Govern

Governance that runs slower than deployment does not exist in practice. Teams route around it, risk assessments become checkbox exercises, and nobody can say what is in production. The answer is not heavier review. It is governance built as infrastructure: policy sets the rules, process operationalizes them, and technical controls enforce them at the speed systems ship. Approval is tiered by risk: low-risk work moves on a paved road, high-risk work gets real scrutiny.

This discipline covers where that architecture is tested hardest. Generative models break the reproducibility assumption behind traditional model risk, so validation and monitoring must supply the confidence signal the model cannot. Agents act rather than recommend, which calls for explicit authorization, escalation paths, audit trails and a tested kill switch before the first one ships. Unsanctioned AI use is a demand signal to channel, not a behavior to police. And regulation, led by the EU AI Act, is already enforceable.

Start with the inventory and the audit trail. Principles can be revised later; a record of what your systems did cannot be reconstructed.