No data governance framework exists - No one has the title "data owner" for any dataset - Privacy compliance is reactive — the legal team reviews data practices only when a specific question arises - There is no AI use policy; several employees are using ChatGPT to draft customer communications with