How to Govern AI When the Rules are Still Being Written

In just a few short years, artificial intelligence (AI) has transitioned from a niche curiosity to a fundamental pillar of modern work, embedding itself into workflows and decision-making processes with more speed than any technology in history. But as the dust from the initial implementation rush settles, we’re facing a startling reality: AI has moved from optional to essential, but the necessary oversight hasn’t always kept pace.

A recent IBM study found that an overwhelming majority of CEOs believe trusted AI operations are impossible without effective AI governance, yet only 39% say they actually have those safeguards in place, illustrating a clear but dangerous disconnect between vision and execution. Another report from IBM, the 2025 Cost of a Data Breach Report, notes that AI “is emerging as a high-value target,” with 63% of breached organizations reporting that they haven’t yet put an AI governance policy in place.

With these stats in mind, we can’t ignore the fact that adopting a high-impact tool like AI poses a risk for any organization. Sure, it opens the door to increased operational efficiency, reduced costs, and enhanced innovation, but at the same time, it can also lead to leaked data, tarnished reputations, and severed customer trust — threatening the very progress that AI made in the first place if not governed appropriately.

However, we would be remiss to ignore a significant hurdle many businesses are facing: the criteria for AI governance is still being defined at a time when executives fear that any hesitation will cost them their competitive edge.

Navigating the Governance Gap

The hesitation to formalize AI oversight usually boils down to the fear that “governance” means putting the brakes on profitable initiatives that amplify human power, save time, and significantly increase productivity. But, because AI represents a total technological departure from the past, governing it requires an equally radical shift in mindset. Today, governance is more than just “rules to follow,” it’s a strategic lever that supports acceleration through protection, allowing companies to rapidly adopt new technology with confidence while protecting their reputation and bottom line. But embracing governance as a strategic accelerator raises an unavoidable question: how do organizations govern a technology that is still defining itself?

AI is so new that there are no de facto rules to follow and no consensus on what constitutes acceptable use. With little to no government buy-in on safety guidelines so far, organizations are left grasping for solid ground as they try to establish appropriate guardrails. Countless studies show that organizations want to implement AI governance, but the problem is that they simply don’t know how.

The frustration becomes even more apparent when you consider the pace of AI vs. that of a modern-day business. While it can take a year for larger organizations to draft, review, and roll out an AI governance framework, the technology is evolving faster than anything we’ve ever seen, which can render formal governance plans obsolete before they even have a chance to be implemented.

Faced with this incredible pace and nonexistent benchmarks, the path of least resistance for many organizations often becomes a standstill; however, that’s where the real danger lies. We can’t fall into the trap of believing AI governance needs to start at “level 10 maturity” and instead realize that success today means taking the first step toward control.

The Case for Dynamic Solutions

Even though there aren’t many government or industry-mandated standards for safe AI usage so far, the biggest push for AI governance is coming from customers. Organizations that were the first to deploy AI outpaced the entire market and grew a significant customer base, and those that are the first to deploy safe AI will reap the same benefits. As AI begins to touch every facet of modern life, public scrutiny regarding data privacy and protection is reaching an all-time high. To maintain trust and gain market advantage, your organization must move beyond promises and provide concrete evidence of its security commitment.

Implementing a comprehensive AI governance plan is a tall hurdle for any organization, but today’s goal should be to start small. The first step toward effective governance is gaining a solid understanding of your organization’s AI landscape to help you mitigate potential risks and creating policies you can point to to build trust with your customers.

AI governance today is being able to:

• Track sprawl — understanding exactly where all AI use cases live, who manages them, and what systems they impact.
• Establish a framework that shows exactly how you’re tracking and managing AI.
• Develop formalized procedures and vetting processes for adopting potential new AI use cases.
• Enact internal policies around acceptable AI use that you can show both employees and customers.

Because the only inevitability in AI governance is that the guidelines for safe use will move as quickly as the technology itself, the most critical step you can take today is finding a partner, platform, or program that doesn’t just help you achieve all of the above, but also evolves alongside the rapidly shifting landscape.

In an era moving at hyperspeed, static governance is akin to no governance at all, making flexibility the core principle of modern-day security. Finding dynamic solutions will allow organizations to implement innovations faster, maintain regulatory agility, future-proof their technology, and uphold a level of customer trust that helps a business thrive.

Flexibility is essential for adapting to any soon-to-come laws without rebuilding frameworks from scratch, ensuring risk mitigation remains relevant even as AI architectures fundamentally change, and demonstrating that your safety keeps pace with growing expectations. AI governance is far from being clearly defined, but the uncertainty of the landscape isn’t a reason to wait — in fact, it’s the opposite.

Now is the time to build an AI governance foundation that can keep pace with the technology. While the guidelines for safe AI use are undeniably hazy, those who take the first step with a flexible, forward-thinking solution will lead the market in trust and be better equipped to leverage AI faster, safer, and more confidently as the industry itself takes shape.