AI is forcing us to rethink everything, including governance

Over the past few years, I’ve been trying to stay on top of all things AI governance. Like many of you, I’m reading articles, looking at frameworks, saving cheat sheets, checking out visual diagrams, participating in technology demos, and trying to keep up with the seemingly endless stream of regulations and guidance.

Much of the content has been created by people I respect who have spent years advancing their respective fields, and each one has taught me something. Yet collectively, I’m left with more questions than answers. In fact, I’ve gone from reading and saving nearly everything to simply skimming most of what I see now.

Why has that changed? Because instead of AI governance becoming clearer over time, it has started to feel overwhelming and fragmented, and I don’t think that’s because there’s a lack of guidance. Instead, I believe we’re facing the opposite challenge. There is so much information and so many competing priorities that it’s becoming difficult to determine what matters, where to focus, and what will have the greatest business impact.

And the more I think about it, the more I realize that AI governance isn’t the only discipline to experience this. This same pattern exists across security, legal, compliance, privacy, IT, and other high-risk functions, and I’m not the only one seeing this. I have conversations every week with people across my network who are wrestling with the same exact challenges.

It’s through these conversations and pressure testing of ideas, with people I know and trust, that I’ve come to believe that we need to broaden the conversation beyond AI governance. The challenge is much bigger than AI governance alone. AI is forcing organizations to rethink how business functions work together, yet we’re still trying to solve increasingly interconnected business challenges through the lens of individual disciplines and functions. I no longer think that’s enough.

Rethinking governance

Before we build new governance frameworks for AI, we should first ask whether we’re defining governance in a way that still fits the business environment we operate in today.

Over the years, governance itself has continued to evolve. Today, we hear terms like data governance, information governance, records and information management (RIM), model governance, AI governance, and now agentic AI governance. What those terms mean, how they’re used, and where responsibilities sit can vary depending on the organization, the discipline, and who you’re discussing the topic with.

That’s not necessarily a bad thing. Each discipline serves an important purpose and brings expertise that organizations need. The challenge is that as business functions become more interconnected, their responsibilities and priorities increasingly intersect and overlap. Organizations still need deep expertise within individual disciplines, but they also need a way to connect that expertise across the business.

That becomes especially important when multiple high-risk functions have a legitimate role in the same business decision. Another question then emerges: how does the business determine which priorities take precedence?

For the purpose of this article, I am intentionally using the broader term “governance.” Not to eliminate the distinctions between important governance disciplines, but so that we can step outside each of them for a moment and look at the common foundation they all share.

The rapid evolution of governance

A few weeks ago, I was discussing this topic with a good friend whose perspective as legal counsel I deeply respect. I was frustrated because governance seems to be getting more complex than it needs to be, especially with the introduction of AI. Our conversation helped simplify governance for me in ways that I can’t stop thinking about.

The most important takeaway: everything has a beginning, everything has an end, and then there’s everything in between. Governance programs need to provide oversight across that entire lifecycle, regardless of business function or the processes within it.

It’s such a simple perspective, but it works. It has allowed me to strip away all of the current terminology, disciplines, and frameworks and think about governance from a high-level business perspective. As the way we work becomes more interconnected, our approach to governance needs to evolve with us.

Without question, business functions, context, and the application of governance will continue to change; however, the underlying foundation of governance should always endure.

The center of gravity in today’s business environment is shifting

AI isn’t simply another technology organizations have adopted. It is fundamentally changing how work is created, how decisions are made, how information flows, and how business outcomes are achieved.

At the same time, the center of gravity within an organization is shifting. Business operations are no longer only defined by individual systems or functional disciplines. They are increasingly being defined by interconnected people, processes, technologies, and data working together across an organization. And AI is accelerating this shift while continuing to change the environment in which the business operates.

Where we go from here

I’m not convinced we’re talking about the wrong things or asking the wrong questions when it comes to AI governance. But I do think we need to broaden the conversation to reflect the increasingly interconnected environment in which governance now operates.

And the issue isn’t that the available guidance on AI governance isn’t valuable. Every framework, regulation, maturity model, and perspective contributes something meaningful to the conversation. The challenge is that much of this work is still being approached through the lens of individual functions, while the business challenges organizations are trying to solve are increasingly more complex.

As responsibilities and priorities intersect and shift across an organization, governance needs to help the business connect those cross-functional perspectives to determine what matters most in the context of broader business decisions and outcomes.

That’s why I don’t see the next evolution of governance as simply another function. We still need the individual disciplines and the deep subject matter expertise behind them. I believe the bigger opportunity is learning how to connect that expertise around broader business governance principles that can be applied across an increasingly interconnected organization.

The future of AI governance isn’t governing AI in isolation. It’s about recognizing that AI is now part of something much bigger: the business itself.

And maybe the next generation of governance starts by asking three simple, function-agnostic questions:

1. Can we explain what we did as a business?
2. Can the business trace the work performed and outputs created back to where they started?
3. Can the business defend its decisions and outcomes if challenged?

Ultimately, the business has to be willing to explain—and be accountable for—its decisions, actions, and outcomes across and beyond traditional organizational boundaries. Increasingly, laws and regulations are reinforcing that expectation. Being able to respond defensibly will be the true test of governance.