In the first article of this series I argued that generative AI did not eliminate the data problem, it relocated it to inference time. Nowhere is that more concrete than in retrieval augmented generation. RAG is the workhorse pattern of enterprise generative AI, the mechanism by which a general-purpose model becomes useful for your policies, your products, and your clients. And RAG rests on a single, quietly radical assumption:that the content you retrieve deserves to be trusted.
Most institutions adopted RAG without ever testing that assumption. They pointed an embedding pipeline at a document repository that had never been curated, versioned, or owned, and then wondered why a frontier model kept producing confident answers that compliance could not sign off on. The model was doing its job. The knowledge base was not doing its job, because nobody had ever defined its job.
This article is about what it takes to turn a pile of unstructured content into a governed, production grade knowledge asset. Not the retrieval architecture, which comes next in the series, but the readiness of the data itself.
The Shift Nobody Announced
Before RAG, a policy document sitting in a shared drive was passive. If it was outdated, a human reader might notice the date, recognize the superseded logo, or simply know from experience that the procedure had changed. The document's flaws were mitigated by human judgment at the point of consumption.
RAG removes that mitigation. The moment a document enters a retrieval corpus, it becomes an active input to a production system. The model will retrieve it, treat it as ground truth, and synthesize it into an answer delivered with uniform confidence. The stale version and the current version read equally authoritative in a context window. A knowledge base is therefore no longer a filing cabinet. It is a data feed, and it deserves the same discipline we apply to any data feed that drives decisions: defined ownership, quality rules, change management, and monitoring.
This is the single most important mindset shift for data readiness. Everything else in this article follows from it.
The Quality Dimensions That Decide Whether RAG Helps or Poisons
Traditional data quality frameworks give us dimensions like accuracy, completeness, consistency, timeliness, and validity. Those still apply, but unstructured content for RAG demands a translated and extended set.
These are the dimensions I have found decisive in practice:
1. Currency and versioning
Is this the current, approved version, and can the pipeline tell? If your corpus contains three generations of the same procedure, retrieval becomes a lottery.Every document needs an authoritative source, a version, an effective date, and a supersedes relationship. Freshness must be machine readable, not tribal knowledge.
2. Authority
Is this the official answer or somebody's working copy? Repositories are full of drafts, personal summaries, training copies, and annotated exports. A model cannot distinguish a signed policy from a draft that was never approved unless metadata makes the distinction explicit.
3. Coverage
Does the corpus contain everything needed to answer the questions you intend to serve? Gaps are more dangerous in RAG than in search.A search engine returning nothing prompts a human to look elsewhere. A RAG system with a gap often falls back on the model's general training and produces a plausible answer with no grounding at all.
4. Consistency and semantic agreement
Do documents contradict each other, and who resolves it? As Ruchir Gupta argued in the post I referenced in Article 1, organizations never agreed on what their data means, and AI makes that disagreement impossible to ignore. In a corpus, unresolved contradictions surface as answers that change depending on which chunk was retrieved.
5. Extractability
Will the document survive parsing, chunking, and embedding with its meaning intact? Scanned PDFs without OCR, complex tables flattened into word soup, footnotes divorced from their anchors, and content locked in images all degrade silently. The document looks fine to a human and arrives mangled in the context window.
6. Contextual self sufficiency
Does every chunk carry enough context to stand alone? A paragraph that says the limit is 50 million dollars is useless or dangerous without knowing which limit, which product, which jurisdiction, and which effective date. Metadata and chunk enrichment carry that context; without them, retrieval precision collapses.
7. Sensitivity and entitlements
Who is allowed to see this content, and does the pipeline enforce it? A knowledge base that ignores entitlements turns RAG into a data leakage engine.Sensitivity classification and access controls must travel with the content into the vector store and be enforced at query time.
8. Provenance and lineage
Can you trace an answer back to its source document, version, and ingestion date? When a regulator or an internal auditor asks why the system said what it said, retrieval logs and document lineage are your defense. If you cannot reproduce the context, you cannot defend the answer.
Did you Notice?
None of these are model problems. They are data management problems wearing an AI costume. That is good news, because data management is a discipline financial institutions already know how to fund and govern. The work is applying it to a class of content that escaped it for decades.
A Readiness Workflow That Actually Works
The failure mode I have seen most often is trying to boil the ocean:a firmwide initiative to clean all unstructured content before any use case ships. It never finishes, and the AI program loses sponsorship waiting for it.
The approach that works is use case scoped readiness, executed in a repeatable sequence:
1. Scope the corpus to the use case
Start from the questions the use case must answer, then identify the minimum set of documents required to answer them. Readiness is defined per corpus, not per firm.
2. Assign an owner before ingestion
Every document set gets a named owner accountable for currency, accuracy, and completeness. If nobody will own a document set, that is a signal it should not be in the corpus at all.
3. Curate and enrich
Deduplicate, remove superseded versions, resolve contradictions with the owner, fix extractability problems, and attach the metadata that retrieval will depend on: authority, version, effective date, sensitivity, and domain.
4. Validate with ground truth
Build a golden set of questionswith known correct answers drawn from the corpus, and test retrieval against it before launch. This is your evaluation dataset, and it doubles as your regression suite for every future corpus change.
5. Operate it like production
Documents change, policies get superseded, and coverage gaps appear as users ask new questions. Monitor retrieval quality, log unanswered and poorly grounded questions, and route them back to the content owner. Readiness is a lifecycle, not a gate.
This sequence converts data readiness from an abstract aspiration into a bounded, fundable piece of work per use case, while every corpus you ready compounds into institutional capability.
The Governance Connection
Readers of my governance work will recognize where this lands in the 5 Pillar Governance Model. Corpus scoping and ownership sit under Accountability Structures and Inventory and Classification. The golden question set and retrieval testing are Independent Validation applied to data rather than models. Entitlement enforcement in the pipeline is Use Controls and Guardrails. The monitoring loop that routes gaps back to owners is Change Management and Issue Remediation. Supervisory expectations point the same way: the rigor SR 11-7 demanded for model input data extends naturally to retrieval corpora, and examiners are already asking institutions to demonstrate exactly the lineage and validation evidence described above.
The Test I Give Every Team
When a team tells me their RAG use case is ready to launch, I ask five questions:
Who owns this corpus by name?
What is your process when a source document changes?
Can you show me your golden question set and its latest scores.
What happens when a user without entitlement to a document asks a question it would answer?
Can you reproduce, for any answer given last month, the exact chunks and document versions behind it?
Teams that can answer all five have a production knowledge asset. Teams that cannot have a demo, and the distance between a demo and production is measured almost entirely in data readiness.
The next article in the series moves from the content to the pipeline: chunking strategies, embeddings, vector stores, and the retrieval quality dimensions that determine whether the model sees the right context at the right time.
If you are working through corpus readiness in your own organization, I would welcome hearing what has worked and where the friction is. Share your experience in the comments.
Explore more: Start Here · Topics · Archive · About