The Mistakes I See Most Often
Artificial intelligence is moving faster inside many organizations than the policies, controls, and accountability structures designed to govern it.
And that may be the most common mistake I see today: adoption is happening before organizations have fully decided how AI should be governed.
Employees are already experimenting with AI. Business teams are finding new use cases. Vendors are embedding AI into products organizations already use.
The opportunity is significant. But so is the responsibility to understand where AI is being used, what information it can access, and how its outputs are influencing business decisions.
Two mistakes, in particular, continue to surface.
Mistake #1: Letting Adoption Outpace Governance
AI adoption rarely waits for a formal enterprise strategy.
Employees naturally gravitate toward tools that help them work faster, analyze information, summarize documents, create content, or solve problems. The challenge is that this experimentation can introduce risk before leadership even realizes it exists.
Confidential, proprietary, customer, employee, or other sensitive information can make its way into platforms that have never been reviewed or approved.
AI-generated information may be accepted as accurate without sufficient validation.
And regulatory, contractual, privacy, or security obligations may not receive attention until after a problem occurs.
The answer is not to stop innovation.
It is to create enough structure around innovation that the organization understands what is being used, what information is being exposed, who is accountable, and what level of risk is acceptable.
Mistake #2: Treating AI as an IT Initiative
The second mistake is organizational.
AI may depend on technology, but AI governance is not simply an IT responsibility.
Its impact extends across legal, compliance, cybersecurity, privacy, human resources, finance, operations, risk management, and executive leadership.
Consider a few simple questions:
Who determines whether sensitive information can be entered into an AI platform?
Who evaluates the contractual and data-handling practices of an AI vendor?
Who decides when an AI-generated recommendation requires human review?
Who is accountable when AI influences a decision that affects a customer, employee, financial outcome, or business operation?
Those are not technology questions alone. They are enterprise governance questions.
When AI is managed primarily as a technology project, accountability gaps can emerge between functions. And those gaps are often where the greatest risks reside.
Innovation and Protection Are Not Opposing Goals
I have spent much of my career helping organizations balance technology advancement with cybersecurity, risk, governance, and business priorities.
One principle continues to hold true: innovation and protection do not have to compete.
Done correctly, they reinforce one another.
Organizations that understand their risks can make better decisions about where to move quickly, where additional controls are necessary, and where experimentation is appropriate.
That is what risk-based governance looks like in practice.
It means applying the right level of oversight based on the sensitivity of the information, the business use case, and the potential impact. That may include appropriate access controls, data classification, monitoring, human oversight, vendor governance, and clearly defined accountability.
The objective is not to eliminate risk. It is to understand it well enough to make informed decisions.
Trust, but verify.
AI can create tremendous business value. The organizations that benefit most will not necessarily be those that adopt it fastest, but those that can innovate while maintaining the trust of their customers, employees, partners, and stakeholders.
A Question for Leaders
Which of these two mistakes has your organization already encountered — adoption outpacing governance, or AI being treated as “just an IT thing”?
I would welcome your perspective.
