What Happened
Records and Information Management (RIM) has lost its place at the compliance table. This didn't happen overnight but over two decades of strategic drift. From 2002 to 2025, while RIM professionals focused on Enron-era litigation risks, the compliance landscape shifted to AI governance, privacy regulation, and breach response. By 2025, a PwC survey showed Cybersecurity, Privacy, and Artificial Intelligence as top compliance priorities. RIM didn't even make the list.
Organizations are now investing in high-ROI compliance areas. About 82% plan to increase spending on technology to automate compliance, and the eDiscovery market has reached $16 billion, projected to hit $25 billion by 2030. Meanwhile, four out of five Chief Compliance Officers (CCOs) report budget constraints that force them to prioritize spending on areas with visible ROI and risk mitigation.
RIM has become a relic from 20 years ago rather than a vital capability for today's needs.
Timeline
2002: Enron collapses, leading to the Sarbanes-Oxley Act. Records management becomes a compliance priority focused on litigation risk and financial controls.
2002-2005: The Zubulake v. UBS Warburg case establishes that electronic data is subject to discovery. RIM expands to cover electronic records, leading to investments in retention schedules and legal hold processes.
2018: The GDPR takes effect, making privacy a global compliance priority. Twenty U.S. states eventually adopt privacy laws, prompting organizations to build privacy programs requiring data mapping, retention controls, and consumer request workflows.
2020-2025: AI governance becomes a regulatory requirement. High-risk AI systems need assessments, explainability, human oversight, and transparency under regulations like the EU AI Act and Colorado's AI law. Breach costs average $4.88 million, with 258 days to identify and contain incidents.
2025: The PwC compliance survey lists AI, Privacy, and Cybersecurity as top priorities. RIM isn't mentioned. Budget constraints force CCOs to fund only what shows clear ROI or addresses visible vulnerabilities.
Which Controls Failed or Were Missing
Strategic Positioning Failure: RIM professionals continued to focus on outdated litigation scenarios instead of aligning with current compliance priorities. They didn't position themselves as essential to AI governance, privacy impact assessments, or breach response protocols.
Integration Gap: RIM operated separately rather than embedding into high-priority compliance programs. When organizations built AI governance frameworks, RIM wasn't involved in inventorying AI systems or preparing training data. Privacy teams often developed parallel systems without RIM input.
Communication Breakdown with Legal: Despite eDiscovery spending reaching $16 billion, many legal departments initiated preservation and collection without consulting RIM. Legal holds were issued without reference to Records Control Schedules, and data maps in RIM weren't accessible to litigation teams.
Visibility Deficit: RIM struggled to demonstrate ROI in terms compliance officers understand. While privacy teams showed that 86% of organizations reported positive impacts from privacy laws, RIM couldn't quantify its contribution to these outcomes.
What the Relevant Standard Requires
The Generally Accepted Recordkeeping Principles don't specifically mandate integration with AI governance or privacy programs, but they establish a foundation:
Principle of Accountability: Assign responsibility for managing records throughout their lifecycle. This includes ensuring AI system documentation meets regulatory requirements and managing personal data according to privacy policies.
Principle of Integrity: Records must be complete and unaltered, applying directly to AI governance requirements for maintaining assessment logs, training data lineage, and decision audit trails.
Principle of Protection: Protect records based on sensitivity and risk, connecting to privacy requirements for personal data and breach response protocols.
Principle of Compliance: Comply with applicable laws and organizational policies. RIM must support privacy laws across 20 U.S. states, AI regulations requiring transparency and explainability, and industry-specific requirements like HIPAA and GLBA.
Principle of Availability: Records must be accessible when needed. This includes making data maps available during eDiscovery, providing documentation during privacy impact assessments, and producing AI system logs for regulatory audits.
ISO 30300 reinforces this by requiring management systems that integrate records management into organizational processes.
Lessons and Action Items for Your Team
Join the AI Governance Committee Now: Don't wait for an invitation. Reach out to those building your AI governance framework and offer specific capabilities: inventory AI systems, prepare and document training data, maintain assessment logs, and ensure AI system records meet retention and regulatory requirements. Get involved before the framework is finalized without you.
Map Your Capabilities to Privacy Requirements: Your Records Control Schedule already addresses retention and disposition of personal data. Your Business Classification Scheme can support privacy impact assessments. Your accessioning processes can manage consumer data subject access requests. Document these connections in language your privacy team understands, then schedule a meeting to show them.
Build the Legal Hold Bridge: Legal departments change personnel frequently. Create a standing quarterly meeting with your litigation group. Walk them through your data maps. Explain which systems your Records Control Schedule covers and which require special handling. Provide a single point of contact for preservation questions. Make it easier to include you than to work around you.
Quantify Your Breach Response Value: With the average breach costing $4.88 million and taking 258 days to contain, your retention and disposition program reduces exposure. Calculate how much data you've eliminated through defensible disposition. Estimate the reduced scope of a potential breach. Present this to your Chief Compliance Officer in the same meeting where you discuss your role in incident response documentation.
Stop Selling Enron: Every time you reference litigation risks from 2002, you reinforce the perception that your function addresses outdated problems. Instead, start with: "Our privacy program needs data mapping and retention controls. We have both." Or: "AI governance requires documentation of training data and assessment logs. That's what we do."
Your function isn't obsolete, but it's invisible to compliance officers allocating budgets to AI, privacy, and cybersecurity. You're already doing the work these programs need. Now make sure they know it.
