What Counts?

Lee Karas and Maura Dunn close out their ARMA InfoCon 2026 coverage with a full debrief from Savannah, Georgia. AI ran through nearly every session, and so did the questions. How do you control it? What do you do with the prompts? Who decides how it gets used? This episode covers what they learned about records retention and AI, and where the profession goes next.

Made for This Moment

Many attendees saw AI as the moment information governance has prepared for. Accountability, transparency, retention, disposition, and traceability are the foundations AI needs to succeed. Without them, AI stays a shiny new toy instead of a game changer. Yet many practitioners also hit a wall. They know the principles matter, but they are not in the room where AI decisions get made.

The episode returns to a show favorite: the King of Ur, who kept contracts on clay tablets around 3000 BC. Those tablets gave both parties to a transaction a version they could trust. Every organization still needs that today. AI makes it harder, because it can create convincing content out of nothing.

Confidence Is Not Accuracy

Speaker after speaker made the same point. AI is good at confidence. Whether the answer is right is a different story. Conflicting data and early drafts trip it up, because the tool lacks the context records managers bring. That context, along with traceability and accountability, gets lost when you turn AI loose on your content.

Rethinking Retention and Disposition

The most important question of the week had no answer yet. Can retention and disposition move from tight controls to a good faith effort based on confidence levels? Data volumes have outgrown the controls that worked for paper and well-mapped shared drives. AI adds even more. If the old level of control is no longer possible, the profession should stop promising it. Instead, practitioners should weigh what they give up and document the risk. That question sits at the center of records retention and AI.

IT Secures It, Privacy Limits It, Governance Proves It

Lee and Maura offer a simple way to divide the work. IT secures the data. Privacy limits it. Information governance proves it. A strong information governance program does all three. That proof is not 100% locked down. It rests on an honest understanding of confidence levels and risk factors.

The technical track showed how much larger a role technology now plays at ARMA. Many organizations look to Microsoft Purview to govern what Copilot can see. The controls are still maturing, and the hosts are still learning the tool. Either way, file plans, sensitivity labels, and records categories matter more than ever.

Find Out Where You Stand

Start with the IG Navigator, a free eight-question assessment on the TrailBlazer Learning Academy.

Episode Chapters

00:00 Arriving at ARMA InfoCon 2026

00:43 Back to our roots and the AI theme

01:56 How do you control it? The questions in every session

03:01 Records management skills in the age of AI

03:35 Made for this moment: the principles AI depends on

04:50 Getting invited into the AI conversation

05:22 The King of Ur and records both parties can trust

06:48 AI confidence versus accuracy

08:13 Saying yes without abandoning the fundamentals

09:15 Retention and disposition: from tight control to confidence levels

11:38 IT secures it, privacy limits it, governance proves it

12:24 Microsoft Purview, Copilot, and the technical track

14:46 File plans, sensitivity labels, and records categories

15:04 A successful return to ARMA InfoCon

What Counts is produced by TrailBlazer Consulting, LLC and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [email protected]. Explore compliance-ready corporate training programs at the TrailBlazer Learning Academy. Read more from Maura at Maura’s Substack. Music by Jason Blake. Full disclaimer.

InfoCon Update: AI and Information Governance

What Counts checks in from the convention center at ARMA InfoCon. After a weekend of pre-conference activities and leadership sessions for chapter and regional leaders and the board of directors, the educational sessions and exhibit hall are in full swing. One theme runs through all of it: AI and information governance. The message from day two is clear: IG professionals are critical to the success of AI in business, government, and every other kind of organization. This is a short update from the floor, with the full debrief to come once we are home.

Why AI depends on the records behind it

An AI tool is only as reliable as the content it reads. When that content includes superseded drafts, duplicate copies, and files kept long past their retention period, the model surfaces outdated answers with full confidence. Over-retained data also widens exposure in litigation and discovery, because anything an organization keeps, it may have to produce.

The fix is work IG professionals already do. A records retention schedule defines what to keep and for how long. Defensible disposition removes what has met its retention period. Legal holds preserve what must not be destroyed. A clear line between records and non-records keeps convenience copies out of the retrieval set. Together, these controls give AI a smaller, cleaner, and more trustworthy body of content to work from.

That is why the governance of information belongs at the start of every AI project, not at the end. We will share more of what we learned at InfoCon in an upcoming episode.

Episode chapters

00:00 Welcome to What Counts

00:17 Day two at InfoCon

00:53 Why IG professionals matter to AI

01:10 More when we get home

What Counts is produced by TrailBlazer Consulting, LLC and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [email protected]. Explore compliance-ready corporate training programs at the TrailBlazer Learning Academy. Read more from Maura at Maura’s Substack. Music by Jason Blake. Full disclaimer.

Lee Karas and Maura Dunn take What Counts on location for the first time. They recorded this episode live from ARMA InfoCon 2026 in Savannah, Georgia. In this short check-in, they explain why information governance and AI belong in the same conversation.

Back to Our Information Management Roots

For both hosts, InfoCon is a return to their information management roots. It is also their first InfoCon since ARMA adopted the name. Their goal for the week is simple. They want to talk with records and governance professionals and learn what those practitioners see in their own organizations. Then they will bring those lessons back to the show.

Why Governance Comes First

The core point of the episode is direct. Governance is the critical path to proving that AI output deserves trust. An AI tool can only leverage the content you give it. So you must prove that content first. Know which version is the record, where it lives, who owns it, and how long you must keep it.

Records managers already own the disciplines that supply that proof. A records retention schedule ties content to the business process that created it. Defensible disposition clears out redundant, obsolete, and trivial (ROT) data. Legal holds preserve what must not change. Access controls keep sensitive material out of the wrong answers. Skip these steps, and your AI tools draw from more noise and repeat more risk.

That is why we expect information governance to take off as AI adoption grows. Governance proves your information, and AI puts it to work. This is our first live shot. We hope you will join us for the next one.

Episode Chapters

00:00 Welcome to What Counts, live from ARMA InfoCon

00:30 Back to our information management roots

00:51 What brought us here: governance in the world of AI

01:14 Why governance is the critical path to trustworthy AI

01:34 Our first live shot and sign-off

What Counts is produced by TrailBlazer Consulting, LLC and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [email protected]. Explore compliance-ready corporate training programs at the TrailBlazer Learning Academy. Read more from Maura at Maura’s Substack. Music by Jason Blake. Full disclaimer.

Data Lifecycle: The Cost of Keeping Everything Forever

In Episode 145, a lightning round that takes on the keeping everything forever mentality.

Staff lose time every day hunting through duplicate versions. Eventually someone shares the wrong one with a counterparty.

A data breach exposes far more than it needed to. In litigation or an audit, everything responsive that you still hold must be searched, reviewed, sometimes converted, and produced. That holds even when it hurts you, and even when a retention schedule would have allowed its disposal years earlier. Privacy laws add deletion requests on top, where you must state with certainty that the data is gone.

Why keeping everything forever feeds AI hallucinations

Lee raises AI, and Maura connects it to the old big data promise of a hidden gem buried in abandoned research. Point AI tools at neglected data, and you are more likely to get a confident, internally consistent answer built on old versions, mixed versions, and research you abandoned for good reason.

Migration copies make it worse. When the same file appears 35 times across servers, an AI may treat repetition as relevance. The episode closes with Maura's verdict: keep everything forever, regret it forever.

Episode chapters

00:00 Lightning round: should you keep everything forever?

00:35 Storage is cheap, so why not?

01:10 The daily cost of finding the wrong version

02:10 Search, wrong versions, and breach exposure

02:52 Discovery: review, conversion, and disclosing what hurts you

03:49 Privacy laws and deletion requests

04:23 Record keeping does not happen in a vacuum: the food bank test

05:11 AI hallucinations and the big data hidden-gem myth

06:51 Mixed versions, migration copies, and lost context

07:57 How duplicates inflate AI relevance scores

08:41 Keep everything forever, regret it forever

08:59 How to reach us

Apps mentioned in this episode: TrailBlazer Tracker is available on the Microsoft Store, the App Store, and Google Play. TrailBlazer Insight is available on the Microsoft Store.

Closing

What Counts is produced by TrailBlazer Consulting, LLC and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [email protected]. Explore compliance-ready corporate training programs at the TrailBlazer Learning Academy. Read more from Maura at Maura's Substack. Music by Jason Blake. Full disclaimer.

Training vs automation in information governance is a risk decision, not a technology preference. In this lightning round, Lee Karas and Maura Dunn explain why training alone rarely holds. At maturity level one, a program works only when individual people make heroic efforts. However, manual filing breaks down fast, because "I'll file that tomorrow" rarely turns into done. For a small company with low regulatory and litigation risk, training is often the right answer since it costs little. By contrast, a global company in a heavily regulated industry cannot afford inconsistent records. Then comes the regulator who called one records response "not good enough" while staff searched fifty years of paper. Finally, a pipeline example shows why weld inspections need a process that captures proof. So before you weigh training vs automation in information governance, start with risk assessment and policy.

## Training vs Automation in Information Governance: Episode Chapters

0:00 Training vs automation in information governance

0:45 When records programs ran on training

1:22 People vs process and the maturity model

2:17 Why manual filing breaks down

3:11 When training is the right answer

4:09 When your risk profile calls for automation

5:37 What happens when a regulator asks for proof

7:20 The cost of automation vs the cost of risk

7:45 Pipeline welds and materials traceability

9:13 Why risk assessment and policy come first

This episode is brought to you by TrailBlazer Tracker.

The contract you cannot find is also the contract that auto-renews without you. Tracker reads your PDFs, Word files, and scanned paper, pulls out renewal, cancellation, notice, and payment dates, and puts them on your calendar with lead-time alarms. Every date shows the exact source line it came from, so you can prove where it came from. Track your first document free, forever. Available on the [App Store](https://apps.apple.com/us/app/id6791267818), [Google Play](https://play.google.com/store/apps/details?id=com.trailblazer.rt), and the [Microsoft Store](https://apps.microsoft.com/detail/9pn7wd53t24m?hl=en-US&gl=US). Details at [trailblazer.us.com/tracker](https://trailblazer.us.com/tracker/).

## About What Counts

What Counts is produced by [TrailBlazer Consulting, LLC](https://trailblazer.us.com/) and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [[email protected]](mailto:[email protected]). Explore compliance-ready corporate training programs at the [TrailBlazer Learning Academy](https://trailblazerlearningacademy.com/). Read more from Maura at [Maura's Substack](https://mauradunn.substack.com/). Music by Jason Blake. [Full disclaimer](https://trailblazer.us.com/policy-page/).

Why You Need Information Governance Policies

Why do you need information governance policies? In this lightning round of What Counts, Lee Karas and Maura Dunn explain how policy turns records into dependable evidence. First, Maura shows how a written policy sets expectations for your team and for everyone who relies on you. Next, they tackle a hard question: is a policy you ignore worse than no policy at all? In court, it can lead to an adverse inference. Outside court, food recalls and a bank incentive scandal show the same gap between policy and practice. Then Maura ranks the three information governance policies that matter most. They are the retention schedule, legal hold, and electronic communications. Finally, they discuss why Teams, Slack, texts, and even AI prompts create records that need clear rules.

Episode Chapters

00:00 Welcome to the lightning round

00:53 Consistency, and policy versus process

01:32 Why records exist: evidence and compliance

02:39 How information governance policies set expectations

03:55 Because it says so? How policy protects you

05:21 Is an ignored policy worse than none?

06:49 Food recalls and policies nobody followed

09:49 When a bank's incentives beat its policy

10:48 Too many policies, and what matters most

11:00 First policy: the retention schedule

12:01 Second policy: legal hold

13:37 Third policy: electronic communications

16:10 Finally, where AI prompts fit

17:33 Closing and how to reach us

This episode is brought to you by TrailBlazer Tracker.

The contract you cannot find is also the contract that auto-renews without you. Tracker reads your PDFs, Word files, and scanned paper, pulls out renewal, cancellation, notice, and payment dates, and puts them on your calendar with lead-time alarms. Every date shows the exact source line it came from, so you can prove where it came from. Track your first document free, forever. Available on the App Store, Google Play, and the Microsoft Store. Details at trailblazer.us.com/tracker.

About What Counts

What Counts is produced by TrailBlazer Consulting, LLC and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [email protected]. Explore compliance-ready corporate training programs at the TrailBlazer Learning Academy. Read more from Maura at Maura's Substack. Music by Jason Blake. Full disclaimer.

Most people hear "information governance risk" and think immediately of a data breach. In this lightning round, Lee Karas and Maura Dunn argue that the breach is only one risk on the list, and often not the one that costs you most. They work through the risk of not being able to reach your own information, using the New England PBS stations whose seventy years of program archives went dark when their cloud provider failed; the risk of ransomware, where nobody wants your data and simply locking you out of it is enough to stop the business; and the risk of the single hard drive or the single box of paper. From there they get practical about scaling risk to the organization: the one-person mechanic shop with three record types that matter (employment, hazardous materials disposal, and financial records supporting the tax return) against the charter school carrying accreditation, curriculum, teacher credentialing, facilities, and student transcripts that graduates ask for fifty years later. They then take on age as its own risk factor, since a company that has kept everything has both a volume problem and an exposure problem: underwriting records written under rules that changed decades ago, or environmental records from an era when the answer was to dump it in the ground. The through line is that a risk assessment is not an academic exercise. It is the input to the retention schedule you build, the repositories you pick, the providers you trust with fiduciary-level responsibility, and whether you are ready to put an AI system on top of any of it.

Episode chapters

00:00 Cold open: the lightning round

00:14 Welcome to What Counts

00:29 What is information governance risk?

00:48 The breach answer: financial records and PII

01:53 A second definition: you cannot find it when you need it

02:55 The PBS archive that disappeared inside a cloud provider

03:53 Why inaccessibility goes straight to the bottom line

04:24 Sizing breach risk: are you actually a target?

05:34 Ransomware and being locked out of your own data

06:06 One hard drive, one box: single points of failure

06:20 The mechanic who keeps everything in paper

07:53 Three record types a one-person shop still has to manage

08:42 The charter school: accreditation, curriculum, and student records

11:27 Company age as a risk factor: volume and obsolete rules

12:11 Underwriting and environmental records that come back to bite

14:02 No program, no proof: auditors, regulators, and courts

15:56 Fiduciary duty and vendor due diligence

16:37 Deploying AI without an IG program underneath it

17:40 Turning the assessment into retention and repository decisions

18:46 Wrap-up

19:07 Closing credits

Sponsor block

This episode is brought to you by TrailBlazer Tracker.

The contract you cannot find is also the contract that auto-renews without you. Tracker reads your PDFs, Word files, and scanned paper, pulls out renewal, cancellation, notice, and payment dates, and puts them on your calendar with lead-time alarms. Every date shows the exact source line it came from, so you can prove where it came from. Track your first document free, forever. Available on the App Store, Google Play, and the Microsoft Store. Details at trailblazer.us.com/tracker.

Closing

What Counts is produced by TrailBlazer Consulting, LLC and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [email protected]. Explore compliance-ready corporate training programs at the TrailBlazer Learning Academy. Read more from Maura at Maura's Substack. Music by Jason Blake. Full disclaimer.

Records vs Non-Records: What Counts as Evidence

Records vs non-records is the first distinction any information governance program has to get right, and most organizations never make it explicitly. In the opening episode of our lightning round series, Lee Karas and Maura Dunn answer both halves of the question: what is a record, and what is not. A record is any data, in any format, that is recorded or capable of being recorded and that provides evidence of a transaction, a decision, a policy, a process, an obligation, a contract, an agreement, a legal right, or an ownership interest. Format is irrelevant. Structured data, photographs, and recordings qualify; an unrecorded conversation does not, which is why "did you get that in writing" has survived as advice. Maura draws the line at evidence: discarded drafts, background reading, and abandoned research are recorded and are not records, because they are not where the organization landed. Published material you cite belongs to whoever originated it, so your record is the citation, not the source. We close with a Sarbanes-Oxley example that makes the principle concrete: in vendor verification, the record is not the tax identification number you looked up, it is the documented fact that you checked it.

Records findability starts at the point of creation

Trustworthy information has four attributes. It must be accurate, reliable, timely, and findable. Last episode covered the first two. This week, Lee Karas and Maura Dunn take on the other two.

The rule does not change. Capture the record where the work happens. Capture it when it happens. Capture it from the people doing the work. As a result, timeliness and findability follow along.

Why your file dates cannot be trusted

Open a shared drive and sort by date. The dates look authoritative. However, they are not.

Sometimes opening a document changes the date. The created date gives way to the modified date. Meanwhile, that modified date may only mean someone glanced at the file.

Auto-save makes it worse. Word saves before you rename your copy. Your manual version scheme then breaks quietly. It never runs at all in Microsoft Project or Visio. Even in Excel, it can miss when OneDrive has not finished logging in.

Timeliness is proof, not a timestamp

An approval date proves timeliness. So capture it deliberately. A workflow engine already knows who drafted, who commented, who approved, and when. Record that context anyway, because property values alone will not carry it.

Maura describes a client who did this on paper. Every requirements document carried five or six signature blocks. Each reviewer initialed and dated in ink. Then the team scanned it. An e-signature process gets you the same result today, with less effort.

Traceability at every step

Business requirement one becomes functional requirements 1.3, 1.4, and 1.5. That trace increases accuracy. The sign-offs at each step add timeliness.

Universe search versus precision search

Library science calls keyword search a universe search. You give it three words. In return, it gives you everything near those words. For example, ask for "training" and you also get "learning."

The result set grows. The usefulness does not. Instead of the whole company, you now face a couple thousand documents.

A precision search works differently. First you set the file type. Next you name the business process. Then you name the contract or the facility. Now the found set is small enough to use.

Metadata is what makes records findable

Four elements matter most: function, process, record category, and trigger date or event. Those are real data, not keywords. Because of that, you can filter on them and build a collection. In other words, you get a virtual folder without a physical file plan.

Maura and Lee revisit an old FileNet argument on exactly this point. An IT lead wanted no folders and no file plan. He trusted full-text search to sort out billions of documents. He was partly right, but for the wrong reason.

Search, access, and retrieval

Findability has three parts. Search identifies potentially responsive material. Retrieval pulls it back so you can use it. Access decides whether you may open it at all.

Sometimes users can see that a record exists but cannot read it. Sometimes they cannot see it at all. That choice is yours, so make it on purpose.

Episode chapters

00:00 Timeliness and findability: the two attributes we still owe you

00:58 Why the date on the file lies: created versus modified

02:12 Auto-save versus manual versioning, and when OneDrive has not logged in yet

04:35 A tangent worth an episode: password management as a mapping problem

05:34 Capture at the point of creation, then make capture into storage

06:39 What the workflow engine already knows, and what you must record by hand

08:09 Ink initials and signature blocks: traceability from business to functional requirements

09:44 The universe search: three keywords, a million results, ranked by confidence

11:51 The precision search: file type, process, and facility narrow it down

12:58 Process metadata tags every file behind the scenes

14:27 The FileNet argument: "we will just use search"

15:24 Function, process, record category, and trigger as real metadata, not keywords

17:19 Contract records split: construction and non-construction retention

18:47 Collections as virtual folders, and knowing your repository before you commit

19:46 Search, access, and retrieval: three parts of one problem

20:39 Should users know a record exists if they cannot open it?

Closing

What Counts is produced by TrailBlazer Consulting, LLC and hosted by Lee Karas and Maura Dunn. Learn more or reach out directly at [email protected]. Explore compliance-ready corporate training programs at the TrailBlazer Learning Academy. Read more from Maura at Maura's Substack. Music by Jason Blake. Full disclaimer.

Provenance decides whether your data is AI-ready

Everyone wants to point AI at their content repositories. Maura Dunn's position in Episode 139 is simpler than that. A model can only be as trustworthy as the data feeding it. Provenance settles that question long before anyone builds a pipeline.

Records capture points settle provenance. These are the moments in a business process where an input becomes a record. Seventeen (17) steps later, the process has changed that input into something new. That is another capture point. Every copy, every hand-off, every transformation makes chain of custody harder to establish.

Content versus context

Our back file characterization approach documents the method while we build it. We do not hand a client a disposition report with no reasoning attached.

Consider a recommendation to destroy sixty (60) of seventy-five (75) files. That report is content. The folder structures, file properties, creation and modification dates, and security group access rights behind it are context.

Context gives the client something to react to. We can say we hold this level of confidence that these records align with your sales and marketing category. That category carries an end of fiscal year trigger and a five (5) year retention period. The client then makes the risk judgment. Without context, one answer survives a year later: "because Maura said so."

What the Superfund SITREP got away with

We built the same principle into our records process mapping work.

The contrast comes from the US EPA Superfund program. A SITREP moved from field samples and a gas chromatograph printout to a typed memo in a drawer. Eventually it went into a box at the Federal Records Center. That process produced no interim record steps. In a paper world, it did not need to.

Engineering records capture points into the workflow

Digital process manipulates information continuously. So the workflow itself has to carry the capture points. Mark the inputs and the interim decision support drafts. Mark the comment responses where public comment periods apply, and the finals.

Automated workflow and document management version control make those records capture points easier to build than ever. Growing volume makes the discipline harder. Records prove what happened. That proof now doubles as the audit trail for whatever your AI does next.