By Cornelius Greyling

Kirk to Uhura: What’s our Position?

Our data transformation starship hurtles into the turbulent second half of 2025. For months now, strange new cosmic forces lash out at the ship’s hull, with the sound of golf-ball-sized hail battering a tin roof. The bridge crew clutches their consoles as regulatory shockwaves reverberate through all ship levels. This all started in February when the EU AI Act’s phased implementation started and caused alterations to the warp drive configuration. And now the eight new U.S. state privacy laws are creating gravitational anomalies that threaten to derail our meticulously mapped out course. The Big Brass communications from Starfleet Command have become increasingly garbled. I struggle to untangle their contradictory directives about the U.S. SEC climate disclosures which are flickering in and out like a faulty subspace relay. Meanwhile, our data transporter has been offline for weeks now, ever since that catastrophic incident where an entire governance framework was beamed over and materialized as regulatory spaghetti. Our IT teams had no choice but to ferry their data transformation cargo flying shuttles through increasingly unwelcoming regulatory space.

The crew looks at each other with increasing concern because their trustworthy navigation maps have become all but useless in this new quadrant of enterprise requirements, where AI governance meets sustainability requirements and traditional security protocols encounter quantum-encrypted aggression.

Yet they remain at their stations, because in the final frontier of data transformation, boldly going where no organization has gone before, isn’t just an adventure – it’s survival.

Uhura to Kirk: ” Captain, I’m picking up huge energy readings all across corporate space.”

Back on corporate Earth, boardrooms are grappling with similar navigation challenges. Let’s have a look at how the landscape of data transformation projects has fundamentally changed over the last year.

This much is clear: Data transformation not so long ago was one of the top five items on everyone’s strategic to-do list but has now unsurprisingly moved up some notches. This urgent operational reality is loudly knocking at the door and demanding to be let in. This is the “critical mission” on which all the other enterprise initiatives depend.

A giant distance has grown between organizations that have been following a comprehensive data-centered transformation “philosophy”, now travelling at warp speed, versus those who are still struggling to clear the docking station.

The Momentum has Shifted

The drivers behind data transformation now are not just the internal pressure to get value to market ever quicker and keeping up with getting ahead of the competition. The highest levels of pressure are increasingly coming from other drivers. These are some of the most important ones:

• AI integration has now become mandatory, namely the need to leverage AI and tap into the explosion of raw processing and network capacity enabling it. Staying aligned with evolving regulation (below) is a challenge.
• Also, business is now used to getting real-time results and the ability to make intra-day changes to business applications.
• Increasingly complex and significant data and compliance regulations are emerging non-stop. The field of regulation is maturing quickly, doing its best to contain the exponential evolution of AI technologies, by pre-empting and containing the accompanying potential risks these pose to privacy, safety, and social stability. Let’s take a closer look at how regulators are showing their teeth, intensifying and shaping demands to corporate data conformity.

Only in the first half of 2025, approximately 8 new US state privacy laws took effect – the trend is clearly to implement increasingly state-specific approaches and regulations of data privacy. This “state-divergent” trend clearly impacts companies that specialize in the implementation of “standardized” data transformation solutions. The need is to permit increasingly granular data policies that can be customized by geography. It can get really complex for corporations doing business in various US states – especially the handling of personal data is increasingly state-specific.

The phased implementation of the world’s first comprehensive artificial intelligence regulation, the EU AI Act which was signed into law in 2024, started taking effect in February this year, and companies will have until August 2025 to fully comply with all regulations, or face extremely hefty fines.

How does this act affect data? As you know, AI systems are inherently built on and driven by data. The EU AI Act imposes strict data requirements for high-risk AI systems – and this also applies to US companies that do business with or in the EU. The act is forcing companies to look at their data belly button under a microscope – analyze and clean their data internally before releasing it to and with AI solutions. The regulation looks at how the data was collected, how it is stored and how it is used. We may see this year that, as companies scramble to massage their data and systems into compliance, the capacity to implement business-driven projects is impacted. Some of this impact can be mitigated but this depends severely on the data status of every company – on the progress that has been made on data cleansing and transformation journeys over the last years. 

• And just when you thought that we have Security Risks sort of under control, the stakes have been upped. Especially in the AI corner, new swindle schemes have been created, aimed at getting AI agents to reveal sensitive data or for example resetting passwords. This is known as AI Agent Manipulation.
• Another new worry is the power of quantum computers. As they have become more powerful, so has their ability to crack todays widely used public-key encryption cryptographic systems, such as RSA, ECC, etc. Post-Quantum Cryptography’s mission is to stay ahead of quantum processing by creating new algorithms capable of resisting these attacks.
• And welcome to relative newcomer Sustainability. Sustainability has added a new kind of pressure on data transformation projects (and on projects in general). Yet purely from a data standup, again the impact of the data center capacity required to fuel the growth of artificial intelligence, has a significant impact on the environment. For more detailed information, I suggest you read this great article by Adam Zewe | MIT News – “Explained: Generative AI’s environmental impact” (January 2025).

As a result of this impact, top-down mandates now require data transformation projects to monitor and expose environmental impacts, by setting and transparent monitoring and reporting of project KPIs that were set in line with corporate sustainability commitments. Basically, these KPIs translate into the carbon footprint, the amount of C02e being released into the atmosphere, and how this amount is contained or hopefully by which measures the emissions are being reduced. In projects, this means reporting on environmental metrics together with other traditional project metrics.

Also, again in this area, organizations must navigate the constellation of the new ESG (Environmental, Social and Governance) reporting requirements, and report in detail on their compliance.

As with AI regulation, Europe has taken the lead, in this case with the CSRD (Corporate Sustainability Reporting Directive) setting the standard in Europe for reporting on social and environmental impact, requiring the same level of discipline as with traditional financial reporting.

In the US, the pressure of reporting on sustainability and environmental impacts is significantly lower than in Europe and has even recently been eased. In March this year, amidst a polemic internal policy shift under the current administration, the US Securities and Exchange Commission (SEC) started rolling back its climate risk disclosure rules – the deeply polarizing 2024 “Climate Change Rule” – which would have applied to publicly traded companies. It’s all a bit confusing, but in essence the rule exists, but has never been put into effect, and companies are currently not obliged to comply. After the SEC removed it from its active policy agenda, it’s not clear how the regulatory framework will evolve, but it is probable that the rule will rise from the grave again under a new administration, not least because the investor and international pressure for climate disclosures have not dissipated, on the contrary.

Summarizing, incorporating sustainability in the DNA of data transformation projects is a new, must-have dimension which will become increasingly more demanding.

Meeting the Moment

While companies struggle to keep up and navigate this asteroid field of existing and new demands, there are also some special challenges worth mentioning:

The Importance of Managing Change

When thinking of data transformation, don’t only think tech! Organizational change management is critical for the success of all projects, and the lack thereof has been the demise of many a project. Projects require individuals to adapt to new ways of doing things, abandoning the trodden path – understanding and (being forced into) doing new and daunting things.

Change management must accompany transformation, by continuously empowering people to embrace change with confidence. You’ll have heard the self-explaining terms “Compliance Fatigue”, “Process Circumvention” or “Shadow IT Behaviors”, which point to our natural human resistance to change. The importance of addressing this resistance and turning it into excitement and curiosity is as important as that of facing technical transformation. Teams must be supported by institutionalized change management which is also embedded into the transformation project as such.

Change Management in data transformation projects also focuses on:

• Data literacy training
• Clear data ownership and stewardship
• Changing behavior around how data is handled – for example observing data privacy and compliance rules
• Promoting user engagement in the use of data tools

Data Quality – Garbage in, Hallucinations out

You are what you eat, and this also applies to AI. As was mentioned earlier, AI systems feed on data, and that data needs to be of the best quality: Accurate, complete, and consistent, to name just a few aspects. In transformation projects, data quality and governance are a core priority. A clear Data Strategy needs to be put in place and the roles and responsibilities for the governance defined and cemented in the project organization.

Before starting, or as one of the first steps as you take walking into a data transformation project, must be the assessment of the data that you will be working with. This typically involves an in-depth analysis of the source system(s). It is normal to “discover” that the data quality is in a deplorable state. Actually, everybody on deck already knows this, but it is invaluable to know exactly what you are dealing with and where to expect problems.

Based on the findings, running a data cleansing pre-project is one recommendable way of avoiding data quality “landmines” exploding only once you’re in the middle of a project, and having to deal with improvised band-aid fixing and firefighting.

Finding skilled, experienced employees

Data transformation projects are complex, intricate beasts with a knack for almost never being repeatable. If you’ve done a company code carve-out in one company, you’ll find that in the next apparent carbon-copy of the implementation scenario, it turns out to be a completely different kettle of fish.

On top of it, the demands mentioned earlier in this article are dynamic and impact on all project areas and team members. The required roles and skillsets did not exist some years ago, are extremely tailored and do not fit the traditional molds for IT transformation projects, which were built on system migrations, and software implementations.

Staffing these projects with skilled and experienced resources is not trivial, and demand continues to be far higher than supply, resulting in organizations staffing with inadequate or junior resources who only possess a veneer of “in-house” training and knowledge transfer.

In Summary

Change is a constant, and looking to the other side of 2025 and beyond, things are only likely to become more demanding.

Organizations will be challenged to evolve their data transformation from individual programs and projects into a rolling organizational capability and above all culture which can continuously accommodate new, surprising, more stringent, or adapted data-related requirements. As we have seen, these can come from any myriads of sources, as nothing much out there in the digital world does not require top-notch data and organizations that possess a sustainable data foundation and are geared to adapt on the fly to the latest greatest “what’s next”.

Failing to chart an effective data transformation voyage isn’t just inefficient – it becomes more difficult to play catch-up as time and space passes, and new demands and technologies stack up. In the long run, failure to “adapt or die” can erode complete organizations until they end up drifting in empty space.

So, what are we waiting for? Energize!