Risk Management for Unstructured Data

David Jensen

August 24, 2026

8 mins

Artificial intelligence (AI) is a pivotal technology for today’s enterprises. The data-driven future accompanied by AI seems promising, but the foundation of any AI application is relevant, comprehensive, and up-to-date data. AI uses data to train its models. Therefore, quality data is necessary for AI applications to function properly and produce accurate outcomes. That said, there are still many limitations to AI, given the amount of data fragmented across the cloud, applications, data warehouses, documents, streaming systems, and on-premises environments that are unstructured. This data is scattered and even nebulous throughout the organization, but it’s vital for effectively training AI models, so it must be gathered, managed, and kept secure.

What Is Unstructured Data?

Unstructured data is often in formats that lack standardization and doesn’t easily align with the schemas of conventional databases. Therefore, it requires significant preprocessing. Digital unstructured data is a valuable source of information that may not exist in a format that is immediately usable for AI purposes. However, when combined with structured data, it provides a complete view of data across an enterprise.

Despite its value, unstructured data is challenging to manage, store, and locate when needed. Most companies accumulate content that lives in various file shares, collaboration tools, and archives. The issue is that the data may be unclassified, untagged, and siloed. Without a strategy and the necessary tools, it can be difficult to organize, manage, and ensure its quality.

Unstructured data needs context (including metadata) and a clear understanding of how it fits within the organization’s data framework. This is how the unstructured data is transformed into data that’s interpretable and usable for AI. Examples of unstructured data include:

Emails and chat transcripts
Text files
PDFs
Blogs
Social media posts and web content
Content from scanned forms, reports, and handwritten notes
Slide decks, spreadsheets, and even code comments
Video files

Unstructured data can also be nontextual, including image files (JPEG, GIF, and PNG), multimedia files, video files, mobile activity, and sensor data from Internet of Things (IoT) devices.

How Structured Data Becomes Unstructured Data

When data is printed, saved as a PDF, or scanned into unmanaged folders, it becomes unstructured because it’s in a format that doesn’t fit in a relational database structure of predefined rows and columns. Consequently, it becomes inaccessible to AI workflows and data analytics.

Essentially, the data becomes dark (information that has been collected but not actively used or analyzed). Dark data eludes compliance controls, bypasses AI workflows, and quickly becomes an organizational liability. For businesses in regulated industries, managing unstructured data and documents, both print and digital, becomes more complicated.

The characteristics of dark data include:

Lacks properly documented metadata.
May or may not be known to the organization.
Lacks data governance.

Why Is Unstructured Data Important?

Unstructured data is diverse, flexible, and infused with insights that may not exist in structured datasets. This data is commonly stored in its native format until needed. This means companies could be harboring stores of untapped, unstructured data. The insights gathered from this data can be valuable for:

Better business intelligence.
Measuring customer sentiment, needs, and buying behaviors.
Accumulating vast amounts of information that’s easy and inexpensive to store.
Revealing insights into supply chain risk.

Finally, without access to all available structured and unstructured data, AI outputs and subsequent decisions can be incomplete, inconsistent, biased, or difficult to defend.

Inherent Risks of Unstructured Data

According to Gartner, “Roughly 80% of enterprise information is unstructured, spread across documents, files, and rich content in dozens of systems.”1 Unstructured data exists in formats that are not easy to compile and organize. When it continues to accumulate, it becomes more unwieldy. Common risks with unstructured data include:

Operational challenges. Unstructured data doesn’t conform to any standard, which makes it difficult to manage and search. But this data is valuable, so it’s important to know where it is and what it contains.
Data privacy and security. Unstructured data often contains sensitive information, such as Personally Identifiable Information (PII) or confidential intellectual property. Improper management of this data increases the risk of data breaches, potentially leading to regulatory fines and reputational damage.
Regulatory violations. Keeping unstructured data longer than necessary may violate data retention and disposal policies. In regulated industries, non-compliance with data retention guidelines can lead to significant fines and legal consequences.
Data oversight challenges. Organizations are drowning in data. Effective data management requires visibility into the entire data ecosystem. Unstructured data is difficult to track, classify, and manage.

Managing Unstructured Data Risks

Data Privacy and Security

As your organization’s data accumulates across providers, SaaS applications, and endpoints, your risk of a data breach also increases. Hackers and cybercriminals continue to develop ways to exploit security vulnerabilities to access sensitive data that is spread across multiple cloud data centers and data stores.

“One of the biggest security challenges with unstructured data is the lack of visibility and lineage as information moves across systems, clouds, and teams,” says Jack Berkowitz, chief data officer at Securiti. “When organizations cannot track where data originated, how it has changed—even what version is active or whether it is still relevant—they increase the risk of exposing sensitive or inaccurate data through genAI applications.”

Establish a Zero Trust Architecture

A Zero Trust architecture (ZTA) is a pivotal strategy that tightens data governance and security. The idea is to prevent unauthorized access by making access to data services as granular as possible. Zero Trust networks break an environment into smaller, isolated zones. Even if an attacker gains access to one server, they are isolated from the rest of the network, preventing lateral movement. As the title suggests, Zero Trust means trusting nothing by default—every user, service, and data flow has to prove itself.

In a Zero Trust architecture, effective data privacy and security risk management should be built around these principles:

Verify everything. Authenticate every access. All users and services must have a strictly defined identity. Organizations typically enforce multi-factor authentication (MFA) and adaptive risk-based access policies to ensure that only legitimate users access systems.
Enforce device security. Zero Trust cannot be limited to users. The devices that connect to the network must also be vetted. Devices must be continuously monitored for security compliance, software updates, and potential malware before and during any connection.
Tightly oversee access permissions. Use metadata to assign only what’s needed for users to perform their tasks.
Always assume the worst. Encrypt all data at rest and in transit, isolate networks, and continuously monitor all systems and data.

These security measures are designed to protect structured and unstructured data alike, so it’s important to establish and adhere to data protection policies.

Compliance and Regulatory Risks

Businesses are advised to properly manage their data to save costs, improve operational efficiency, and comply with data management regulations. One of the more common regulatory guidelines of data management is data retention. An organization should only retain data for as long as the regulatory guidelines dictate. The company needs to determine the retention period based on the type of data and specific regulations and include them in the business’s data retention policy.

A data retention policy is a critical part of an organization's overall data management strategy. The policy ensures that older, potentially sensitive data that is no longer needed is disposed of properly. Data management best practices for regulatory compliance risk include:

Identify legal and regulatory requirements. An organization must determine which laws and regulations governing data retention apply to the business and incorporate those requirements into its data retention policy.
Consider data types when crafting a data retention policy. Some data is either more valuable or has different retention guidelines than other data. Therefore, creating a blanket data retention policy is not feasible. Instead, define the data types that must be retained and establish a relevant data retention policy for each type.
Adopt an effective data archiving system. Some regulatory guidelines require that certain types of data be retained for longer than the business needs them. Setting up a data archival system (long-term data storage repository for inactive data) can help keep data organized and secure, reduce data storage costs, and meet compliance requirements.
Create two versions of your data retention policy. Organizations are likely required to document their data retention requirements in a manner that satisfies regulatory requirements. As a best practice, draft both a legal version and a simpler version designed for the organization and stakeholders to better understand retention requirements.

Data Oversight Challenges

Because unstructured data does not have a predefined format or storage place, it is at risk of human errors, data inconsistencies, or duplication. Inaccurate or incomplete data can result in misguided strategies and ineffective operations. The downstream effects can be costly in many ways.

Consider a scenario where healthcare providers rely on electronic health records to make important decisions. If critical information is locked in documents and never reaches decision-makers, or if there are data quality issues, it becomes a patient safety risk. Similarly, in finance or government, insufficient or poor quality data inevitably leads to flawed data-driven decision-making.

One of the most persistent data management challenges is the existence of data silos. These occur when different departments (operations, marketing, sales, finance) store their respective data separately, using different software and formats. Varying formats and incompatible data systems undermine integration efforts, making data management and governance arduous and expensive.

For example, when a sales team cannot see the service history maintained by the support team, the sales staff lacks a clear view of the customer. This fragmentation prevents real-time data processing and hinders information flow across the enterprise.

Organizations are adopting data integration processes and platforms that standardize data models to promote interoperability. Integrating different data sources is often the first step toward establishing an end-to-end data pipeline. Encouraging data sharing across teams can help break down these silos, ensuring that valuable insights aren’t locked away in forgotten repositories or spreadsheets.

Effective data oversight establishes accountability, sets data standards, and ensures compliance within organizations. Best practices for effective data oversight include:

Establish data ownership. Effective data governance starts with understanding what data exists, where it is, its relevance, and who owns specific data domains to ensure accountability.
Implement cross-functional data stewardship. Assign responsible individuals to oversee data quality, security, accuracy, accessibility, and compliance.
Audit data management activities. Track all data management activities (classification, retention, redaction, disposal). This supports internal oversight and provides compliance officers with the necessary documentation for audits.

Harness Structured and Unstructured Data

Organizational business units seek to get the right data at the right time. When companies have data (structured and unstructured) stored across multiple platforms and systems, they need a process for integrating and analyzing the data for it to be useful in decision-making. In the era of AI, this type of integration is within reach, which enables organizations to leverage all of the data at their disposal. Employing AI automates data integration, which significantly speeds up data handling tasks.

Intelligent Print Automation (IPA) enables organizations to keep data from going dark by integrating applications and intelligently routing documents to approved destinations, helping organizations maintain data governance and accessibility. Ultimately, this ensures that your organization's business intelligence does not go dark. Every print, scan, and system output becomes structured data your AI strategy can build on.

Gain the most value from your structured and unstructured data and the full potential of AI technology throughout all of your business units, operations, and supply chain. Learn more about the benefits of IPA for your organization.

1. Gartner, Navigating the Solutions Landscape for Managing Documents, Marko Sillanpaa, 26 February 2026.

GARTNER is a trademark of Gartner, Inc. and/or its affiliates.