Maturity alignment also matters: ambitions should be aligned to the organisation's current readiness across data integration, architecture and workforce skills, not to where leadership wishes the organisation were. If ambitions and maturity don’t align in reality, that signals the need for deep transformation prior to implementation.
Establishing a workflow contract
To move from ambition to action, a "workflow contract" should be established for each use case. This contract sets out five key elements:
| Workflow boundary – identifying exactly where the process starts and ends |
| Outcome metric – defining the specific, measurable change expected |
| Decision boundary – explicitly stating what the AI can do autonomously, versus what requires human review |
| Data boundary – specifying which data the system is permitted to use, and what is prohibited |
| Project owner – assigning a specific leader who is accountable for adoption and results |
Data readiness underpins all of this. Leaders must align their ambitions with the reality of their maturity along a practical maturity continuum, or their AI implementations are likely to fail. At best, premature or misaligned implementations will generate little to no value, even if “successfully” implemented.
Security and compliance by design
Security and compliance sit alongside governance and require similar discipline. The state of AI regulation in 2026 is more developed than it was even a year ago, with overlapping regional frameworks now placing concrete obligations on organisations deploying some kinds of AI.
Compliance is a core consideration of AI implementations, but like other forms of governance, it should be applied in a right-size manner. It should be an extension of business strategy and risk management. The same applies to cybersecurity: measures should be risk-based and proportionate to the data, processes, people and systems involved.
Both compliance and security should be embedded into the AI lifecycle from the beginning, during scoping and design, rather than as a final review gate. Repeatable governance approaches help here. Organisations should establish repeatable answers to common foundational questions for new use cases, including a standard data classification approach, standardised logging and retention patterns for audit expectations and, crucially, a clear "kill button" or fallback procedure for when quality drops or models behave inappropriately.
A clear exit strategy is essential. Organisations should ask themselves, how will they know when AI quality has dropped? What is the process for disabling the AI and ensuring continuity of the underlying process? Who has ownership and decision-making authority for this? These are questions that need answers before deployment, not after an incident.