Governance that moves with you: why AI control should accelerate innovation, not slow it down
Generative AI and automated decision-making are rapidly finding their way into the workplace. This exposes a tension that often goes unspoken in the boardroom. The board wants to seize the strategic opportunities, and the business wants speed. Risk, compliance and audit want to be able to demonstrate that it is all done in a controlled way, in line with the EU AI Act and ISO/IEC 42001.
This is often presented as a choice between innovation and control. That is a fallacy. The problem is not too much control. The problem is that control was designed for a different kind of risk.
Why the classic model breaks down
Traditional governance and internal control frameworks rest on three implicit assumptions. With AI, none of them hold anymore.
1. The controlled object is stable. An ERP process barely changes after go-live. An AI system does. Vendors update their models, data shifts, and prompts and configurations are adjusted. Output can gradually drift without anyone consciously changing anything. A control tested at deployment says little about how the system behaves three months later.
2. Periodic testing is sufficient. The annual test of design, existence and operating effectiveness provides assurance for stable processes. For systems that change every month, you are testing a snapshot of something that no longer exists. The result is an in-control statement that is correct on paper but says little about the current risk profile.
3. Control is a central check up front. In the classic model, a central function, often the second line, reviews every initiative in advance. With a handful of projects, that works. With dozens of AI applications, most of them low-risk, it creates a bottleneck. It also wrongly keeps ownership of the risks away from the first line.
Two failure patterns
In practice, organisations fall into one of two traps.
The brake on innovation. The approval process is so heavy that initiatives stall for months. Employees turn to their own tools: shadow AI. Strict governance thus results in less grip on risk, because actual usage disappears from view. You cannot control risk in a system you do not know exists.
False assurance. The organisation has an external firm draw up an AI policy, a risk framework and an extensive control checklist. On paper, everything is in place. But policy without working controls is paper governance. The design is there, the existence is questionable and the operating effectiveness has never been tested. Once the consultants leave, the knowledge needed to maintain the framework leaves with them. Meanwhile, technology, regulation and risks keep moving.
Both patterns share the same root cause: control is treated as something that happens after or alongside the work, rather than as part of it.
The alternative: control as a steering mechanism
Good governance is not a brake but a rudder. It ensures the organisation makes deliberate choices about which opportunities to pursue, within a risk appetite the board has explicitly set.
For AI, this calls for a continuous management system rather than static checkpoints. ISO/IEC 42001 provides the structure for this: an AI management system (AIMS) that is continuously evaluated and improved through the Plan-Do-Check-Act cycle. On the risk side, the NIST AI Risk Management Framework fits well, with its Govern, Map, Measure and Manage functions as a practical guide.
In concrete terms, there are five building blocks.
1. Start with strategy, not technology
AI governance detached from strategy becomes a compliance exercise. So first translate strategic objectives into a portfolio of AI applications. Which application contributes to which objective, and what value do we expect from it? Only then does it become clear which risks are worth taking. Strategy deployment and AI governance belong at the same table.
2. Make risk appetite explicit and control proportionate
Not every application deserves the same regime. An internal tool that summarises meeting notes is something else entirely than a model that assesses credit applications or selects job candidates.
Define the organisation’s risk appetite and translate it into a triage with two routes:
Fast track: for low-risk applications, with standard controls.
Full track: for applications with significant impact on people or on the organisation, including an AI impact assessment (ISO/IEC 42001, clause 6.1.4).
This way, governance speeds up the majority of initiatives and focuses attention where it matters.
3. Build control into the process (governance by design)
Control belongs inside the development and implementation process itself, not in an after-the-fact check. Think of:
fixed points in the lifecycle for data and privacy review;
documented acceptance criteria before go-live;
logging that lets you reconstruct decisions afterwards.
Where possible, replace periodic sampling with continuous monitoring of output, deviations and incidents. This is more effective. It also produces the evidence that audit and regulators ask for, without extra work afterwards.
4. Place ownership in the first line
Under the Three Lines Model, ownership of risk lies with the management that uses the application. For AI, this means every system has an owner who is accountable for its use, performance and risks. The second line sets frameworks, supports and oversees. The third line provides independent assurance on how the whole operates. Reverse this, and risk management becomes a department instead of a responsibility.
5. Invest in AI literacy as a prerequisite, not a checkbox
Article 4 of the EU AI Act requires providers and deployers to take measures to support the AI literacy of their staff. Since the Digital Omnibus of July 2026, this obligation has been worded more softly: organisations no longer need to guarantee a specific level of knowledge per person.
Anyone reading that as a reason to do less is missing the point. Without sufficient understanding, employees cannot exercise meaningful human oversight. For high-risk systems, that oversight is required under Article 14, and that requirement has not been weakened; only the application date has been pushed back to December 2027 for most systems. Without that understanding, executives and supervisory board members cannot fulfil their oversight role either.
Literacy is the foundation on which every other control rests. Control only truly works when that knowledge is permanently embedded in the organisation, not held by an external consultant.
Three questions for the boardroom
Want to know where your organisation stands? Start with these three questions:
Do we have a complete and up-to-date overview of the AI systems in use, including the tools employees have started using on their own?
Is it clear for each system who owns its use and its risks? And does that risk fit within our established risk appetite?
Can we demonstrate that our controls work, and not just that they exist on paper?
If the answer to any of these questions is “no” or “we’re not sure”, that is where the first step lies.
Keep your own hands on the helm
At The Wise Sailor, we believe good governance cannot be bought in the form of a report. It has to grow within the organisation itself. That is why we focus on transferring knowledge, not on creating dependency.
We connect strategy, corporate governance, internal control, risk management, operational excellence and AI integration into one coherent whole. Through tailored in-company sessions, masterclasses, e-learnings and fractional consulting, we help your own team build an AI management system. That system aligns with ISO/IEC 42001, the EU AI Act and the NIST AI RMF, and it moves with your organisation.
Want to discover how your organisation can accelerate innovation without losing control? Get in touch with The Wise Sailor, no strings attached.
Comments