A document review campaign can close at 100% without reviewing what your AI reads

A review campaign closed at 100% covers its own scope, not what your assistant reads. A "read by AI" column puts the two lists side by side.

A document review campaign closed at 100% measures the scope it was given. It says nothing about the scope your AI assistants read, because the two lists are held by two teams that never put them side by side. The document review programme was written for quality, audit and compliance; the assistant’s index was built by the integrator, source by source, one use case at a time. On 19 October 2026, opening Gartner IT Symposium/Xpo in Orlando, Daryl Plummer and Kristin Moyer separated governance that protects from governance that slows things down without protecting anything. This gap puts part of your document review in the second group.

Picture the quarterly AI committee of an industrial group. The CDO puts the governance indicator on screen: “2026 document review campaign: 100% closed”. The head of the quality document system, who signed off that closure, is in the room. The DPO asks a simple question: “Of the spaces the HR assistant cites in its answers, how many were in the campaign?” Nobody answers. The list of indexed spaces sits with the integrator, the campaign list sits with quality, and no meeting has ever laid one next to the other.

This piece is for the CDO and CTO of a large group whose assistants index collaborative spaces as well as the controlled quality repository. If your assistants only read documents already covered by the review programme, the two lists match and the argument does not apply to you yet.

Two answers come to mind first. One: the annual campaign exists, it is well run, it is enough. Two: the AI governance platform bought this year, or the review workflow in the document management system, already covers this. Both hold for what they look at. Neither looks at the gap between the two lists.

When document review slows things down without protecting

The framework Gartner presented on 19 October, the Value-Risk Flywheel, describes two forces: momentum and drag. In Gartner’s write-up, good drag protects value through governance, cybersecurity, accountability and spending discipline, while bad drag creates bureaucracy, bottlenecks and rework without reducing risk. The same article reports that 86% of CIOs say their AI risk is growing faster than the value they get from AI.

Document review is drag by design: it takes expert time, it delays publication, it requires sign-offs. The question this framework raises is which side it lands on. A campaign that carefully reviews procedures the AI never reads, while the assistant serves spaces no campaign covers, burns expert time without reducing the risk in the answers. In Gartner’s terms, that is bad drag. Applying this to document review is our reading; Gartner does not make the point about documents.

The proposal is to set the document review programme by what the AI reads: know, line by line, which sources feed an assistant and which feed nothing, then adjust review priorities accordingly.

A note on continuity for readers of this blog. On 7 October we covered a withdrawn document that keeps answering through AI; on 12 October, control evidence that stayed unchanged while the organisation moved on. Here nothing is withdrawn or out of date to begin with: the review programme is simply looking somewhere other than the assistant. In late July we described silos opened to AI that nobody was watching; today’s question is narrower and more uncomfortable, because it concerns a review system that exists, is well run, and reports green.

What quality audit already wrote down

There is nothing new about this kind of adjustment. ISO 9001:2015, clause 9.2.2 a), requires the internal audit programme to take into consideration the importance of the processes concerned, changes affecting the organisation and the results of previous audits. Auditors drew a stable practice from it: audit first and more often what carries the risk, and space out the rest. ISO 9001:2026 was published on 16 September 2026, with certificates transitioning until September 2029; we have not read the paywalled wording of the new edition, and we cite clause 9.2.2 a) of the 2015 edition as reproduced by Auditor Training Online.

The document review programme follows the same logic. If it was set up before the first assistant, its importance criteria were set without it. A procedure’s importance is measured by its process, its regulatory weight and its last review date. A new criterion has appeared without being added: is this source read by a system that answers employees or customers? Adding that criterion upgrades the existing programme, in a sense quality teams already recognise.

Where the two instinctive answers stop

The annual campaign first. It is the most mature form of document discipline in a large group: a defined scope, named owners, a review date, a sign-off trail. Its boundary is its scope. That scope was drawn from certified processes and audit requirements, at a time when a document was only read by people who went looking for it. A team space, an archive library or a project site connected to the assistant only enters it if someone brings it in. The head of the quality document system cannot review a source whose connection nobody reported to her: her sign-off on the campaign is accurate, and it covers an incomplete list.

The AI governance platform next. At its best it inventories use cases, models, agents, their access rights and logs, and it can list an assistant’s connectors. The common control plane Gartner calls the “AI Central Bank” in the same keynote is an organisational concept; it does not name the document review programme among its parts. The platform itself does not hold the review programme, and nothing in it flags that a connected source has no owner and no review date. The document management system’s review workflow, for its part, triggers date-based reviews on the documents it manages, without knowing which ones an assistant indexes.

The status quo has a precise cost: the “campaign 100% closed” indicator keeps reaching the AI committee as proof of governance, while it only covers part of what the AI serves.

The “read by AI” column

The exercise takes half a day and needs no tool. It adds a “read by AI” column to the document review programme.

What it produces. Two lists, side by side. The first comes from the integrator: for each assistant or agent in production, the spaces, libraries, sites and folders connected to its index, as listed in the connector configuration. The second comes from the head of the quality document system: the scope of the review programme. The “read by AI” column states, for each source, which assistants read it, or “none”.

Where it lives. In the existing document review programme, held by the head of the quality document system. Sources read by AI but missing from the programme enter it as new lines. No standalone file is created.

When it is written. The first lines are written when the 2027 campaign is planned, if it is not yet locked, then for each new source connected to an assistant, before go-live.

A filled-in line. “Space ‘HR policies – archive 2021-2024’; outside the review programme; read by AI: HR assistant, new-joiner onboarding agent; likely owner: HR department, to be confirmed; decision: enter the 2027 campaign with a Q1 review, or leave the index.”

How to read it. A source read by AI and outside the programme calls for an owner decision: it enters the programme, or it leaves the index. A source read by AI and already in the programme moves up the review priority list, like an important process in an audit programme. A source in the programme that no assistant reads keeps its cadence: the column adds no review where the AI reads nothing.

Interim conduct. Until the owner decides, the source stays indexed and its line stays open on the AI committee agenda. Removing a source from the index is for the business owner alone to decide.

Failure mode. If the two lists match, the exercise cost half a day for quality and the integrator, and the “100%” indicator now means what it appears to mean. If the integrator cannot produce the list of connected sources, that is the first finding.

Data handled. The exercise only uses connector configuration. It reads neither user questions nor usage logs, and moves no personal data.

The record it creates. A “read by AI, outside the programme” line documents a known gap. Our reading, argued and not backed by any published decision: a gap that is written down, dated and assigned shows a control that works. Legal remains the judge of the wording.

Who owns the decision. The column requires no new role. It is added to the written responsibilities of the head of the quality document system, and the decision on each source belongs to the business owner. The time spent is charged to the existing quality programme, or to the 2027 AI programme budget if it is still being set.

What a Document Knowledge Platform brings, and what it does not

A Document Knowledge Platform (DKP) is the document quality and governance layer that runs upstream of AI systems: it governs the document estate (Govern), detects and handles anomalies, duplicates and obsolete content (Clean), and only activates the corpus for assistants once those two steps hold (Activate). It is not sold in the AI governance platform category and does not belong in that tender; it replaces neither the document management system, nor enterprise search, nor the agents’ knowledge layer. This position does not depend on the analyst calendar: it was the same before the 19 October keynote and will stay the same after it.

On the “read by AI” column, K-AI’s contribution is specific. K-AI counts the documents in each indexed source, states the applicable version of each one and flags obsolete documents, across both scopes at once. For linking a source to an owner or to a line in the programme, the tool proposes candidates and the quality team confirms. The decision to enter the programme or leave the index stays with the business.

Ingestion covers only the document content of the selected sources, within a contractual scope validated jointly by the document owner and the CISO or DPO. No transcripts, no usage logs, no telemetry. No content is reused to train models.

The closest public case is TotalEnergies Retail Power & Gas: across ~500 web pages audited, K-AI identified 19% of pages needing correction, and 53% of cases were resolved in 3 weeks, prioritising the most critical ones, with limited resources: 1 to 2 experts, half a day to a day per week. This shows that a prioritised review can clear a large share of cases with little expert time. It says nothing about the gap between a review programme and an indexing scope, which was not what that diagnostic examined.

Conclusion: audit, clean, monitor

Audit means putting the two lists side by side and writing the “read by AI” column. Clean means getting each owner to decide, enter the programme or leave the index, then reviewing first what the AI reads. Monitor means filling the column for every new source connected to an assistant, before go-live, so the review programme follows the index from the start.

At the next AI committee, the head of the quality document system will be able to answer the DPO’s question with a number, and the campaign indicator will finally say which scope it covers. Document review will be the drag that protects again.

Frequently Asked Questions

What is a document review programme based on AI risk?

It is a review programme that takes into account, for each source, which AI assistants read it. A source read by AI moves up the review priority list; a source no assistant reads keeps its cadence. The principle mirrors the ISO 9001 audit programme (clause 9.2.2 a of the 2015 edition), which considers the importance of the processes concerned.

Why is a review campaign closed at 100% not enough?

Because it measures the scope it was given. If assistants index collaborative spaces, archives or project sites outside that scope, the indicator stays at 100% while part of what the AI serves has never been reviewed.

Doesn’t our AI governance platform cover this?

It inventories use cases, models, agents and their access rights, and can list an assistant’s connectors. It does not hold the document review programme and does not flag a connected source with no owner and no review date. The “read by AI” column links the two.

Who should own the “read by AI” column?

The head of the quality document system, inside the existing review programme. The integrator provides the list of sources connected to each assistant; the business owner decides, source by source, whether it enters the programme or leaves the index.

How does K-AI handle confidentiality during an analysis?

K-AI only ingests the document content of the selected sources, within a contractual scope validated jointly by the business document owner and the CISO or DPO, never by IT alone. No transcripts, usage logs or telemetry are collected, and no content is reused to train models.

Sources

Where to Go From Here

K-AI Corpus Diagnostic — 10 business days on your document estate, full report of the 20 most critical anomalies, money-back guarantee if no meaningful anomaly is found. A one-hour conversation starts from your two lists, locates the first “read by AI, outside the programme” lines to look at, and sets out what it would take to count their documents and flag obsolete versions. Reach the K-AI team: contact@k-ai.ai. The scope of every diagnostic is validated jointly by the business Document Owner and the CISO/DPO, never by IT alone.

K-AI already works with CMA CGM, Veolia, PwC, BNP Paribas, TotalEnergies and CEVA Logistics. Partners: AWS, Snowflake, Microsoft, Wavestone, Devoteam.