Anjana Data

From AI pilots to compliance with the AI Act: a pragmatic approach to AI governance

clara — Thu, 11 Jun 2026 09:06:52 UTC

The conversation around artificial intelligence has changed radically over the past two years.

Many organisations began by experimenting with conversational assistants, co-pilots, predictive models or intelligent agents. Some achieved promising results. Others quickly discovered that deploying AI in production is far more complex than running a proof of concept.

Today, the questions are no longer purely technological:

What AI systems are actually in use?
Who is responsible for each of them?
What data do they use?
What risks do they pose?
How do we demonstrate that they operate safely, responsibly and in compliance with the regulations?

And as these questions become increasingly important, the regulatory landscape is evolving. Against this backdrop, there is a misconception in the market:

To meet these requirements, it is necessary to undertake complex, lengthy and costly projects.

The reality is quite different.

You don't need to go all out right from the start

Most organisations do not need to implement a Artificial Intelligence Management System (AIMS) fully operational from day one.

Some simply need:

Take stock of your AI systems.
Identify those responsible.
List models.
Document the data used.
Assess basic risks.
Keep records.

Others are already equipped to tackle more advanced scenarios relating to regulatory compliance, comprehensive risk management, impact assessments and audits.

That is why, at Anjana Data, we have designed our SGIA with a forward-thinking approach.

The platform allows you to start with the basics and gradually move towards advanced models of governance, compliance and auditing without having to switch tools, redo work that has already been done, or introduce new technologies every time the organisation’s level of maturity increases.

Technology supports the organisation as it evolves, rather than the other way round. This reduces the learning curve, makes change management easier and significantly speeds up time-to-value.

Once AI goes live, government involvement is no longer optional

Most organisations can manage one or two AI use cases in a relatively informal manner.

The problem arises when AI starts to scale up. New models, new teams, new suppliers, new data sources and new responsibilities emerge.

Organisations deploying artificial intelligence in Europe are no longer wondering whether they will have to comply with the AI Act 2024/1689, the ISO/IEC 42001 or the transparency requirements for GPAI models. The question is: when will the first inspection take place, and how long will it take us to respond?.

And in this context, specific questions arise that need to be answered reliably and promptly:

Which models are using personal data?
Which systems might be considered high-risk?
Who passed a particular assessment?
What mitigation measures are in place?
What evidence can we provide during an audit?
How do we demonstrate compliance with the AI Act?

Most people admit, in private, that the information needed to answer these questions is currently scattered across spreadsheets, PDFs on SharePoint and the MLOps team’s collective memory. And that’s unmanageable.

That is why the only viable option is to turn AI governance into a structured and operational process.

From the AI Act to an operational platform

At Anjana Data, we have applied artificial intelligence to the same process that we previously developed for data governance initiatives, corporate catalogues, data quality, data lineage, open data and data hubs.

Translate regulatory frameworks, standards and best practices into actual platform configurations without the need for development work.

The result is a Artificial Intelligence Management System (AIMS) deployable on the Anjana Data Platform, aligned with:

AI Act (EU Regulation 2024/1689).
ISO/IEC 42001.
ISO/IEC 23894.
ISO/IEC 42005.
ISO/IEC 22989.
UNE 0077.
UNE 0078.
UNE 0079.

This is neither a concept model nor a future proposal. It is an actual configuration that we deploy in production environments.

A model designed to grow alongside the organisation

The great advantage of a metadata- and configuration-based approach is that it allows for seamless evolution.

An organisation can start by managing only:

AI systems.
Models.
Use cases.
Those responsible.
Basic risks.

And subsequently incorporate more advanced capabilities such as:

Impact assessments.
Comprehensive risk management.
Technical documentation.
Compliance with the AI Act.
GPAI model management.
Operational observability.
Ongoing audit.

All of this on the same platform, with the same user experience and ensuring full traceability of the information.

The core of the SGIA: governance, risk and traceability

The configuration includes:

- More than 18 specialist roles for governance, compliance, risk and operations, organised into three sections:
  - Corporate governance: CDO, DPO, CISO, Legal IP Officer
  - Data governance and data quality in accordance with UNE 0077/0078/0079: Data Owner, Data Steward, Data Quality Director/Analyst, Data Architect
  - SGIA-specific operation: AI System Owner, AI Delegate, AI Human Oversight, AI Compliance Officer, AI Risk Owner, AI Auditor, AI Incident Manager, GPAI Model Owner, Model Validator
  - Each role with surgical authorisations and segregation of duties in accordance with ISO 42001 — the auditor does not alter what they are auditing; the validator does not develop the model they are validating.

- More than 25 subtypes of entities which cover:
  - The crux of the AI Act: `AI_SYSTEM`, `AI_MODEL`, `AI_USE_CASE`, `SUMMARY_OF_GPAI_TRAINING_CONTENT`, `AI_PROVIDER`.
  - Risk and impact management: `RISK_ASSESSMENT_IA`, `IMPACT_ASSESSMENT_IA`, `CONTROL_MEASURE`, `CONTROL_EVIDENCE`.
  - The SGIA process: `TECHNICAL_DOCUMENTATION_IA`, `COMPLIANCE_FILE_IA`, `MONITORING_PLAN_IA`, `INCIDENT_IA`, `NON-COMPLIANCE_SGIA`, `CORRECTIVE_ACTION_SGIA`.
  - Data governance according to UNE: `DATA_POLICY`, `DATA_INITIATIVE`, `DATA_QUALITY_REQUIREMENT`, `DATA_QUALITY_MEASUREMENT`.
  - The GDPR: `PROCESSING`, `DPIA_ASSESSMENT`, `SECURITY_BREACH`.
- More than 30 subtypes of relationships which enable end-to-end traceability:
  - System governance chain: system ↔ use case ↔ model ↔ documentation ↔ compliance file ↔ supplier
  - Risk chain: system → risk → measure → evidence
  - Data → model → production pipeline: model ↔ training, validation and production datasets
  - GDPR chain: processing ↔ DPIA ↔ FRIA ↔ breach

Preloaded controlled vocabularies aligned with the standard:

- Risk classification under Article 6: unacceptable, high, limited, minimal
- Domains listed in Annex III
- ISO 23894 risk categories
- Types of ISO 22989 standard
- Training data formats under Article 53
- Special categories under Article 9 of the GDPR
- Controls in Annex A of ISO 42001
Menus from templates configured, validations mandatory and workflows for approval.

The aim is not to produce more documentation. It is to turn the information needed to govern AI into a living, manageable asset.

Designed for high-risk systems and GPAI models

The SGIA covers the two main categories of obligations introduced by the AI Act from August 2026:

High-risk systems (Articles 6–15, Annex III): Each `SISTEMA_IA` has five template menus — Identification, Technical, Compliance, SGIA Management and Operational Observability — with mandatory fields that prevent a system from being registered without a risk classification, without the appointment of a human supervisor as required by Article 14, without an assessment of exceptions under Article 6(3) and without a scope record under Article 2 (including extraterritoriality under Article 2(1)(c) where the output is used in the EU).
Technical documentation for Annex IV: The `DOCUMENTACION_TECNICA_IA` entity provides a structured mapping to the points in Annex IV and the sections of ISO 42001. It allows you to answer the question «Which document covers point 3 of Annex IV?» in a matter of seconds, without having to open a single PDF.
GPAI models (Articles 53–55): The `RESUMEN_CONTENIDO_ENTRENAMIENTO_GPAI` entity models the data types (text, images, audio, video, code, synthetic data), the corpus size within the ranges that the AI Office will require to be published, the aggregated sources by type, the policy on respecting TDM opt-outs in accordance with Directive 2019/790, and the specific detection mechanisms (robots.txt parsing, TDM headers, whitelists/blacklists, individual agreements). The «GPAI Model» flag in `MODELO_IA` automatically triggers the creation of the linked entity.
Fundamental Rights Impact Assessment (FRIA): The FRIA is not a separate entity: it is precisely what is documented in `EVALUACION_IMPACTO_IA`, in accordance with Article 27 of the AI Act and the ISO 42005 methodology. It includes vulnerable groups, impacts by fundamental right and a binding conclusion (Acceptable / Requires mitigation / Unacceptable).

Post-marketing surveillance (Art. 72) and reporting of incidents (Art. 73): The `PLAN_MONITORIZACION_IA` and `INCIDENTE_IA` entities complete the operational lifecycle with metrics, thresholds, frequencies and deadlines for reporting to the regulator.

Ready to deploy: no code, no friction

Like all Anjana Data configurations designed to accelerate the implementation of use cases on the Anjana Data Platform, the SGIA is delivered out of the box:

Automated deployment in record time on any instance of the Anjana Data Platform.
No development is required. The configuration is applied via a REST API, and the client can customise attributes, vocabularies and workflows without compromising compliance with the standard.
Built-in validations: critical fields (risk classification, scope under Article 2, FRIA conclusion) are mandatory. A system cannot be set to «Active» status without the associated regulatory documentation.
Templates and sections organised for ease of use: each menu groups attributes by category of obligations, so that the end-user—who is not necessarily an expert in the AI Act—knows what to fill in and why.

End-to-end traceability: from use case to data

This is the key feature of Anjana Data’s SGIA. The AI Act requires providers and deployers to maintain traceability use → system → model → data. Most organisations keep it to hand, in an Excel spreadsheet that is never up to date.

In SGIA, that chain is navigable:

One use case (`CASO_USO_IA`) records the scope of Annex III, the intended users and the preliminary assessment of the impact on fundamental rights. If the response is «High», the workflow blocks activation until the FRIA has been signed.
The use case is linked to the AI system that runs it. The same neural network may be classified as low-risk when labelling spam and high-risk when deciding on a loan: the AI Act regulates the use case, not the model.
The system adds one or more models (`MODEL_AI`), including its accuracy, robustness and cybersecurity metrics as required by Article 15, its classification in accordance with ISO 22989, and its GPAI flag where applicable.
Each model connects to the datasets who trained it, validated it and feed it during production. When a data subject exercises their right to erasure under Article 17 of the GDPR, we can identify all the models that processed that data. When a bias appears in the output, we can trace back to the dataset that introduced it.
The dataset has its own technical lineage — RAW → Silver → Gold — and its consumption pattern towards Power BI, where the reports are linked to KPIs and the KPIs with terms from the corporate glossary.

The result: a single platform where the question «Which personal data feeds which models, which systems run them, in which use cases, with which DPA signed by whom?» is answered with a few clicks, not with meetings.

Data governance, the GDPR and the AI Act in a single thread

The AI Act devotes an entire section—Section 10—to data quality for high-risk systems. If the data governance system resides in one tool and the AI governance system in another, this requirement necessitates a manual workaround that is never fully complete.
SGIA reuses the data governance and quality metamodel that Anjana Data already provides natively:
- UNE 0077: Policies, initiatives, designated responsibilities and data risks associated with the AI system.
- UNE 0078: Classification, lifecycle, architecture, data security and privacy (including the designation of special categories under Article 9 of the GDPR, which automatically triggers the obligation to carry out a DPIA under Article 35).
- UNE 0079 / ISO 25012: Quality assessment based on inherent and system-dependent characteristics, including an improvement plan and metrics.
- Data for AI: A specific section covering bias, representativeness, labelling and preparation. This is where the requirement in Article 10 to «document data quality to the extent possible» is put into practice.
- Native GDPR compliance: `PROCESSING` (RAT under Art. 30), `DPIA_ASSESSMENT` (Art. 35) and `SECURITY_BREACH` (Arts. 33–34), linked to the AI system via specific relationships (`DPIA_SYSTEM`, `SYSTEM_PROCESSING`, `DPIA_FRIA`).
The DPO issues their opinion on the DPIA; the AI Risk Owner signs off on the AI risk assessment; the Data Owner authorises the dataset; and the Legal IP Officer approves the GPAI summary. Three worlds, a single traceability chain.

Operational observability: from MLOps to governance

Each `SISTEMA_IA` and each `MODELO_IA` includes a menu of Operational observability with sections dedicated to performance, availability and SLOs, runtime quality, cost and consumption, model drift and technical traceability.

These attributes do not fill in by hand. They are synchronised via:

Anjana Data REST API: documented endpoints, OAuth authentication, idempotent. Any MLOps platform can push metrics.
Native plugins: Dynatrace, MLflow, Evidently, Datadog, Helicone, LangSmith, Langfuse, and the model registries of the leading cloud providers.

The idea: AI technical management layer ↔ AI governance layer. MLOps tools handle day-to-day operations; Anjana Data transforms those operations into metadata that is governable, auditable and reportable to regulators. This puts an end to the classic discrepancy between «what Datadog knows» and «what the compliance report says».

A modular solution, ready to grow

Anjana Data's SGIA is the configured base, not the ceiling:

Sector-specific extensions. Banking, healthcare, the public sector, HR, critical infrastructure: each domain can add specific attributes without altering the base metamodel.
Proprietary metadata. Organisations that already have risk taxonomies, internal controls or governance KPIs can incorporate these as additional attributes.
Customisable governance workflows. Who approves what, under which SLA, with what notifications, and based on what evidence. Approval workflows are modelled within the platform.
Integration with the rest of the Anjana ecosystem: DCAT-AP-ES open data catalogue, data product marketplace, corporate glossary, technical lineage, KPIs and governed reports. The SGIA inherits all of these.

The aim is not simply to comply. It is to govern.

Regulatory compliance is merely a consequence. The real aim is to have a comprehensive, reliable and auditable overview of how the organisation uses artificial intelligence.

Because the organisations that will derive the most value from AI will not necessarily be those with the most models. They will be those capable of managing, operating and scaling them with confidence.

Would you like to see it in action?

We have a 50–60-minute demo which covers the entire SGIA framework in relation to a real-world case: from the creation of a use case, its risk classification in accordance with Annex III, the technical documentation of Annex IV, the FRIA under Article 27, the risk assessment in accordance with ISO 23894 with its control measures and supporting evidence, the IA model with its metrics under Article 15, the GPAI summary under Article 53, the training datasets governed in accordance with UNE 0077/0078/0079, right through to the technical lineage to Power BI and the data access marketplace.

The demo is tailored to the audience—executive committee, CDO/CDAIO, DPO, technical buyer—and demonstrates exactly how to respond within minutes to the question that is bound to come up during the first audit: «Please provide us with the inventory of high-risk AI systems, including their classification, signed risk assessment and full technical documentation.»

Request a demo of SGIA

You can do it now immediately, without the need for development, using a 100% solution that complies with the AI Act, ISO/IEC 42001 and the UNE data governance standards.

This isn’t just documentation. It’s a living management system.

Governing your open data according to DCAT-AP-ES ready to publish on datos.gob.es

clara — Tue, 14 Apr 2026 16:48:18 +0000

DCAT-AP-ES at Anjana Data is now a reality. At a time when public administrations and organisations operating in Spain need to publish their open data according to the Technical Interoperability Standard (NTI-RISP), having a solution that translates the standard into a real, frictionless, development-free configuration makes the difference between complying and leading.
We have analysed the application profile in depth DCAT-AP-EN (version 1.0.0), based on DCAT-AP 2.1.1 and the European High Value Data extension (HVD 2.2.0), and we have translated it into a full configuration and drop-down in Anjana Data Platform. The result: a solution that allows governing catalogues, datasets, distributions and data services according to the Spanish standard, ready to interoperate with datos.gob.es and with any European portal.

From the BOE to the platform: the standard made configuration

DCAT-AP-ES is not just a technical document. It is the framework that defines how open data should be described, classified and shared in Spain. But applying it requires mapping dozens of classes, mandatory properties, controlled vocabularies and validation rules.
We have already done this. The configuration in Anjana Data includes:

5 types of entity aligned with the classes of the standard: Catalogue, Dataset, Distribution, Data Service and Catalogue Record.
9 types of relationship that faithfully reflect the DCAT-AP-ES model: from the Catalogue-Dataset relationship to the lineage between datasets.
More than 50 metadata attributes mapped one-to-one with the properties of the standard, using the technical nomenclature dcat_ y dcatapes_ to ensure full traceability with the specification
15 controlled vocabularies preloaded: NTI-RISP themes, EU Data Theme categories, licences, formats, update frequencies, geographic coverage by autonomous communities, High Value Data categories and more.

All this with native attributes name y description mapped to dct:title y dct:description, as required by the standard.

High Value Data (HVD) ready

The European High Value Data Regulation (EU 2023/138) sets specific obligations for datasets in six critical categories: geospatial, meteorological, statistical, mobility, business and environmental. DCAT-AP-ES incorporates these requirements, and so does our configuration:

Dedicated HVD section in Dataset and Data Service with the fields dcatapes_hvdCategory y dcatapes_applicableLegislation
HVD Category Vocabulary preloaded and ready to use
Filter in the search engine to quickly locate all assets classified as High-Value Data

This means that organisations handling high-value data can comply with European regulations from day one.

Ready to deploy: no code, no friction

The DCAT-AP-ES configuration in Anjana Data is out of the box. This means:

Implementation in record timeThe entire structure of menus, sections, attributes, validations and vocabularies is deployed in an automated way.
No programming requiredconfiguration is applied directly through Anjana's administration API
CustomisableThe following is an example: you can start from this basis and adapt menus, sections or attributes to the specific needs of each organisation, adding your own metadata without breaking compliance with the standard.
Integrated validationsThe mandatory fields of the standard (title, description, publisher, subject, access rights...) are already configured as follows REQUIRED, reducing cataloguing errors at source

Real interoperability with the Spanish and European ecosystem

The configuration has been designed with interoperability in mind:

NTI-RISP Vocabulariessectoral thematic and territorial coverage aligned with the official resources of datos.gob.es
Publishers as Organisational UnitsPublic bodies are modelled using Anjana's native selector, facilitating integration with the DIR3 Common Directory.
Breakdown of contact pointscontact information (vcard:Kind) is broken down into individual fields - name, organisation, email, phone, URL - for ease of completion and export.
Open REST APIall metadata governed in Anjana is accessible via API, allowing to feed open data portals, federations of catalogues and automated harvesting.

Three layers of lineage to visualise your catalogue

Beyond the metadata, we have set up three lineage layers that allow us to visualise the relationships between assets from different perspectives:

Catalogue overviewshows the complete hierarchy Catalogue > Datasets > Distributions > Services, with groupings that allow each level to be collapsed and expanded.
Data lineagetraceability between datasets, their distributions and the services that serve them, including relationships between source datasets.
Governance of the catalogueManagement-oriented, showing catalogue records, sub-catalogues and the relationship of each record to the resource it catalogues.

10 search engine filters, ready to find what matters

The Anjana Data search engine is now configured with 10 specific filters for DCAT-AP-ES:

Main filters (visible by default): Thematic, Publisher, Access rights, Geographical coverage and HVD Category.
Secondary filters (on request): Language, Format, Date of publication, Date of modification and Frequency of update

Each filter is translated into English and Spanish, and linked directly to the controlled vocabularies of the standard.

A modular solution, ready to grow

DCAT-AP-ES is the basis, but Anjana Data allows you to go further:

Add sectoral extensions (health, energy, geospatial...) on the same base configuration.
Incorporate own metadata organisation in additional sections, without altering the conformity with the standard.
Activate governance workflows for review and approval of metadata prior to publication
Connect with open data portals to automate the synchronisation of existing catalogues

[VIDEO] DCAT-AP-ES configuration demo

We show you in detail what this implementation looks like on the platform:

https://youtu.be/CyHWst97aA8

Do you want to govern your open data according to the Spanish standard?

If your organisation needs to align your data catalogue with DCAT-AP-EN, comply with the High Value Data Regulation or prepare for the Data Act, now you can do it immediately, without development and with a solution 100% interoperable.
Get in touch with us to activate this setting in your environment, request a personalised demo or learn how Anjana Data can help you turn regulation into real governance.

ADP4DS at CRED Webinar: how to operate sovereign Data Spaces in production

clara — Fri, 27 Feb 2026 09:13:08 +0000

This week we participated in the webinar organised by the Centre of Reference in Data Economics (CRED): “Data Space Solutions”.

On behalf of Anjana Data, our CEO Mario de Francisco Ruiz presented how ADP4DS (Anjana Data Platform for Data Spaces) allows to move from the conceptual design of a Data Space to its actual operation in production.

Because the challenge is no longer to understand what a Data Space is.
The challenge is to how to govern, operate and scale it with confidence.

The challenge: industrialising governance in multi-organisational environments

Data Spaces involve:

Multiple participants
Data use policies
European standards (Gaia-X, IDSA)
Regulatory compliance
Traceability and continuous monitoring

Without a ready-made platform, the complexity grows exponentially.

ADP4DS: Platform for Data Spaces in Production

During the webinar we show how ADP4DS acts as a common layer of governance and information and knowledge sharing, The new, metadata-driven, database-driven system is specifically designed for federated environments.

ADP4DS allows:

✔Governing assets with traceability, auditing and versioning
✔Manage data sharing agreements
✔Integrating common vocabularies on a shared semantic layer
✔Automating processes with a governance-first approach
✔Operating multi-organisational environments with role-based workflows
Integration with IDS connectors, Clearing House and other technologies

We are not talking about theory.
We are talking about production-ready technology infrastructure.

Beyond the catalogue: Federated Knowledge Marketplace

A Data Space is not just an exchange of datasets.

ADP4DS enables a Federated Knowledge Marketplace, where:

Assets are semantically contextualised
Agreements are traceable
Lineage is declarative and multi-layered.
Knowledge is reusable

This makes it possible to evolve from simple data sharing to the creation of shared value.

Real sovereignty, not declaratory sovereignty

Data sovereignty implies:

Effective access control
Enforceable policies
Audit capacity
Interoperability without loss of autonomy

ADP4DS is designed to enable sovereign Data Spaces aligned with European frameworks and ready for regulated environments.

Are you designing or promoting a Data Space?

If your organisation is:

Promoting a sectoral Data Space
Joining an existing ecosystem
Seeking interoperable and production-ready technology

Let's talk.

👉 Request a technical session on ADP4DS:
https://anjanadata.com/solicita-una-demo/

If you were unable to attend the webinar, you can consult all the material here:

📺 Watch the full recording of the webinar
👉 https://www.youtube.com/watch?v=e0ROLt5R0As

CNIS 2026: Industrialising Data Governance, AI and Data Spaces in the Public Sector

clara — Thu, 19 Feb 2026 20:19:37 +0000

Anjana Data will be present at CNIS 2026, The National Congress on Innovation and Public Services, together with our strategic partner hiberus, We would especially like to thank him for the invitation and the opportunity to share space at his stand.

After participating in the last two editions, we return to CNIS with a clear message:

The challenge for the Public Sector is no longer to define data and AI strategies.
The challenge is to industrialise and scale them up.

A strategic partnership to transform the Public Sector

Our collaboration with hiberus goes far beyond an event.

We share a vision and commitment to the modernisation of the Public Sector, and have joint success stories such as that of the Government of Aragon, The national benchmark in Data Governance and AI Governance.

This kind of project shows that it is possible:

Integrating governance, technology and operation.
Align strategy and implementation.
Build structural capacities, not isolated solutions.

Our value proposition for the Public Sector

1️⃣ Data Governance: from theory to implementation

Public administrations need more than a catalogue.

They need:

Comprehensive metadata management.
Quality control.
Policies and roles.
Traceability and auditing.
Compliance automation.
Real integration with the existing technology stack.

Anjana Data Platform enables governance to become a permanent operational capability.

2️⃣ AI governance: control, oversight and compliance

The adoption of AI in the Administration requires:

Traceability of datasets and models.
Risk management.
Control of use.
Continuous monitoring.
Alignment with the European regulatory framework.

Our platform integrates AI Governance as a natural extension of Data Governance, avoiding silos and ensuring consistency.

3️⃣ Data Spaces: interoperability with sovereignty

Spain is actively promoting sectoral Data Spaces.

But for them to work, they need production-ready infrastructure.

With ADP4DS (Anjana Data Platform for Data Spaces) we enable:

Management of Data Sharing Agreements.
Access control and sovereignty.
Audit and traceability.
Real interoperability.
Scalability beyond pilots.

The differential: Data & Knowledge Marketplace

One of the differentiating capabilities of the Anjana Data Platform is its approach to Marketplace.

We are not just talking about cataloguing data, but about enabling real data:

🔹 Data & Knowledge Marketplace

Where:

Producers publish governed assets.
Consumers (individuals and intelligent agents) can discover and request them.
Access is managed through formal and traceable agreements.
Control, security and compliance are ensured.

This approach turns the platform into a knowledge-sharing infrastructure, The European Commission has prepared for an environment where consumers are no longer just people, but also autonomous systems and agents.

Spain brand with international recognition

Anjana Data is the the only Spanish company included in a Gartner Magic Quadrant in the field of Data & Analytics..

This reinforces our commitment to:

Technological sovereignty.
Domestic industry.
International competitiveness.
Global standards.

Live demos at CNIS 2026

On Thursday morning, at the hiberus stand, we will be giving personalised demos of the new version of the platform, showing:

Data Governance in real operation.
Integrated AI governance.
Active marketplace.
Real cases in public administrations.

Demos will be present:

Mario de Francisco Ruiz, CEO & Business Development Director
Lucía Engo Bermejo, Head of Customer Success & Product Strategy Director

If you are attending CNIS 2026, we would be happy to discuss how to take your data and AI strategy to production with confidence.

See you in Madrid.

Governing is not cataloguing: understanding the market before starting a Data Governance & AI initiative

clara — Mon, 16 Feb 2026 11:44:57 +0000

To govern is not to catalogue

Understanding the market before starting a Data Governance & AI initiative

In recent years, the data management market has changed significantly. It is no coincidence that Gartner no longer publishes the historical Magic Quadrant for Metadata Management Solutions to evolve into new categories such as Active Metadata Management and, more recently, the Magic Quadrant for Data & Analytics Governance Platforms.

This movement is not simply terminological. It reflects a market reality: not all solutions that manage metadata or catalogue assets are designed to govern data and AI from an organisational point of view..

Today, at least two major technological blocks coexist:

On the one hand, Data & AI Platforms that include technical governance capabilities within their own stack (Microsoft Fabric and Purview, AWS Glue Catalog, Lake Formation, DataZone and Sagemaker, Google Dataplex, Unity Catalog in Databricks, Snowflake Horizon, IBM, SAP, Oracle, Cloudera, Denodo, Qlik-Talend, Stratio, among others).

On the other hand, the independent and transversal Data Governance & AI Platforms, recognised as their own category by Gartner, where solutions such as Collibra, Informatica, Atlan, Alation, Erwin, DataGalaxy, etc. are located. Anjana Data Platform.

Read our article about our appearance in the Magic Quadrant for Data & Analytics Governance Platforms here.

For a start-up organisation, understanding this differentiation is critical. Because the most common mistake is not choosing the wrong tool. It is not understanding what problem each type of solution is really solving.

Cataloguing vs Governing: a structural difference

Many organisations start their journey by activating the technical catalogue that is already included in your cloud or analytics platform. It makes sense: the functionality is available, the integration is easy and the value is immediate.

Tools such as Microsoft Purview, AWS Glue Catalog, Google Dataplex, Unity Catalog, Snowflake Horizon or Cloudera Catalog allow to automatically discover technical assets, extract structural metadata, infer technical lineage and classify sensitive information (with some limitations, of course). For architecture and data engineering teams, this is extremely useful.

But cataloguing is not governing.

To catalogue means to describe what exists. To govern means to decide how it should exist, who is responsible, under what rules it is built and how it is consumed.

A catalogue answers the question:

What technical assets do I have and how are they connected?

An organisational governance platform answers more complex questions:

Who is the Data Owner?
What policies do they apply?
Which contract regulates your consumption?
What is the impact of change?
How is this integrated into demand management and business processes?

From our experience in real projects - including organisations that have had to redesign their approach after several months of implementation - the confusion between the two concepts often leads to initiatives with a lot of technical visibility and little organisational control.

Technical vs. functional government

The native catalogues of cloud and data platforms serve a clear function: to provide technical governance within their own ecosystem.

Purview and OneLake «rule» Azure and Fabric.
Unity Catalog «governs» Databricks.
Horizon «rules» Snowflake.
Cloudera SDX «rules» Cloudera.
Dataplex «governs» GCP.
Glue Catalog, Lake Formation, DataZone and Sagemaker «rule» AWS.

Their integration is deep, their automation is powerful and their alignment with the underlying architecture is natural. They are very valuable pieces.

But their scope is limited to the technological field they control.

Functional governance, on the other hand, is about how the organisation structures domains, responsibilities, policies, data contracts, approval workflows and operational models. It is about how the entire lifecycle of data and AI assets is managed from an organisational perspective, not just a technical one.

This is where the Data Governance & AI Platforms recognised by Gartner as a differentiated category appear. These platforms - Collibra, Informatica, Atlan, Alation, among others - are born with a transversal vocation, not as an extension of a single technological architecture.

Anjana does not compete with the native technical governance of Data & AI Platforms. It elevates it to a higher layer of comprehensive, cross-cutting, agnostic and business-oriented governance..

It does not replace technical governance. It complements it and integrates it into a broader organisational framework..

Passive and reactive government vs. proactive and preventive government

There is another, less visible but equally critical distinction.

A purely technical catalogue-based model tends to be reactive.. Discover assets once they are built. Detects changes when they have already occurred. Classifies information after it has been created.

It is a government after the fact.

A proactive governance model integrates governance by design. Declares assets prior to construction. Define rules and responsibilities before going into production. Assess impacts before implementing changes.

In organisations that aspire to models such as Data Mesh y DataOps, hybrid and federated ecosystems o advanced AI agent governance, the reactive approach is insufficient. Not because the technical catalogue is not useful, but because it is too late to influence critical decisions.

In our experience, the strongest initiatives are those that combine automated technical visibility with preventive organisational operationalisation.

Inferred technical lineage vs Declarative lineage

Lineage is one of the most common arguments used in the market.

Technical platforms have certain capabilities to infer technical lineage automatically. (WARNING, black magic does not exist and there is a lot of smoke in the market here) from pipelines, queries and transformations. This capability is valuable for understanding technical dependencies and analysing impacts.

But the inferred technical lineage does not capture organisational or contractual relationships. It does not represent responsibilities, sharing arrangements, approved policies or dependencies between information products from a functional point of view.

Declarative lineage, on the other hand, allows these relationships to be explicitly modelled. It represents how assets are connected from a governance perspective, not just from a technical transformation.

The two approaches are not mutually exclusive. In fact, they must coexist.

The technical lineage lives where it should live: in the technical layer.
Declarative lineage provides a layer of organisational meaning that inferred lineage cannot.

When well thought-out hybrid architectures are designed, both flows are integrated bi-directionally under principles of Active Metadata.

Control-based governance vs. flexible governance

Some organisations interpret governance as a rigid centralised control mechanism. In practice, this generates resistance, friction and slowdown.

But neither does the opposite extreme - purely observational government that only documents what happens - work.

Flexible government combines structure and autonomy. Allows for centralised, federated or hybrid models. Adapts to business groups with multiple organisations. Can coexist in multi-cloud and on-premise environments.

In real-world architectures - with Azure, AWS, GCP, Snowflake, Databricks, Oracle, SQL Server, Cloudera, Denodo and multiple combinations agnosticism is not a luxury, it is a necessity.

Avoiding lock-in is not just a technological issue. It is also conceptual.

If the governance model is designed around a single technical platform, any future strategic change may force the government to redesign from scratch.

Anticipating cost and maturity

The cost model is another element that is rarely analysed in depth at the outset.

Some technical solutions operate under continuous consumption modelsRecurrent scans, automatic profiling, dynamic classification, change detection. In initial phases, the impact may seem small. As the ecosystem grows, it can become a structural factor.

But beyond the cost, there is the organisational maturity. An overly technical model may work in engineering-focused organisations. It is insufficient when governance must involve business, risk, compliance or AI governance.

Anticipating these factors is a matter of strategic design, not technical configuration.

Defending the hybrid scenario from the outset

After years of working with real organisations - and seeing both successful implementations and complex rectifications - our conclusion is clear:

The debate is not “Purview or Anjana”.
It is not a “Unity Catalog or governance platform”.
It is not “native or open-source catalogue”.

The debate is about architecture and vision.

The sensible thing to do is to leverage native technical governance where it provides value - discovery, classification, deep technical lineage - and elevate that information to a higher layer of organisational, cross-cutting, agnostic governance.

This hybrid approach:

Avoid conceptual and technological lock-in.
It allows for scaling up as maturity grows.
It integrates technical and functional governance.
It facilitates the shift from reactive to proactive government.
It makes the model sustainable in the medium and long term.

Data Governance & AI Governance

Governing data and governing AI are not exactly the same thing. But neither can they be approached as worlds apart.

Data governance has traditionally focused on quality, semantic definition, accountability, traceability, compliance and access control. Even when limited to the technical level, its focus has been on the lifecycle management of structured assets: tables, pipelines, reports, datasets.

AI governance introduces new dimensions:

- Versioning of models.
- Traceability of training datasets.
- Explainability.
- Risk assessment.
- Ethical and regulatory impact.
- Continuous monitoring of behaviour.
- Control of autonomous agents.
- Management of prompts, embeddings and knowledge sources in generative environments.

Platform-native technical governance pieces often extend their capabilities to AI from an equally technical perspective. For example, by integrating model metadata, capturing training information or showing technical dependencies between datasets and models within the same technology ecosystem.

This is useful, but insufficient.

Because governing AI is not just about registering that a model exists or knowing which dataset it was trained on. It is to establish who approved it, under what criteria, for what purpose, with what limits of use, under what risk policy and what oversight mechanisms apply.

It is moving from the technical metadata to the organisational context.

Furthermore, an AI model, system or agent does not exist in a vacuum. Depends on dtraining sessions, semantic definitions, quality rules, pAccess policies, responsible domains, contracts of use, etc.

If data governance and AI governance are managed on different platforms, with different organisational models or without real integration, structural problems arise. There are the inconsistencies in responsibilities, the lack of end-to-end traceability, the lack ofifficulties for assessing regulatory impact, the duplication of workflows, the fhigh level of alignment between business and technology and the ross of AI consuming unapproved or uncertified data.

In an environment where AI regulation is growing and where autonomous agents are starting to make operational decisions, this disconnect is not just an inefficiency. It is a strategic risk.

Governing data without governing AI leaves the door open to automated decisions without organisational control.
Governing AI without integrating data governance generates technically traceable but organisationally opaque models.

When data governance and AI governance coexist in the same Data Governance & AI Platform, the approach changes radically.

In an integrated model:

An AI model can be declared as an information product.
It is associated with a responsible domain.
It is formally linked to the approved datasets that feed it.
It undergoes approval workflows before deployment.
Specific usage contracts are assigned to it.
It is connected to regulatory policies.
It is integrated into the declarative lineage together with the data assets.

This allows for a complete picture, from raw data to automated decision making. It is not just a technical issue. It is a question of organisational coherence.

In addition, integration brings three key strategic benefits:

Real end-to-end traceability: From the source data to the model and from the model to the business process that consumes it.
Clear responsibility: Each asset - data or model - has a domain and associated roles within the same organisational framework.
Governance ready for autonomous actors: In a world where knowledge consumers are no longer just people but also AI agents, having a unified governance layer allows control over what knowledge is exposed, under what conditions and with what contracts.

Technical platforms can register models and datasets within their ecosystem. But they are not designed to articulate a cross organisational model that connects data, models, contracts, responsibilities and processes.

A modern AI & Data Governance Platform enables the integration of both worlds under one governance logic.

It is not about adding “AI governance” as an additional module. It is about recognising that AI models are governed information assets and should be part of the same system of responsibilities, policies and contracts as data.

Here the central message makes sense again: Anjana does not compete with the native technical governance of Data & AI Platforms. It elevates it to a higher layer of comprehensive, cross-cutting, agnostic and business-oriented governance.

And in the current context, that integration between data governance and AI governance is not optional. It is the only coherent approach for organisations that want to scale their use of artificial intelligence without taking unnecessary risks.

From the Data Catalog to the Knowledge Marketplace: the real competitive advantage

So far we have talked about visibility, control and architecture. But there is an even more strategic question that few organisations ask themselves at the outset:

What do we really want to govern for?

The answer should not just be to comply with regulations or to have the inventory in order. The real goal is to turn data and AI into reusable, sharable and exploitable knowledge in a controlled way.

If data governance and AI governance are integrated in the same organisational logic, something very interesting happens. The conversation is no longer purely defensive -monitoring, compliance, risk mitigation and becomes strategic.

Because when data and models are in a state of flux, thee formally declared as governed assets, aand responsible persons, vinculcated by declarative lineage, sujects to workflows and policies, regulated by contracts of use and are auditable throughout their life cycle, en then the organisation does not only control. It can also activating knowledge in a secure and scalable way.

And it is at this point that the next evolutionary level appears. We are no longer talking about a catalogue. We are not just talking about government. We are talking about Knowledge Marketplace.

For years, the market has spoken of the Data Marketplace as a repository for datasets. But that view is limited. A Knowledge Marketplace does not just publish tables; it publishes complete information products, integrating data, semantic context, quality rules, usage policies, responsible parties, contracts and traceability.

It is not just data that is shared. You share governed business knowledge.

And this cannot be built solely on a technical catalogue. A catalogue can show that a dataset exists. But it cannot, on its own, declare it as an approved product, associate it with a responsible domain, establish usage contracts or automate the granting of access under organisational rules.

The actual realisation of a Knowledge Marketplace requires a modern Data Governance & AI Platform, capable of converting technical assets into governed products.

Read our article explaining the evolution from Data Marketplace to Knowledge Marketplace here.

This transforms the democratisation of knowledge into a regulated, traceable process aligned with the governance model.

And it is even more relevant in today's context. Knowledge consumers are no longer just people. They are also AI models, autonomous agents and automated systems that need to access business knowledge in a standardised, secure and governed way.

These actors cannot interpret organisational informalities or manually navigate technical catalogues. They need context, contracts and clear rules.

In this scenario, the Knowledge Marketplace becomes the icing on the cake. It is the natural result of having designed the right governance architecture from the start.

And it is increasingly the source of real competitive advantage.

Conclusion. From catalogue to real government

To govern is not to catalogue. Technical governance is not a substitute for organisational governance. Inferred lineage is not a substitute for declarative accountability. Reactive control does not equal preventive design.

Democratising knowledge does not mean opening access without control. It means doing so in a governed, contextualised, secure and aligned manner with clear responsibilities.

And governing AI is not just about registering models. It is to ensure that each automated decision is backed by approved data, defined policies and explicit usage contracts.

Anjana does not compete with the native technical governance of Data & AI Platforms. It elevates it to a higher layer of comprehensive, cross-cutting, agnostic and business-oriented governance.

A layer that allows data governance and AI governance to be integrated under the same organisational logic. A layer that enables the controlled democratisation of business knowledge. A layer that enables individuals and autonomous agents to access knowledge in a standardised, secure and traceable way.

In a market increasingly driven by data, AI and automation, the difference is not who has the most metadata. It is in who is able to transform data and models into governed and activatable knowledge. And that difference is strategic.

1st National Data Space Meeting

clara — Wed, 11 Feb 2026 14:46:55 +0000

On 29 January 2026, Madrid hosted the 1st National Meeting of Data Spaces, organised by the Reference Centre for Data Economy (CRED) and supported by the Secretary of State for Digitalisation and Artificial Intelligence (SEDIA).

The event confirmed something that we at Anjana Data have been observing for some time in real projects: Data Spaces have moved beyond the conceptual phase and are entering a stage of effective implementation.

It is no longer a question of defining what a Data Space is, but how to operate it in production.

The conversation has matured: now the challenge is to execute.

Key issues such as interoperability, regulatory compliance, sovereignty and European standards were addressed during the various sessions. However, the real challenge is not strategic, but operational:

How is a Data Space technically deployed?
How do you govern in federated environments?
How do you ensure real control over the data when multiple actors are involved?

From our experience deploying real Data Spaces, we know that these questions require specific infrastructure, not just conceptual frameworks.

ADP4DS: Data Spaces Designed for Production

At Anjana Data we approach Data Spaces from a practical perspective: providing organisations with a platform ready to operate federated environments.

ADP4DS (Anjana Data Platform for Data Spaces) was born precisely to bridge the gap between institutional strategy and technical reality. It is not a theoretical framework or a set of best practices, but a platform designed to:

Implementing effective governance in distributed environments
Integrating European standards such as Gaia-X and IDSA
Ensuring traceability and control over information assets
Facilitating interoperability without losing sovereignty

Our approach starts from a clear premise: a Data Space is not a pilot project, it is a critical infrastructure.

Real, not declarative, interoperability

One of the recurring messages of the Encuentro was the need to move forward on open standards and federated architectures.

In our experience, interoperability is not only achieved by adhering to a reference framework, but by resolving specific technical issues:

Identity and trust management
Distributed access control
Data use policies
Secure connectivity between participants

ADP4DS integrates these components as a native part of the platform, allowing organisations to operate within a federated ecosystem without relying on ad hoc development.

From sovereignty discourse to effective control

Data sovereignty was one of the central themes of the event. However, sovereignty does not simply mean hosting data on European territory.

Meaning:

Deciding who gets access
Under what conditions
With what traceability
And with what capacity for revocation

In projects such as the Evidenze case study, we have demonstrated that it is possible to put into production a Data Space with effective control over shared assets, while maintaining the autonomy of each participant.

It is this practical experience that differentiates a mature technological approach from an exploratory initiative.

Spain accelerates. Now it's time to climb

The 1st National Meeting of Data Spaces shows that Spain is aligned with the European agenda and determined to consolidate strategic sectors such as health, industry or mobility through shared data infrastructures.

The next step is to scale up.

Scaling up involves moving from funded pilots to stable environments.
It involves industrialising governance.
It involves operating Data Spaces with technical, regulatory and organisational safeguards.

At Anjana Data we will continue to contribute to this transition with a clear conviction:

Data Spaces are not a future promise.
These are infrastructures that must work today.

And for this, they need production-ready technology.

A Data Space in production: the real case of Evidenze

clara — Wed, 11 Feb 2026 13:35:38 +0000

The Data Spaces are establishing themselves as a key enabler of new data-driven collaboration models, especially in contexts where the security, governance and regulatory compliance are critical. However, one of the main challenges for promoters remains how to move from strategy to actual operation in production.

In this context, Evidenze, a company that promotes clinical research through Real World Evidence (RWE/RWD) and works with different actors in the European healthcare ecosystem, he shared his experience as a promoter of a Data Space during the webinar “Evidenze Data Space: real use cases and keys to the Data Space Kit”.”.

The webinar took place on 14 January 2026, from 12:00h to 14:00h, and showed how it is possible to deploy, in a timeframe of less than two months, the whole layer of cataloguing, data governance and automation of access management, using a proprietary technology platform, no tailor-made developments.

During the session, Lucía Engo, Director of Customer Success at Anjana Data, made a live demo on the Evidenze Data Space, showing how Anjana Data Platform for Data Spaces (ADP4DS) acts as the technology platform supporting the cataloguing, governance and automation layer of access management of the customer's Data Space.

ADP4DS is a platform in TRL 9, a leader in the Spanish market, with multiple deployments and production success stories in large private sector and public sector organisations Public Administration, and recognised by Gartner in the field of Data and Analytics Governance.

This webinar is a real and replicable example how any organisation - public or private - can act as a promoter of a Data Space and have, in a very short period of time, a mature, configurable and vendor-supported technology infrastructure to operate its data exchange ecosystem.

Watch the full recording of the webinar here:

Video

Unboxing: ADP4DS (Anjana Data Platform For Data Spaces)

clara — Thu, 18 Dec 2025 15:52:31 +0000

Within the new series of webinars by BAIDATA, entitled “Unboxing”, We have created a space dedicated to showcasing the technological solutions that are transforming data spaces, promoting interoperability and strengthening digital sovereignty in various sectors. With this series, we want to open up the “box” of innovation and analyse, in a practical and accessible way, how different organisations are building reliable and sustainable data ecosystems.

With this initiative, “Unboxing” becomes a key event for discovering relevant ideas, inspiring new collaborations, promoting knowledge exchange, and highlighting the value of the solutions presented, which enable a more reliable and sovereign digital ecosystem.

Mario de Francisco Ruiz (CEO of Anjana Data) and Lucia Engo Bermejo (Head of Customer Success at Anjana Data), have been responsible for spearheading this new series, presenting ADP4DS (Anjana Data Platform for Data Spaces), a product developed by this Spanish company to offer Data Space developers a technological tool.“plug and play”to build Data Spaces quickly and efficiently, avoiding costly developments and allowing you to focus on use cases and the business model.

During the session, a practical demonstration of the platform, showcasing its main features, ease of use, interface adapted to different participant profiles, and how it facilitates the implementation, operation, and administration of a Data Space.

Complies with the technical requirements for Data Spaces according to Order TDF/1461/2023.
Guarantees sovereignty and total control of data by its owners.
Facilitates secure exchange through machine-readable digital contracts.

Following the main standards and frameworks in Data Management, European Regulation and Standards, Data Spaces and Open Data, ADP4DS provides a comprehensive solution for implementing and managing Data Spaces in SaaS, PaaS, or IaaS formats. Its architecture is scalable, interoperable, modular, and open, enabling customisation through low-code and no-code. The platform, which is based on consolidated and globally recognised technology, offers an experience tailored to different types of users, such as producers, administrators, and consumers. It provides advanced capabilities for expert users and simplifies implementation, operation, and management with a low learning curve. In addition, it has a flexible pay-per-use model that offers unlimited coverage of connectors and participants, ensuring scalability and efficiency in the management of Data Spaces.

The session also emphasised that ADP4DS is a reality thanks to the grant from the Product and Service Promotion Plan, thereby strengthening a wholly Spanish technological solution that supports the digital and technological sovereignty of the entire European data ecosystem.

Access the recording and presentation of the session:

Video

Presentation