Beyond data governance: Epistemic dependency risk and the emerging mandate for information professionals in the age of AI-mediated knowledge

Existing data- and information-governance frameworks classify, retain and protect organisational data, but they do not govern the externally controlled artificial intelligence (AI) systems through which organisations increasingly access, interpret and reason about that data. This article names that omission epistemic dependency risk: the exposure an organisation carries when its capacity to access, interpret and reason about its own knowledge assets is contingent on AI systems it neither owns nor controls and whose continued availability it cannot guarantee. Distinguishing this risk from the operational and data lock-in already described in the cloud-computing literature, and grounding it in scholarship on epistemic dependence, the article presents a typology of disruption events from 2022 to 2026 — spanning regulatory withdrawal, commercial discontinuation and infrastructure instability — and argues that the risk is new in degree rather than in kind. It proposes a sequential professional response — mapping, classifying and planning — that extends established information-audit, custody and continuity practice rather than departing from it.