In The Future of AI, Unfiltered, our latest research study, we found that this uncertainty around regulation is pulling companies in opposite directions. Of the 945 global CIOs and CTOs we surveyed, all at organisations with $500m+ in annual revenue, 54% said that regulatory uncertainty has made them more cautious about deploying and scaling AI. Meanwhile, 27% said it’s made them more aggressive.
When the rules keep moving, ticking boxes set by third parties won’t be enough. Leaders need to build governance into the foundation of their tech stacks and AI projects, so that control of their AI doesn’t depend on whichever regulation happens to be in force. That means testing guardrails continually, finding the weak points and strengthening them, with input from people who understand the most serious security risks and the practical ways to address them.
In practice, this starts at the data and platform layer. Permissions are set once, where the data lives, so every model and agent inherits the same access limits. Every AI action is logged, so there’s a record of what was accessed and why. Each use case has a named owner who answers for it. And guardrail testing is part of the release process, run before a system goes live and again whenever the model or its data changes.
The legal consequences of getting governance wrong are one reason it will matter more in the coming years. The other is that effective governance drives AI adoption. Users trust models and agents more when they know what information and systems the AI has permission to access, what data is off limits, and who’s accountable if the AI slips past guardrails.
Guardrails can also be too tight. Clamping down too hard can slow workflows to a crawl. Picture a bank that restricts its approved AI assistant so heavily that it can’t summarise a client document. Analysts with deadlines open personal accounts on a public chatbot and paste the document in there, and nobody in risk or IT knows until an audit turns it up months later. Multiply that across an organisation and employees are using whatever models they prefer, with the business exposed to the security risks that come with them.
As we’ve seen throughout our work with clients, governance isn’t just a matter of liability. It’s a central pillar of value generation.
.webp "GFT Contact: Dean Clark")
