Making enterprise AI governable

The problem wasn't the AI

Our largest enterprise customers — aviation, pharmaceuticals, other regulated industries — were not slow to adopt AI-driven automation. They were unable to. Not because the automation didn't work, but because they could not answer three questions their own compliance functions would ask: What is this system about to do? Who approved it? Can we prove what happened, months from now, to a regulator?

Until those questions had answers in the product, the AI roadmap could not reach the accounts that mattered most to the business.

Reframing governance as the precondition

The prevailing internal framing treated governance as a feature request — something to add once the AI capabilities were mature. I argued the opposite: in regulated accounts, governance isn't a layer on top of the product. It is the condition for the product existing there at all. An AI feature that a compliance officer cannot audit is not a feature those customers can buy.

That reframing changed what got prioritized.

Designing the oversight layer

I led design for two connected surfaces.

Human-in-the-loop approvals answered the question of intervention: how does an operator see what the system is about to do, understand the scope of it, and step in before it acts — without the approval step becoming so heavy that the automation loses its value? The tension between oversight and speed is the whole design problem. Too little friction and no one trusts it; too much and no one uses it.

Audit trails answered the question of proof: how does a compliance officer reconstruct a sequence of automated actions long after the fact, at a standard of evidence that satisfies an external regulator rather than an internal debugging session. This is a fundamentally different design target from ordinary activity logs, and treating it as the same thing is the most common way this gets built wrong.

Getting it onto the roadmap, and keeping it there

Advocating for a capability is not the same as shipping it. I brought governance, admin, permissions, and audit into product planning as a named area rather than a set of scattered tickets, and staffed a dedicated team under a manager I had promoted into the role — so the area had an owner who was accountable for it after my attention moved elsewhere.

What I'd do differently

The most difficult aspect of this project was coordination between two separate teams — the AI Team and the Governance Team. I was the only individual involved with both. They had different cadences, different budgets, different KPIs and different incentives. Compromises I agreed to led to slower integration of governance necessities into AI sprint planning. That was a lesson learned for me, and if I were to do it again I would ensure governance was a first-class citizen in AI sprints.