Mapping the governance labyrinth
While designed for different scenarios, these five archetypes share common governance dilemmas that technical architecture alone cannot solve. These dilemmas must be addressed to reduce the risks of failure or loss of trust.
The ownership question. Traditional IT assumes data ownership is binary – you own it, or you don’t. This is also the case for many commercial platforms. Ecosystems complicate the situation. When Kwinana’s refineries share safety alerts, for example, who owns the transaction record?
The X-Road and Catena-X models suggest a third way: participants can retain sovereignty while pooling insights. In Estonia, citizens own their data, government agencies hold it in stewardship, and X-Road provides the transport mechanism. For corporations, this translates into consortium models in which “data compartments” can allow specific data (safety incidents, emissions) to be shared under strict agreements while commercial secrets remain firewalled.
The control question. Ecosystems require a tiered control architecture. Individual assets require tight operational control, communities require shared governance, and national optimization requires centralized coordination. The challenge is preventing the top layer from cannibalizing the bottom.
Estonia’s solution is “federated control”: an automated system handles routine data routing while human administrators retain veto power over anomalous requests. When Finland and Estonia share cross-border healthcare data, for example, algorithms handle the transfer logistics, but human data protection officers approve each query type.
The privacy question. Smart city ecosystems face privacy trade-offs. For example, the CCTV feeds that optimize traffic flows enable behavioral tracking. Research warns us that even anonymized data can be re-identified when aggregated across sources, creating surveillance risks.
The federated approach offers a partial solution: a privacy-by-design architecture in which only algorithmic insights travel across the network. Helsinki’s MyData initiative implements “consent management” where citizens authenticate themselves to city services and can revoke data permissions dynamically.
The human-AI balance question. How do we ensure AI augments rather than overrides human judgment? The nature of trust varies from sector to sector. Healthcare requires transparency around diagnostic thresholds; manufacturing demands predictability and shared workflow routines. Ecosystems that embed AI without explicit governance around explainability, override permissions, and accountability risk eroding trust.
The competitive question. The Catena-X ecosystem demonstrates that data sharing among competitors requires formalized “co-opetition” governance. Without rules, ecosystems collapse into mutual suspicion where participants fear that shared operational data will reveal competitive weaknesses.
Successful ecosystems establish formal data-sharing tiers. In Catena-X, a Digital Twin Registry allows participants to register product metadata for traceability while keeping detailed production parameters private.