Who owns the information? Data ownership and stewardship in an ECM

I often see this pattern in organizations. The ECM project was an overall success: the migration is complete, and users are happy with the new solution. But after a year or two, the magic faded. Search results are cluttered with duplicates, metadata is inconsistent, permissions have drifted, and nobody dares to delete anything. Some users have gone back to using shared drives.

The platform itself is not the cause; it simply does what it was configured to do. The real problem is that nobody was ever clearly responsible for the information. The project had a sponsor, a manager and a budget. The information had none of these.

I touched on this topic briefly in previous posts (Why ECM Projects fail or Information debt), but let’s take a closer look.

The question remains unanswered

Because it is organizational and political rather than technical, it feels more challenging than a workshop on vault structure. It also seems to be something for ‘phase two’, which rarely receives the same level of attention. Business users assume IT handles it, and IT assumes the business does. Furthermore, ‘ownership’ can mean different things to different people, such as who created the document, who is accountable for it, who can edit it and who decides when it should be deleted.

Four different roles

I think we should start by defining the four crucial roles.

• Data owner is a business role that is accountable for a category of information. For example, the HR director is responsible for personnel files. The owner decides on the rules for classification, retention and access.
• Data steward ensures that these rules are followed on a daily basis. They monitor metadata quality, handle exceptions and propose improvements. This is the role that is most often missing.
• Custodian is usually IT. They keep the platform secure, backed up and running, but they should not decide what the information means or how long it is kept.
• Contributors are users who create and edit content. Being the author of a document does not make you the owner of its information.

In short: owners decide, stewards organize, custodians protect, users contribute.

When one of these is missing, the others compensate badly. IT ends up making business decisions, or users end up inventing their own conventions.

Why it matters even more in M-Files

M-Files organizes information based on its metadata, not its storage location. The metadata model is a shared contract, and every contract needs someone to take responsibility for it.

• Who approves new classes or values in a value list? Without a clear answer, terms such as ‘Contract’, ‘Contracts’ and ‘Agreement’ end up coexisting.
• Who decides which properties are mandatory?
• Who in the business owns each workflow, since only they know when the process changes?
• Who reviews permissions as people and organizations change?
• Who validates retention and destruction rules?

AI adds urgency. Whether you use M-Files Aino or another AI capability, the quality of the answers depends on the content: accurate metadata, no duplicates and no obsolete documents being passed off as current. AI does not fix a governance gap, it exposes it.

Making ownership explicit

I recommend the following six best practices. You should use them in any ECM solution.

• Ask early and write it down. For each information domain, name the owner, the steward(s), the custodian and the applicable rules. A simple table validated by management is enough.
• Name roles, not just people, with a deputy, so the organization survives a departure or reorganization.
• Give stewards time and tools. Use M-Files views that surface missing metadata, notifications and dashboards to make the work lighter.
• Define a light change process for the metadata model, such as a monthly review between steward and administrator.
• Schedule reviews: quarterly on data quality, twice a year on permissions, yearly on retention and the model itself.
• Hand over governance at go-live, not just a configured vault: the roles, the decisions and the reasons behind them.

Do a quick assessment

If you want to evaluate where you are with your solution, try to answer the following questions:

• Can you name the person accountable for each type of document?
• Who can approve a new document class?
• Who decides when a document can be deleted?
• When did the business last review access to sensitive information?
• If your ECM administrator left tomorrow, would the rules still be understood?

Expert level: Who are the deputies?

If you answered ‘I don’t know’ or ‘I’m uncertain’ to at least one question, then you have identified a risk before it becomes a failed project.

Information needs an owner

Successful ECM projects are rarely lost on technology. They are lost slowly, in the months after go-live, through a lack of clear responsibility. The platform keeps working while the information quietly loses its value.

The fix is not complicated, but it does require a decision: information needs owners, just like budgets and projects do. Asking ‘Who owns the information?’ early, and writing down the answer, is one of the cheapest and most effective investments you can make in an ECM.

If you are planning a project, or wondering why a past one is not delivering what it promised, this is a good question to start with. And if you would like to discuss how to set up ownership and stewardship in your own M-Files environment, feel free to reach out.