Share with your CISO
Mouli S., Global CTO at HGS, makes the case that AI governance at enterprise scale can no longer live in a compliance annex. As organizations move from generative AI pilots to agentic systems that autonomously execute business processes, governance needs to be designed in from the architecture stage, not bolted on after deployment. The argument centers on five capabilities: governance-by-design, data governance, risk-based controls, continuous monitoring, and cross-functional accountability spanning technology, legal, security, and business units.
What this means for your business
If your organization has shipped an AI governance policy document but hasn’t yet wired its requirements into solution design templates, vendor procurement criteria, or model monitoring pipelines, you’re in the majority, and that’s exactly the problem Mouli is describing. Agentic AI, meaning systems that don’t just respond to prompts but autonomously initiate and complete multi-step business workflows, raises the failure cost of post-deployment governance sharply. A policy reviewed quarterly cannot catch a model drifting in real time. The exposure question isn’t whether you have governance; it’s whether governance has any teeth before something goes wrong.
The multi-model reality is where this argument gets genuinely difficult. Most large enterprises aren’t running one AI platform; they’re accumulating foundation models from different vendors, SaaS applications with embedded AI features, and custom agents built on top of all of it. Governing each of those separately, which is what most organizations are doing by default, produces inconsistent risk tolerances, overlapping blind spots, and no coherent accountability chain. Mouli’s prescription, an enterprise-wide governance layer functioning as an orchestration layer across the whole AI landscape, is the right structural answer, though he doesn’t address the organizational friction of getting security, legal, and five business units to agree on what that layer actually enforces.
The AI Center of Excellence model Mouli describes, centralized standards with decentralized use-case ownership, is the configuration most mature enterprises are converging on, and it’s a reasonable one. But it only works if the central team has genuine authority to enforce standards rather than just publish them. The organizations that will stumble aren’t the ones ignoring governance; they’re the ones that have a CoE with a great framework and no budget authority or architectural veto. I’d revise this assessment if evidence emerged that federated governance models without centralized enforcement were producing acceptable risk outcomes at scale, but the pattern so far runs the other way.
Concept deep-dive: Governance-by-design
Governance-by-design means building compliance, accountability, and risk controls into an AI system’s architecture before a single model is trained or deployed, the same way a building’s fire suppression system is part of the blueprint rather than installed after the fire. The business case is straightforward: retrofitting controls onto a live system that’s already integrated into customer workflows or financial processes is significantly more expensive and disruptive than specifying them upfront. For CISOs, it means governance requirements belong in the AI project intake process, not the post-launch review.
Based on reporting from AI governance is becoming the foundation, originally published 2026-08-10 09:56:00.
