I hear two things from CEOs on the broad topic of AI governance. One is that they’re accelerating deployment and use of agents across the organization and have no idea how to manage the risk as they scale. The second concern is that the AI risk management that they have in place is cumbersome and slow, leading to growing frustration from business leaders.
The desire to move fast on AI without putting appropriate risk management in place can result in a system lapse or use cases being deployed in areas with strong regulatory requirements that organizations are unprepared for. That’s a serious business liability and could ultimately lead to an erosion of customer trust. At the same time, efforts to manage this risk should not create unnecessary friction that slows the business down.
It’s also important to recognize where we are in the evolution of AI technology. What we’re seeing many organizations implement is a risk management program designed for the world three or four years ago. They’re very formulaic and bureaucratic, with heavy processes and lots of approval gates. That was fine when a company had two or three AI systems being built centrally; you can take a lot of time to work through approvals. But it all falls apart in a world that’s trying to scale AI at an exponential rate—the system cannot keep up.
That’s when you start to see the fissures. The problem I frequently get called in to solve is when business units are facing bottlenecks due to cumbersome risk management. When managing AI risk is a laborious process, good ideas get abandoned and the business experiences unnecessary delays.
When AI governance is working effectively and efficiently, AI risk and quality management is an enabler for the business. It brings inherent benefit to product teams by helping them design systems that deliver maximum value without exposing the business to risk. When AI governance fails, it destroys value.
How do you achieve good AI risk management? There is no fixed design. It depends on your organization maturity, structure, operating norms, and culture. The starting point is to think about your organization’s risk tolerance, the use cases and systems that are inherently low risk, and those that require deeper review. You can then start to implement a streamlined intake and triage system—a simple questionnaire versus a pile of paperwork—which allows you to assess inherent risk and automatically approve low-risk uses. Deeper human review is concentrated on the AI products that carry the greatest risk.
Business users implementing this system are getting near instantaneous access to a lot of their use cases. They feel better about the process because the cases they know are low risk are easily getting approved. Users are more accepting of the process because if they’ve submitted 20 use cases and 18 are automatically approved, they inherently understand that the remaining cases are the ones that need more attention—and the risk management team isn’t wasting their time looking at low-risk cases.
Good AI Governance Requires Leadership and Resources
So what can CEOs do now to deploy AI risk management that matches their AI ambitions? Understand the enterprise AI investments must include adequate budget for AI governance, alongside the tech and build spend. Then empower a C-suite leader to lead the initiative and be accountable for delivering it on behalf of the organization. This is a cross-functional challenge. Choose someone with enough stature to really drive change across functions, and telegraph to the organization that this truly matters. Finally, resource it appropriately, with headcount and budget. There is real work to operationalizing an AI governance program—and that requires real resources.
Implementing strong AI governance is entirely achievable. An organization will have foundational assets already in place, including risk management committees, risk processes, and software release cycles. The key is strategically injecting the stage gates and reviews needed to manage AI risk—and making it a priority. What you’re actually developing is a sociotechnical system, where people are paired with technology. Outcomes of the system should deliver value versus doing harm.
Get AI governance right and it won’t be a brake on ambition; it will enable companies to advance with confidence. Get governance wrong and every bit of value you’ve built with experimentation and early wins could unravel because of a single incident. The CEOs who treat governance as core part of their AI transformation and not a compliance overhead will be the ones to build trust with their teams and customers. That trust, once built, is the real unlock to successfully scale AI.
