Enterprise AI starts with the company’s data

Ask an AI system why a company’s profit is falling, and the quality of its answer depends on what it can see.

Sales figures might show revenue growing. Purchasing records might show higher costs. Customer agreements might contain discounts that have not reached the latest forecast. Each tells part of the story. Understanding what happened requires bringing those pieces together and checking whether they support the explanation.

This is why corporate data is the foundation of enterprise AI. It holds the records of how a business operates: what it sells, what it owes, what it has promised and what actually happened.

The intelligence built on top depends on the strength of that foundation.

In a recent discussion, Western Digital CEO Irving Tan described AI as a data system. His argument focuses on infrastructure: data needs to be moved, accessed, stored and preserved, with performance, reliability and economics considered together. It is a useful reminder that AI depends on an entire architecture working well. Western Digital

For a business, that argument extends to the meaning of the data itself.

A figure labelled “revenue” can mean different things across departments. Sales might be referring to signed orders, finance to recognised revenue, and a manager to cash received. Each figure answers a different question. Bringing them together without preserving those distinctions can produce a misleading conclusion, even when the underlying numbers are accurate.

IBM makes a related point in its discussion of enterprise AI: information needs business context, including definitions, relationships, ownership and knowledge of where records came from. These details help a system determine which information is relevant and how it should be interpreted. IBM

Generative AI can produce an answer with links to supporting documents. That is valuable because it gives people a way to inspect the evidence and challenge the conclusion.

But a citation does not establish that the answer is correct, that the information may be disclosed, or that an action based on it is authorised.

Consider a manager asking when a customer’s payment is due. The AI retrieves a signed contract, finds a 30-day payment term and cites the exact clause. The document is genuine and the quotation is accurate. However, a later amendment changed the term to 60 days. If the system misses that amendment, its answer is wrong for the decision the manager needs to make.

The problem is incomplete evidence. A similar issue arises when an answer cites real sales and cost reports but compares different periods, mixes currencies or overlooks returns. The references make the answer easier to inspect. They do not validate the calculation.

Research reflects this distinction. The ALCE benchmark evaluates answer correctness and citation quality separately. Microsoft’s guidance for evaluating retrieval-based AI also distinguishes correctness, completeness, relevance and whether an answer is supported by the supplied material. An answer can faithfully reflect what was retrieved while still being incomplete or incorrect. ALCE research, Microsoft evaluation guidance

Accuracy is also only one part of responsible business use. An AI system could retrieve a confidential employee record and summarise it correctly for someone who should never have had access. Nothing about the accuracy of that summary makes the disclosure appropriate.

Organisations therefore need to establish where information came from, who may access it and whether it may be used for the intended purpose. Privacy requirements, contractual restrictions and internal policies may affect how data can be processed or shared. NIST’s generative AI guidance addresses provenance, privacy, intellectual property and oversight alongside source verification. These require separate attention; a citation cannot demonstrate compliance on its own. NIST Generative AI Profile

AI agents make these questions more consequential because they can act on the information they retrieve. An agent may send a message, update a customer record, change an order or initiate a transaction. A mistaken interpretation can then affect another person or system before anyone reviews the answer.

An agent preparing a payment reminder, for example, should check the current payment terms and whether payment has already arrived. Before sending the reminder, the system should verify the recipient and the agent’s authority to communicate on the company’s behalf. Citing the original invoice resolves only part of the task.

OWASP recommends limiting agents’ permissions, enforcing authorisation in connected systems and requiring human approval for high-impact actions. These checks should operate through the systems and tools an agent uses, rather than depend on the model deciding for itself what it is allowed to do. OWASP Excessive Agency

A practical starting point is to examine one business workflow from beginning to end. Identify the records it depends on, who maintains them, how updates are reflected and which access rules apply. Test what happens when a document is outdated, two records conflict or a user requests restricted information. When evidence or permission is missing, the system should make that gap visible and route it to the responsible person before proceeding.

Return to the question of falling profit. A useful answer should show which figures were compared, how costs and discounts were treated, and what information remains missing. It should distinguish a possible explanation from a verified cause. The people responsible for the decision should be able to inspect the evidence and understand what still needs checking.

That is the practical significance of treating AI as a data system. The foundation includes the records themselves, their meaning and the rules governing their use. Reliable business intelligence depends on how well those parts work together.

For practical next steps, see the enterprise AI pilot checklist and the business guide to AI governance.

Quick answers

Why does enterprise AI depend on company data?

Company records provide the evidence and business context needed to answer questions about operations, costs, customers and commitments. Their quality, completeness and meaning affect the reliability of the answer.

Do citations make an AI answer trustworthy?

Citations help people inspect the evidence. They do not establish that the evidence is current or complete, that calculations are correct, or that the information may be disclosed.

What extra checks do AI agents need?

Agents need permissions appropriate to the task, authorisation enforced by connected systems and approval for high-impact actions. Missing evidence or unclear authority should be resolved before proceeding.