PIM workflow and governance requirements: process, roles, audit

What do PIM process and governance requirements cover?

Process and governance requirements describe how people work in the PIM: who creates, enriches, approves and publishes which data, under which controls. They are the second domain of the PIM requirements guide, and they decide user adoption more than any other domain. PIM Selection publishes 60 of them in nine groups.

Process requirements only make sense against a designed process. Map your new product introduction, change and phase-out flows first, with an owner per attribute group. The governance model behind this is described in product data governance.

Which workflow requirements matter most?

The workflow requirements that matter most are configuration without code, parallel routing and a personal task list. Together they decide whether the PIM shortens time to market or adds another queue.

Configuration without code (PR-001) lets administrators change steps, assignees and conditions as teams change. Ask the vendor to build a three-step workflow from your process description live in the demo. The time it takes is a fair predictor of how often your workflows will be updated after go-live.

Parallel routing (PR-002) sends a new product to marketing, technical and compliance owners at the same time where their steps are independent. Sequential handovers are a common reason new products take weeks to reach a channel. Event triggers (PR-003) start workflows on creation, import or lifecycle change, so nobody has to remember to start them.

A personal task list (PR-004) shows each editor what is due, with priority and the missing attributes. Lead time reporting per step (PR-006) then shows where products wait. Without that report, time-to-market discussions stay anecdotal.

How detailed should permissions and approvals be?

Permissions should reach attribute group, family, category, channel and locale, and approvals should apply only to designated attributes. Coarse permissions push work outside the PIM. Blanket approvals slow everything and protect nothing.

Three permission requirements carry most of the weight. PR-009 sets the permission level. PR-010 separates read, edit and approve rights for the same attribute group. PR-014 applies those rights equally to the user interface, bulk edit, import and API. Test PR-014 by importing a protected attribute with a restricted user and confirming the import is refused.

Approvals need a draft and published layer (PR-027), so channels keep receiving the last approved version while editing continues. Approvers need to see the proposed value next to the published value (PR-024). Regulatory attributes can require a second approver in a compliance role (PR-025).

Environmental claims deserve a dedicated control. Directive (EU) 2024/825 on consumers and the green transition has applied since 27 September 2026. It targets environmental claims made without recognised substantiation. PR-026 blocks publication of a claim until a compliance role approves it with evidence attached.

What audit trail does a PIM need?

A PIM needs an audit trail that records every event, cannot be edited and links regulated changes to evidence. Product data disputes, recalls and regulatory audits all start with a question about what was published, by whom and when.

PR-029 asks for every create, update, delete, approval and export event with user, timestamp and before and after values. PR-030 protects those records from business users and administrators. PR-031 makes them searchable and exportable by product, attribute, user and date.

Two requirements matter for regulated products. PR-032 records which product version reached which channel and when. PR-033 links each change to a regulatory attribute to the evidence that justified it and the person who verified it. Under GPSR, which has applied since 13 December 2024, online offers carry safety information that you may need to evidence later.

Ask the vendor to show how an administrator would try to remove an audit entry, and what happens. The answer tells you whether the trail has evidential value.

How do we test supplier collaboration in a PIM?

Test supplier collaboration with one of your real supplier files, submitted through the portal or template during the demo. Supplier data is the largest data source for distributors and retailers, and quality must be enforced at the door.

The core requirements form one flow. The portal applies your definitions and rules (PR-035). Submissions land in staging until they pass validation and approval (PR-036). Suppliers receive row-level feedback and correct their own data (PR-037). Reusable mappings handle supplier structures and standards files such as ETIM, ECLASS and BMEcat (PR-038).

Two supporting requirements keep the process manageable at scale. Onboarding status per supplier (PR-039) lets category managers steer by supplier. Data requests per product (PR-040) collect missing items such as packaging weights for PPWR reporting. Certificates with expiry dates (PR-041) start renewal tasks before audits find them.

The architecture behind supplier data flows is covered in supplier onboarding.

AI-assisted enrichment and translation under governance

AI-assisted enrichment belongs in the process domain, because the controls around it matter more than the model behind it. AI is useful for attribute extraction, translation and channel descriptions, and unreliable for regulatory data.

Three requirements are non-negotiable in PIMvendors selections. AI values are proposals until a named role accepts them (PR-048). Every AI value records its model, prompt version, inputs and accepting user (PR-049). Safety and regulatory attributes can be excluded from AI generation (PR-050). Measured acceptance rates on your own products (PR-051) and visible cost per job (PR-052) complete the set. The full reasoning is on requirements for AI features in a PIM.

Translation follows the same logic. Jobs are created per locale and sent to a provider (PR-056). Only changed text is sent (PR-057). A glossary and translation memory apply to human and machine translation alike (PR-058).

The 60 published process and governance requirements

The full PR set is listed below with statement, rationale, test, default priority and tags. Filter, adjust and export it in the PIM requirements checklist.

{{list:requirements:PR}}