Evidence gap map: data privacy in the AI-governance literature

In plain terms

Privacy is among the most invoked words in AI governance — what does the scholarship behind it actually look like? The engine retrieved a corpus on data privacy in AI governance, coded every abstract into a framework matrix, and counted. The picture: legal-doctrinal work on data-protection law, technical surveys of privacy-preserving methods, and a cluster of health-sector commentary — with 24 of 30 matrix cells empty, and not one included paper reporting an empirical study, quantitative or qualitative, of privacy governance in practice.

Finding (screened coverage map): Across a 5x6 framework matrix, 24 of 30 cells have no papers in this corpus of 12 included records; the populated cells concentrate in aspect 'health_data_privacy_governance' (5 papers) and evidence type 'conceptual_normative' (3 papers).

Background

Policy Window's research engine selected the review kind BEFORE this article was drafted: a review-kind selector matched the question ("What does the scholarly literature report on data privacy in AI governance?") and the measured corpus features (32 records, 28 with abstracts, no comparable quantitative effects, abstracts only) to an evidence gap map (selection bfa5b382fa7c25a2). The topic is the last unserviced robust entry of the engine's own study queue — with this article, every topic the engine selected for itself has been serviced. The article's status is a screened candidate routed to human review, not an adjudicated truth (Sacred Rule 9).

Method

Every record was coded exactly once against a declared frame — five privacy aspects (data-protection law, privacy-preserving techniques, health-data privacy governance, privacy risk and threat analysis, privacy concepts and attitudes) by six evidence types — with a verbatim rationale span per inclusion and a stated reason per exclusion (20 records excluded: off-topic or no abstract; the retrieval pulled in substantial non-privacy governance literature, all named). Review report 06a049597a47a3cb; corpus 8e03bc128d945f19.

What the map shows

The populated region: doctrinal analyses of data-protection law (the GDPR's reach over models and inferences, generative-AI challenges to existing frameworks), technical surveys of privacy-preserving machine learning (federated learning in health), and health-sector privacy commentary. The named empty cells include every privacy aspect crossed with empirical evidence of either kind — across the three topics the engine has now serviced (data transparency, governance frameworks, data privacy), the same cell family is empty every time: this corpus contains conceptual, legal, and technical writing about privacy governance, and no included paper that measures it in operation.

Limitations (disclosed by the engine)

• scoping retrieval with fixed queries, not a systematic search (coverage is query-bounded)
• coding from abstracts only — full texts were not consulted; cells count papers, not extracted effect estimates
• single-annotator coding (in-session:claude-agent); no second coder, no kappa
• corpus bounded to 32 retrieved records; counts are corpus-relative, not field-level claims

Verify

Every count above re-derives offline from the committed corpus and codings — no model, no network, no trust in the institute required: PYTHONPATH=src python scripts/verify_review_data_privacy.py # exit 0 = re-derives offline