Governance-by-Design: What Responsible AI Actually Looks Like Inside a Regulated Enterprise

The Gap Nobody's Governing

Eighty-five percent of AI projects never make it to production. Sixty percent of enterprises have no formal AI risk policy. There's an estimated 3.5 million unfilled cybersecurity and AI governance roles globally.

Those aren't three unrelated stats. They're the same problem from three angles: most organizations are deploying AI faster than they can govern it.

I lead enterprise security architecture and AI governance for a large, globally distributed organization. This post isn't theory, it's what I've learned governing AI systems inside a regulated enterprise, where "move fast and break things" isn't an option because the things that break are audits, financial controls, and people's employment decisions.

Four Risks That Aren't Hypothetical Anymore

Bias and fairness. Mobley v. Workday is the case worth knowing here, a nationwide collective action alleging that Workday's AI hiring-screening tool disparately rejected applicants over 40. It's still active, no verdict yet, but a March 2026 ruling rejected Workday's argument that age-discrimination law doesn't even apply to job applicants. The case matters less for its outcome and more for what it signals: AI vendors, not just the companies using their tools, are now squarely in scope for employment discrimination liability.

Hallucination and accuracy. My favorite cautionary tale is Moffatt v. Air Canada. A chatbot told a customer he could retroactively claim a bereavement fare discount. Air Canada refused to honor it, then argued in tribunal that the chatbot was "a separate legal entity responsible for its own actions." The tribunal didn't buy it, ruling it makes no difference whether the information comes from a static webpage or a chatbot. If your AI tells a customer something wrong, you own it, full stop.

Data privacy and leakage. This is the risk already living in your organization right now. Employees pasting contracts, client data, and proprietary code into consumer AI tools, with zero visibility from IT. Shadow AI isn't a future risk, it's a current one.

Model drift and auditability. The quiet one. A model that performs well at deployment can produce materially different outputs six months later, with no audit trail showing what changed. Nobody writes a headline about a model that got quietly worse, which is exactly why it's dangerous.

The Regulatory Reality Check

A lot of people treat AI regulation as a future problem. It isn't, it's already layered on top of laws that have existed for years:

• SOX: if AI touches a financial control, it inherits the same Section 404 audit exposure as any other system in that chain.
• SEC: the SEC brought its first AI-washing enforcement actions in March 2024 (Delphia, Global Predictions, $400K combined), then charged Presto Automation in January 2025, the first public company case. That's the scope expanding, not staying still.
• GDPR/CCPA: Italy's Garante fined OpenAI €15M in December 2024 over ChatGPT's training data practices. A Rome court later annulled that fine on jurisdictional grounds, not because the underlying findings were wrong.
• EU AI Act: high-risk systems (HR, credit, law enforcement) now require conformity assessment and human oversight. The Workday case, even though it's a US case, is the exact fact pattern this regulation was written to prevent.

Five Pillars That Actually Hold Up

Here's the framework I've seen work in practice, not on a slide:

1. Ownership and accountability. Every AI system has a named business owner, not just a technology team. This one change does more work than anything else on this list, once someone's name is attached to a system they can't fully explain, frivolous deployments drop fast.
2. Data classification. Public, internal, confidential, or restricted, gating model access, storage, and logging requirements.
3. Explainability by design. High-stakes decisions require explainable models. No black-box outputs where a consequential decision can't be traced back to a reason.
4. Continuous monitoring. Drift detection and review cycles that catch degradation before it reaches an actual decision.
5. Human override. Every automated decision affecting an individual needs a human review path. You want that muscle memory built before the day you actually need it.

The Talent Problem Underneath All of It

You're not going to hire your way out of a 3.5-million-role gap. The more realistic path: take your best compliance analyst, security engineer, or data steward, and invest in AI literacy. Domain expertise in your industry is the scarce resource. AI fluency is teachable.

The One-Sentence Takeaway

Governance isn't a blocker to AI, it's what makes AI trustworthy enough to actually scale. Ungoverned AI moves fast right up until legal or the board shuts it down, and that costs a lot more time than governance would have.

---

I write about enterprise security architecture, identity governance, and AI governance in regulated environments. Always happy to talk shop in the comments.

I wrote this because I keep seeing the same pattern: AI governance gets treated as a blocker until the first incident, then it gets treated as an emergency. I'd rather see it built in from day one.

Curious where you land: does your team have a named owner for every AI system in production, or is that still an open question? Drop your answer below, I'll reply to as many as I can.