Governance at the Speed of Business and Why AI Governance Must Be Built Into the Operating Rhythm
- 6 hours ago
- 9 min read
Geneva Martin is an executive strategist, leadership consultant, author, and co-founder of The JITT Group. With a Master of Business Administration (MBA), senior leadership experience in technology, data, and Artificial Intelligence (AI) governance, and strategic planning, she helps leaders transform with clarity, resilience, and purpose.
Artificial Intelligence (AI) decisions are being made every day in strategy, budgeting, product, vendor, and workforce conversations. If governance arrives only at the next committee meeting or quarterly review, it is already behind the business.
After years of working in data and AI governance, I have come to believe many organizations aren't struggling because they lack frameworks. They are struggling because governance is often late.
The charter may be approved. The committee may exist. Stewards may have been selected from across the business. Yet the decisions that shape AI risk are frequently being made somewhere else, in strategic planning, budget discussions, product reviews, vendor selections, workforce decisions, and conversations about what to automate next.
By the time governance reaches the executive agenda, the organization may already be moving in a different direction. Organizations are trying to govern AI on top of data environments they never fully governed, using structures designed to report backward rather than influence forward.
Data governance and AI governance are not the same
Data governance is not limited to charters and policies. It establishes operational accountability for what data means, who owns it, whether it is fit for purpose, who may use it, how it moves, and how problems are corrected. AI governance is broader. It governs the purpose, model or vendor, permitted inputs and outputs, testing, monitoring, human oversight, and consequences of an AI capability.
The overlap depends on the use case. A coding assistant may not use customer, billing, or other business datasets, so enterprise data quality may not be its primary risk. But its prompts, source code, repository context, documentation, and generated code still require decisions about access, protection, vendor handling, security, intellectual property, testing, and human review. Here, engineering and cybersecurity may be more prominent than traditional data quality governance.
Data governance is one contributor to AI governance. AI governance connects the disciplines the decision requires.
AI did not remove the data problem
AI governance is broader than data governance. But when an AI capability depends on organizational data, unresolved data problems become AI governance risks.
Most organizations began pursuing AI before they had fully resolved the work of governing their data. Definitions still differed across departments. Ownership was sometimes unclear. Data quality issues remained open. Critical business context still lived in the minds of experienced employees rather than in a system, standard, or model.
When an AI use case depends on organizational data, a technically strong model cannot correct for data that is incomplete, poorly understood, biased, outdated, or disconnected from the decision it is meant to support. AI may produce an answer faster, but speed does not make that answer trustworthy.
At the same time, many organizations are operating with fewer experienced subject matter experts, the people who often recognize that the data does not make sense even when the dashboard says that it does. When those human checkpoints disappear, unresolved data problems can move more quickly into automated decisions. What began as a data quality issue can become an operational, regulatory, compliance, or reputational risk.
The governance loop
I have watched governance teams do exactly what they were asked to do: develop the charter, establish the committee, identify stewards in each department, and form an enterprise governance team. Then the meetings became sporadic because everyone had a full-time role outside governance. A quarterly executive report was prepared, only to reveal that priorities, funding, technology plans, or business conditions had already changed.
The team would revise the plan, update the charter or priorities, and begin again. It felt like a loop. The problem was not that people were unwilling to govern. The structure placed governance behind the organization.
We built governance around committees and reporting calendars when we needed to build it around the decisions that were changing the business.
Quarterly executive oversight still matters. But the quarterly meeting should confirm direction, examine patterns, and resolve major escalations. It should not be the first place governance learns that the organization has selected a new vendor, changed its AI priorities, reduced subject matter expertise, or entered a different risk environment.
When the deadline arrives before the data is ready
One incident has stayed with me. In a large federated organization, a substantial billing discrepancy surfaced that the organization had not identified internally. Billing and reconciliation across a complex operation still depended heavily on spreadsheets and manual inputs between customer, sales, billing, and accounting systems. Numbers could be missed, entered incorrectly, or lost during handoffs. These were not exotic technology failures. They were predictable human errors built into the operating process.
When new data access, privacy, risk, and compliance requirements increased the urgency, timelines came down from legal and risk before anyone had fully assessed the condition of the data or the effort required to remediate it. An external consulting firm was brought in to help accelerate the work. Participation became mandatory, but executive support for governance remained inconsistent. The governance team was expected to move quickly without the funding, time, or authority required to correct the underlying data.
At points, the work became more focused on mapping data flows, answering questions, and signing forms than on mastering and cleaning the data. The organization could document completion while manual reconciliations, unclear ownership, and data quality risks remained. Meanwhile, the pressure to deploy AI kept increasing. We were being asked to demonstrate that AI-supported decisions would be accurate, compliant, and secure while some of the source data was still being reconciled through spreadsheets.
That experience also clarified something for me: when AI depends on organizational data, it does not stop functioning because the data has not been mastered or reconciled. It will still produce an answer, often faster and more efficiently, and with the appearance of precision. But speed and fluency cannot make unresolved data trustworthy. You cannot govern AI through an attestation when the data beneath it is still being reconciled.
Govern AI decisions, not the calendar
AI governance becomes real when it enters the forums where AI use cases are proposed, funded, designed, deployed, and monitored. That includes decisions about the purpose of the use case, the data or context it may use, the model or vendor selected, the people who may be affected, the level of human oversight required, and the evidence that would cause the organization to pause or stop.
This does not mean placing an executive or governance specialist in every meeting. It means establishing clear decision rights, governance triggers, and escalation thresholds before urgency arrives.
Executives do not need to sit in every governance meeting. AI governance needs to be present in the meetings where executives and business leaders are already deciding the future.
Embedding AI governance into the operating rhythm does not mean creating more meetings. Much of the work can happen before the meeting through a structured decision queue. Each item should identify the accountable owner, recommendation, supporting evidence, AI risk level, required reviewers, and decision deadline, then route the issue to the appropriate data, AI, engineering, risk, compliance, cyber, legal, privacy, or business leader.
Routine reviews can occur outside the meeting. The meeting agenda should focus on decisions that are pending, already made, unresolved, or ready for escalation. Leaders should enter the room prepared to decide, not spend the meeting discovering the issue for the first time.
The National Institute of Standards and Technology (NIST) AI Risk Management Framework treats governance as a cross-cutting function intended to inform the mapping, measurement, and management of AI risk. That reinforces a practical point: governance cannot be confined to one committee or one point in the AI lifecycle.
AI governance must flow through the organization
At the top, leaders establish the organization's AI ambition, risk tolerance, nonnegotiable boundaries, and accountability. They determine which AI decisions may be delegated and which require executive review.
Business and functional leaders translate that direction into decisions about AI use cases, investments, data, models, vendors, products, customer impact, and workforce changes. The people closest to the work determine whether the relevant information and context are appropriate, evaluate how the model and its outputs behave, apply required safeguards, preserve human oversight, and monitor actual outcomes.
AI direction and decision rights move down through the organization. Evidence about data quality, model performance, unintended consequences, and emerging risk must move back up.
Federated does not mean fragmented
Most federated governance models appoint departmental subject matter experts as stewards, add managers and directors as another layer, and then establish an enterprise council above them. The structure may look complete on an organization chart. But federation without connection becomes fragmentation.
Business leaders understand strategy, customers, budgets, and operational pressure. Data, AI, and engineering teams understand lineage, quality, model behavior, and technical limitations. Risk and compliance understand obligations and control requirements. Cybersecurity sees attacks, vulnerabilities, and access concerns. Legal and privacy interpret changing laws, while executives know when economic conditions and organizational direction are shifting.
No single group sees the entire AI decision. AI governance must be the place where those signals meet before a consequential decision is made.
AI Governance Decision Flow. Original framework developed by Geneva Martin, 2026. Copyright 2026 Geneva Martin. All rights reserved. Authority moves down, evidence and emerging risk move up.
A federated AI governance network, bringing together data, AI, engineering, risk, compliance, cyber, legal, privacy, business stewards, and subject matter experts, connects those levels. It provides expertise and consistency, but it does not replace executive accountability or the judgment of the people closest to the work.
The flow must also respond to what is happening outside the organization. New regulations, changes to models and vendors, cyber threats, economic pressure, and marketplace expectations can alter the risk surrounding an AI use case long after its initial approval.
Approval is not the end of governance
AI systems do not remain static simply because they were approved. The data changes. The model may drift. A vendor may update its technology. The business may use the system in ways that were not part of the original decision. The population affected by the system may also change.
Every material AI decision should leave a visible thread: what was approved, why it was approved, which risk was accepted, who owns the outcome, what will be monitored, and when the decision will be revisited. If those answers cannot be reconstructed after the meeting, the organization has governance activity, but not yet accountability.
Repeated exceptions should also be treated as information. They may reveal that a policy no longer reflects how the business operates, that decision thresholds are unclear, or that teams lack a practical way to comply. Governance should not only constrain action. It should help the organization learn.
Measure whether AI governance is improving decisions
It is possible to count policies, committee meetings, completed assessments, and training participation while missing whether AI governance is improving decisions. Those measures show activity. They do not automatically show trust, clarity, or movement.
Leaders should also ask whether AI use cases are reaching the right review at the right time, whether accountable owners are named, whether data and model issues are identified before deployment, and whether monitoring results actually change decisions when they should.
The goal is not frictionless AI. Some friction is protective and necessary. The goal is purposeful friction, clear enough to protect the organization, proportionate enough to support responsible innovation, and visible enough that people know how to move forward.
AI governance is leadership in practice
AI governance may be coordinated by data, technology, risk, legal, security, or compliance teams, but it cannot be delegated away as a leadership responsibility. Leaders decide what the organization rewards, which tradeoffs it accepts, whose concerns are heard, and whether accountability remains intact when the pressure to move faster increases.
As I discussed in my Brainz interview on thoughtful transformation, technology decisions cannot be separated from their human consequences. AI governance is one of the places where that leadership responsibility becomes visible.
Governance taught me that leadership is stewardship, and that trust is the currency of AI, data, and people. Stewardship is not demonstrated by having the most comprehensive framework on paper. It is demonstrated by how consistently our values, responsibilities, data, and decisions stay connected as the business moves.
The question for leaders is no longer only, “Do we have an AI governance framework?” It is this: If your organization made a consequential AI decision tomorrow, where would governance enter the conversation, and would it arrive before or after the decision?
Before the next AI decision
Identify the meeting where the decision will be made, the leader accountable for the outcome, the evidence that must be reviewed, and the threshold that would require the organization to pause. If those answers are unclear, that is where your AI governance work should begin.
Read more from Geneva Martin
Geneva Martin, Executive Strategist, Leadership Consultant, Author, Speaker, and Co-Founder of The JITT Group
Geneva Martin is an executive strategist, leadership consultant, author, and co-founder of The JITT Group. With an MBA and senior leadership experience across technology, data, and AI governance, strategic planning, and organizational transformation, she helps leaders turn complexity into clarity and purpose-driven action. She is the author of Surrendered in Silence: The God Who Stayed, a deeply personal work on faith, resilience, healing, and transformation. Geneva’s work blends executive insight, neuroscience-informed leadership, emotional intelligence, and faith-centered purpose. Through her writing, speaking, and consulting, she equips leaders and organizations to grow with wisdom, resilience, and intentional impact.
