Melvin Ryan  Fetalvero

AI Governance Without Killing Innovation: What I Learned from the Enterprise Front Lines

Article (news)

<div><img src="https://od2-image-api.abs-cbn.com/prod/editorImage/1781157520836ai_governance_redesigned.jpg" style="width:960px;display:block;height:auto" class="fr-fic fr-dib" width="960"/>AI Governance Without Killing Innovation: What I Learned from the Enterprise Front Lines. Generated Using Google GeminiI have been working in IT and cybersecurity for more than 20 years. I have seen a lot of technology trends come and go. But nothing moves quite like AI is moving right now, and I think that is both exciting and a little bit scary, especially for those of us responsible for security and governance.</div>I want to share some honest reflections from what I have been seeing and learning in enterprise AI implementations. Not the polished version you see in marketing slides. The real one, including the things that did not go as planned.<div>The Problem Nobody Talks About Honestly </div>Here is the uncomfortable truth I hear from practitioners across industries and regions: AI adoption is moving faster than anyone&#x27;s governance can keep up with. Globally, roughly 87 percent of large enterprises are already implementing AI solutions (Second Talent, 2025). But only 14 percent have enterprise-level AI governance frameworks in place (Aligne.ai, 2025). That gap is where the risk lives.The honest version of what happens inside many organisations sounds something like: &quot;We launched 40 AI projects across five business waves. And then things got messy.&quot;This is more common than people admit. And the reason it happens is not that organizations are reckless; it is because AI adoption is grassroots. It happens at the team level, in HR tools, in sales automation, in finance dashboards. IT and security often find out after the fact. Shadow AI is not a future risk; it is happening right now.I see this pattern across markets. In Australia, where I work and see a lot of enterprise AI conversations firsthand, the public trust deficit makes this even more acute; only 30 percent of Australians believe the benefits of AI outweigh its risks (University of Melbourne/KPMG, 2025). But the underlying governance gap is a global problem. The regulatory environment is just at different stages depending on where you sit.Responsible AI cannot be retrofitted. It has to be designed into systems from the start. That is the part that keeps me up at night. Not the technology itself , the gap between deployment and governance.<div>What Actually Works: Six Lessons from the Field </div>I want to share what I have seen work, from real enterprise deployments, not from theory. Some of these came from conversations and presentations I have been following closely in the industry. None of them are unique to one geography. They apply whether you are operating in Sydney, Singapore, London, or San Francisco.<div>1. Tier Your Governance by Risk, Not by Technology</div>One of the most practical things I have seen work is building a tiered governance structure, matching the level of oversight to the level of risk, not to the type of technology.In practice, many organisations make every AI use case go through the same approval process. That kills adoption speed and frustrates the business without actually reducing risk where it matters most.A better model looks something like this: ● An executive committee for high-risk use cases: regulatory compliance, ethics, anything touching sensitive data or automated decision-making ● An AI Center of Excellence at VP and director level: focused on enablement, training, standardised practices, and shared controls ● A domain-level review board at the manager level: for lower-risk, pre-built, or off-the-shelf use casesThe principle is simple , decisions should be made at the level closest to the risk. Not everything needs to go to the top.I see this same logic showing up in government frameworks. Australia&#x27;s Digital Transformation Agency is finalising an AI Review Committee to advise on high-risk use cases across the public service, review sensitive cases, and support continuous improvement. The EU AI Act uses a risk-based classification system for the same reason. The pattern is consistent globally: match oversight intensity to risk level.<div>2. You Cannot Govern What You Cannot See</div>This sounds obvious. But in practice, many organisations jump straight to controls without first building visibility.What does visibility actually mean in enterprise AI? It means knowing what tools your people are really using, not just what was formally approved. It means procurement rationalisation. It means having business unit partners who can tell you how AI is actually being used on the ground.And this requires trust. If security or IT is seen as a blocker, people find workarounds. Shadow AI gets worse, not better. The goal has to be creating an environment where teams want to surface their AI usage because they know they will get help, not just restrictions.Deloitte&#x27;s research confirms what I see in the field: enterprises where senior leadership actively shapes AI governance achieve significantly greater business value than those delegating it to technical teams alone (Deloitte, State of AI in the Enterprise, 2025). Governance is not a security team problem. It is a leadership problem first.<div>3. Document Everything, Before You Need It</div>This is a lesson I have seen organisations learn the hard way, across multiple industries and markets.When AI is deployed without documented baseline processes, there is nothing to measure against. You cannot tell if AI improved something if you did not measure it before. You cannot catch deviations if there is no standard defined.&quot;You can&#x27;t manage what you don&#x27;t document, and you can&#x27;t document without standards.&quot;A practical AI policy needs to do several things. It should clearly list which technologies are approved and which are not. It should define where human oversight is required, not leave that to individual judgment. It should require mandatory AI awareness training. And for high-risk deployments, legal sign-off should be non-negotiable.The same gap shows up everywhere: existing risk management processes built for conventional IT systems do not adequately cover AI-specific concerns like model drift, training data quality, algorithmic bias, or the interpretability of automated decisions. Documentation is the first step to closing that gap.<div>4. Build Scorecards, Not Just Risk Assessments</div>A lot of AI intake processes only ask &quot;what are the risks?&quot; That is not enough.If you only evaluate risk, you end up either blocking everything, because everything has risk, or approving everything with a disclaimer. Neither is useful.A better approach is a scorecard that evaluates AI use cases across five dimensions: value, cost, risk, feasibility, and strategic alignment. Each dimension gets a score. The combination tells you whether to proceed, what controls to put in place, and what success looks like.The last part is critical; success measures need to be defined before deployment, not after. Once something is live and people have invested time in it, there is enormous pressure to declare it a success regardless of the evidence. Define the benchmark first.<div>5. Deploy in Phases and Constrain Execution Authority, Not Innovation</div>I like to think of this as the difference between a sandbox and a lockbox.A lockbox keeps everything out. A sandbox lets you experiment safely within defined boundaries.What I have seen work is a phased enablement model. You identify which AI capabilities are lower risk and enable them broadly, core chat functionality, collaboration tools within your own environment, and audited deployments. Then you gate the higher-autonomy features, deep web research, autonomous execution, connected external apps, until you have done proper evaluation.For coding agents, especially, I think we need a different mental model entirely. A coding agent is not just another developer tool. It has autonomous execution capability, system call access, and it operates at a level of complexity that traditional security controls were not designed for. The governance evaluation for something like that needs to examine execution surfaces, blast radius, and what enterprise-grade mitigations exist at the vendor level.The principle: constrain execution authority, not innovation. Give teams clear guardrails and then let them move. Organisations with mature governance frameworks deploy AI 40% faster and achieve 30% better ROI from their AI investments than those without (Aligne.ai, 2025). Governance enables speed. It does not slow it down.<div>6. Governance is Continuous, Not a One-Time Gate</div>This is maybe the most important lesson. And the hardest to operationalise.Governance is not a project that ends at deployment. It is an ongoing function. AI models drift. Regulations change. New capabilities get added to tools you already approved. What was acceptable six months ago may not be acceptable today.&quot;Governance must be continuous, not a one-time gate.&quot;This has practical implications: audit and alerting need to run post-deployment, not just at approval time. Policies need scheduled reviews. Teams need to be empowered to escalate when something changes, without fear of being penalised for surfacing an issue.The framing I keep coming back to is sustainable adoption, not just fast adoption. That is the language the Australian Government uses in its responsible AI policy. It is also the language Deloitte uses when they describe what separates organisations that scale AI successfully from those that stall. The word sustainable is doing a lot of work there. It means building something that can keep going when the pressure and scrutiny increase, not just something that looks good in the first quarter.<div>The Sponsorship Question</div>One more thing I want to address directly, because I think it is the most underrated factor in whether AI governance succeeds or fails.<div>You need executive sponsorship. Full stop.</div>Security teams cannot govern AI alone. Legal cannot govern AI alone. No single function can. Effective AI governance requires shared risk ownership across business units, security, legal, and privacy teams, and someone at the executive level who is actively driving that alignment.The cultural side of this is equally important. If developers do not trust the governance process, they route around it. If business units see security as a blocker, they go shadow. Developer trust is foundational to compliance. That is not a soft skill; it is a hard operational requirement.The goal is not restriction. The goal is secure enablement, creating the conditions where AI can be adopted responsibly, at scale, without losing visibility or control. That framing matters. The moment your governance program becomes known internally as the team that says no, you have already lost.<div>Where to Start If You Are Just Beginning</div>I know not everyone reading this is at the same stage. So here is a practical sequence that I think works, regardless of your organisation&#x27;s size, industry, or geography: 1. Build visibility first. Before any controls, understand what is already in use. Audit your AI tool landscape honestly. 2. Set up a tiered governance structure. Not everything needs the same level of scrutiny. Match oversight to risk. 3. Standardise your documentation. Intake forms, risk assessments, and success metrics, these need to exist before deployment, not after. 4. Deploy in phases. Enable lower-risk capabilities broadly. Gate the high-autonomy features until you have proper evaluation in place. 5. Embed controls in design. Access controls, monitoring, alerting, these need to be in the implementation plan from the start, not bolted on afterward. 6. Schedule your governance reviews. AI capabilities are moving fast. Your framework from last year may already be out of date.<div>Final Thought</div>The 77% of organisations actively building or refining AI governance programs (IAPP, 2025) are starting to figure out what I believe is the core truth of this moment: governance is not a constraint on AI adoption. It is what makes AI adoption sustainable. Reference: <a href="https://oecd.ai/en/dashboards/overview">https://oecd.ai/en/dashboards/overview </a>The organisations that will extract the most value from AI are not the ones that move fastest, and they are not the ones that govern most conservatively. They are the ones that build the infrastructure, the policies, the structures, the visibility, and the culture that lets them do both.The ones that skip that foundation will be playing catch-up. And in AI, catch-up is hard.References ● IAPP AI Governance Profession Report 2025 ● IAPP Governance Survey 2024 ● Deloitte, State of AI in the Enterprise 2024–2026 ● Aligne.ai, The AI Governance Crisis Every Executive Must Address in 2025 ● Second Talent, AI Adoption in Enterprise Statistics &amp; Trends 2025 ● AI21, 9 Key AI Governance Frameworks in 2025 ● University of Melbourne / KPMG, Trust in AI Study, 2025 ● Digital Transformation Agency (DTA), Policy for the Responsible Use of AI in Government v2.0, December 2025 ● National AI Centre (NAIC), Guidance for AI Adoption (AI6), October 2025 ● Australian Government, National AI Plan 2025, December 2025 ● IAPP, Global AI Governance Law and Policy: Australia, November 2025 ● SafeAI-Aus, Current Legal Landscape for AI in Australia, January 2026 ● Validata.ai, AI Governance Under CPS 230: What Australian SMEs Need to Know, 2025 ● EU AI Act (Regulation (EU) 2024/1689) ● NIST AI Risk Management Framework (AI RMF 1.0) ● ISO/IEC 42001:2023 , Artificial Intelligence Management Systems ● APRA CPS 230, Operational Risk Management ● Billy Norwood, CISO, FFF Enterprises, Establishing AI Governance Without Stifling Innovation: Lessons Learned (CSA/ISSA San Diego presentation) ● Ragini Ramalingam, Director of Enterprise Security, Snowflake, Enterprise AI Governance at Snowflake: Balancing Innovation &amp; Risk (industry presentation)

I have seen a lot of technology trends come and go. But nothing moves quite like AI is moving right now , and I think that is both exciting and a little bit scary, especially for those of us responsible for security and governance.

I have seen a lot of technology trends come and go. But nothing moves quite like AI is moving right now , and I think that is both exciting and a little bit scary, especially for those of us responsible for security and governance.

AI governance without killing innovation: What I learned from the enterprise front lines

News

Entertainment

Lifestyle

Sports

Metro.Style

More

Sudoku

Word of the Day

Lotto

Horoscope

Technology

AI governance without killing innovation: What I learned from the enterprise front lines

Michael Calizo | Principal Customer Architect | Canberra,

Australia

Published June 11, 2026 02:32 PM PHT

|

Updated June 12, 2026 06:16 AM PHT

Read More:

AI

Artificial Intelligence

Information Technology

IT Governance

Innovation

Computing

Computer Science

ABS-CBN is the leading media and entertainment company in the Philippines, offering quality content across TV, radio, digital, and film. Committed to public service and promoting Filipino values, ABS-CBN continues to inspire and connect audiences worldwide.

Corporate

Investors

Governance

International Distribution

Corporate

Governance

Investors

International Distribution

NPC Seal of Registration

Privacy Policy

AI Policy

Terms of Service

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.