I was recently contacted by a professional on LinkedIn about my experience with commercial AI governance platforms.
The assumption behind the question was clear: that “AI governance” is something that requires a formal product, a structured framework, or a sufficiently large organization before it becomes relevant.
In my experience, that assumption is backwards.
Governance doesn’t begin when you adopt a platform; rather, it begins the moment you introduce AI into a system.
The Common Assumption
There’s a tendency to think about governance as something that arrives later:
- once the system becomes complex enough
- once there are enough users
- once risk becomes visible
- once the organization can justify the investment
At that point, teams start evaluating:
- governance frameworks
- compliance tooling
- vendor platforms
Until then, governance is often treated as optional, or deferred entirely.
The Problem With Waiting
The issue with this approach is not that governance tools are unnecessary.
It’s that delaying governance allows systems to evolve without constraints. Even a well-architected solution - which serves as a "front line" constraint - can allow AI features and integrations to drift in ways that aren't necessarily initially accounted for.
And once patterns are established — even informal ones — they tend to persist.
You start to see things like:
- AI-related changes bypassing normal review processes
- prompt or instruction updates made without traceability
- unclear ownership of AI-driven behaviour
- inconsistent handling of data boundaries or outputs
None of these decisions are individually catastrophic.
But they accumulate.
By the time governance is introduced formally, it’s often correcting an already established system rather than guiding its evolution.
Start Small, But Start Explicitly
Governance does not need to begin as a framework or a product.
It can begin as a small set of explicit practices.
For example:
- Assign a clear owner for each AI feature
- Require pull request review for prompt or instruction changes
- Define unacceptable outputs before releasing a feature
- Log prompts and outputs for later inspection
- Establish basic rules for what data is allowed to reach the model
None of these require a platform.
None of them require a large organization.
But each one introduces a constraint, and those constraints shape how the system evolves (noticing a pattern here?).
Governance as an Iterative System
These practices don’t need to be complete from the start.
They can (and should) evolve.
As the system grows, you might add:
- more structured evaluation processes
- clearer data classification rules
- formal review cadences
- stronger enforcement through tooling
At some point, a governance platform may make sense.
But by then, it is supporting an existing set of practices rather than defining them.
That distinction matters.
A tool can reinforce governance, but it cannot replace it.
Where This Fits Architecturally
In previous posts, I’ve written about architectural constraints — boundaries, layering, and ubiquitous language.
Governance plays a similar role.
It constrains how a system is allowed to change.
Without governance, systems drift.
With even minimal governance, that drift slows down: not because change is prevented, but because change becomes deliberate.
A Practical Way to Think About Readiness
One of the reasons I built a small AI readiness assessment tool was to make these governance dimensions more visible.
Most teams can answer questions about models or infrastructure.
Fewer can answer questions about:
- ownership
- traceability
- data boundaries
- failure handling
Those are the questions that tend to matter later.
If you’re evaluating AI readiness, it’s worth starting there.
Closing Thoughts
AI governance doesn’t need to feel like a large, future initiative.
It can start with a handful of explicit rules.
The important part is not completeness.
It’s that the system begins with constraints.
From there, governance can evolve alongside the system itself, and if a formal governance product or framework becomes helpful when your system becomes sufficiently complex, its integration into that system becomes much smoother.
Top comments (0)