI Governance (D8). D1, D7, and D8 together account for 57.3% of all practices. D4 is the thinnest domain, with only 6 practices (6.3%), even as regulatory pressure around explainability intensifies. Three domains, D4, D6, and D7, have no direct counterparts in DAMA-DMBOK, confirming that AI governance introduces requirements that conventional data management frameworks were not designed to handle. The mean quality assessment score across included studies was 5.57 out of 6.0. This catalogue is, to our knowledge, the first of its kind grounded entirely in empirical evidence from real-world organisational settings.