Governing AI at the Speed of Change
Why strategic clarity, adaptive governance and bounded autonomy matter more than ever
An executive perspective on how organisations can accelerate innovation without allowing local failures to become systemic risks.
An executive perspective on how organisations can accelerate innovation without allowing local failures to become systemic risks.
Pierre-Etienne Lévêque | October 2026 | Leadership · Strategy · Operational Resilience · 9 min read
AI is placing leaders in an uncomfortable position. The technology is improving quickly, new applications appear constantly, and decisions that seem rational today may need revisiting within months. Yet organisations cannot defer every choice until the future becomes clearer. They still need to invest, protect their information, serve customers and enable people to act.
AI is placing leaders in an uncomfortable position. The technology is improving quickly, new applications appear constantly, and decisions that seem rational today may need revisiting within months. Yet organisations cannot defer every choice until the future becomes clearer. They still need to invest, protect their information, serve customers and enable people to act.
The question is not whether boards and executive teams can predict AI’s next breakthrough. They cannot do so reliably. The real question is whether they are building organisations capable of making sound decisions as circumstances change — without losing strategic direction or exposing the business to unacceptable risks.
The question is not whether boards and executive teams can predict AI’s next breakthrough. They cannot do so reliably. The real question is whether they are building organisations capable of making sound decisions as circumstances change — without losing strategic direction or exposing the business to unacceptable risks.
Hise O. Gibson’s April 2026 Harvard Business Review article, AI Is Reshaping Cyber Risk. Boards Need to Manage the Threat, places this challenge squarely at board level. His ACTS framework calls on leaders to assume compromise is possible, cultivate AI fluency, connect AI to core operations and strengthen governance [1]. Nolan Melson subsequently expanded on the human side: resilience, judgement under pressure, intergenerational learning and the ability to operate when systems fail [2].
Hise O. Gibson’s April 2026 Harvard Business Review article, AI Is Reshaping Cyber Risk. Boards Need to Manage the Threat, places this challenge squarely at board level. His ACTS framework calls on leaders to assume compromise is possible, cultivate AI fluency, connect AI to core operations and strengthen governance [1]. Nolan Melson subsequently expanded on the human side: resilience, judgement under pressure, intergenerational learning and the ability to operate when systems fail [2].
I agree with that direction. From my experience leading complex, 24/7 safety-critical operations, I would extend it further: effective AI governance is not only about governing technology. It is about designing an organisation able to turn strategic intent into coherent decisions, distributed action and controlled risk.
I agree with that direction. From my experience leading complex, 24/7 safety-critical operations, I would extend it further: effective AI governance is not only about governing technology. It is about designing an organisation able to turn strategic intent into coherent decisions, distributed action and controlled risk.
1. Keep the compass stable; make the route adaptable
A recurring temptation is to mistake strategic agility for continuously changing strategy. When the technology landscape shifts every few months, leaders may feel compelled to redraw the entire roadmap just as frequently. The result can be fragmented investments, competing priorities and exhausted teams.
A recurring temptation is to mistake strategic agility for continuously changing strategy. When the technology landscape shifts every few months, leaders may feel compelled to redraw the entire roadmap just as frequently. The result can be fragmented investments, competing priorities and exhausted teams.
A better approach separates three different rhythms.
A better approach separates three different rhythms.
Strategic intent should be sufficiently stable to guide decisions. Why does the organisation exist? Where does it create distinctive value? What must it protect? What risks are unacceptable? These questions deserve a longer horizon, even if circumstances occasionally force a fundamental rethink.
Strategic intent should be sufficiently stable to guide decisions. Why does the organisation exist? Where does it create distinctive value? What must it protect? What risks are unacceptable? These questions deserve a longer horizon, even if circumstances occasionally force a fundamental rethink.
Technology and investment choices should remain revisable. Supplier concentration versus diversification, cloud arrangements, information architecture, use cases and build-versus-buy decisions should be assessed against explicit assumptions and revisited when evidence changes. A quarterly review may suit some decisions; an emerging critical risk requires immediate escalation.
Technology and investment choices should remain revisable. Supplier concentration versus diversification, cloud arrangements, information architecture, use cases and build-versus-buy decisions should be assessed against explicit assumptions and revisited when evidence changes. A quarterly review may suit some decisions; an emerging critical risk requires immediate escalation.
Operational safeguards need continuous attention. Access rights, incident signals, agent permissions, training needs and controls cannot wait for an annual strategy exercise.
Operational safeguards need continuous attention. Access rights, incident signals, agent permissions, training needs and controls cannot wait for an annual strategy exercise.
This is the difference between having a direction and pretending to have a complete map. The less predictable the road, the more useful a shared compass becomes.
This is the difference between having a direction and pretending to have a complete map. The less predictable the road, the more useful a shared compass becomes.
2. Cascade the reasoning, not just the decision
Organisations often treat communication as the final stage of strategy: executives decide, managers cascade, employees execute. In a fast-moving AI environment, that is insufficient.
Organisations often treat communication as the final stage of strategy: executives decide, managers cascade, employees execute. In a fast-moving AI environment, that is insufficient.
Imagine a team that identifies an external AI agent capable of compressing a labour-intensive process from days into hours. It is a genuine opportunity. But the proposed workflow would transmit confidential information to a third-party service and allow that service to act on internal systems.
Imagine a team that identifies an external AI agent capable of compressing a labour-intensive process from days into hours. It is a genuine opportunity. But the proposed workflow would transmit confidential information to a third-party service and allow that service to act on internal systems.
A blanket prohibition might reduce immediate exposure, but it could also block valuable learning or encourage workarounds. Unrestricted deployment could create risks that the team cannot see from its local perspective.
A blanket prohibition might reduce immediate exposure, but it could also block valuable learning or encourage workarounds. Unrestricted deployment could create risks that the team cannot see from its local perspective.
The leader’s job is to explain the trade-off: which value the organisation seeks, which data must remain protected, what experimentation is authorised, what requires review, and where responsibility sits. Teams also need an approved route to test promising ideas without unreasonable delay.
The leader’s job is to explain the trade-off: which value the organisation seeks, which data must remain protected, what experimentation is authorised, what requires review, and where responsibility sits. Teams also need an approved route to test promising ideas without unreasonable delay.
Leadership is not merely cascading decisions. It is cascading the reasoning that makes autonomous decisions coherent.
Leadership is not merely cascading decisions. It is cascading the reasoning that makes autonomous decisions coherent.
This is an extension of commander’s intent: align people on the purpose, desired outcomes, constraints and decision boundaries, rather than trying to prescribe every move. It combines genuine autonomy with a common understanding of what good judgement looks like.
This is an extension of commander’s intent: align people on the purpose, desired outcomes, constraints and decision boundaries, rather than trying to prescribe every move. It combines genuine autonomy with a common understanding of what good judgement looks like.
3. Trust people. Do not design systems that require perfect behaviour
A strong culture, clear purpose and committed teams are essential. They are not sufficient safeguards.
A strong culture, clear purpose and committed teams are essential. They are not sufficient safeguards.
In a large organisation, some people will make mistakes. Others may be under pressure, act carelessly or misuse legitimate access. Autonomous systems add another class of failure: an agent may misinterpret a task, be influenced by malicious inputs or act beyond its intended scope.
In a large organisation, some people will make mistakes. Others may be under pressure, act carelessly or misuse legitimate access. Autonomous systems add another class of failure: an agent may misinterpret a task, be influenced by malicious inputs or act beyond its intended scope.
These are different risks and should not be conflated. A dissatisfied employee is not presumptively malicious. Nor does zero-trust security mean a leader should distrust employees as people. The technical principle is that access to resources should not be granted implicitly simply because an account or device is inside the organisation [3].
These are different risks and should not be conflated. A dissatisfied employee is not presumptively malicious. Nor does zero-trust security mean a leader should distrust employees as people. The technical principle is that access to resources should not be granted implicitly simply because an account or device is inside the organisation [3].
The operational design principle is straightforward: give people freedom to initiate, learn and contribute; limit the ability of any single person or agent to inflict irreversible harm.
The operational design principle is straightforward: give people freedom to initiate, learn and contribute; limit the ability of any single person or agent to inflict irreversible harm.
That can mean data classification, minimum necessary permissions, independent approval for high-impact actions, secure testing environments, monitoring proportionate to risk, and the ability to isolate or stop an agent. These are not substitutes for leadership or culture. They make responsible autonomy sustainable.
That can mean data classification, minimum necessary permissions, independent approval for high-impact actions, secure testing environments, monitoring proportionate to risk, and the ability to isolate or stop an agent. These are not substitutes for leadership or culture. They make responsible autonomy sustainable.
International cybersecurity agencies have explicitly recommended limiting AI agents’ permissions, retaining appropriate human oversight and layering controls around agentic systems [4].
International cybersecurity agencies have explicitly recommended limiting AI agents’ permissions, retaining appropriate human oversight and layering controls around agentic systems [4].
There is no perfect balance. More control has costs: delay, bureaucracy, weakened initiative and sometimes shadow AI. Less control increases exposure. The goal is not to optimise either dimension in isolation, but to manage their combined effect on long-term performance.
There is no perfect balance. More control has costs: delay, bureaucracy, weakened initiative and sometimes shadow AI. Less control increases exposure. The goal is not to optimise either dimension in isolation, but to manage their combined effect on long-term performance.
4. Match decision rights to consequences and reversibility
Not every decision should reach the executive committee. Equally, not every decision should be delegated without qualification.
Not every decision should reach the executive committee. Equally, not every decision should be delegated without qualification.
I find it useful to evaluate autonomy through four questions:
I find it useful to evaluate autonomy through four questions:
Potential consequence: What happens if this decision or action is wrong?
Reversibility: Can we safely undo it, and how quickly?
Observability: Will we know promptly if the situation is deteriorating?
Containment: Can we prevent a local failure from spreading across the organisation?
Potential consequence: What happens if this decision or action is wrong?
Reversibility: Can we safely undo it, and how quickly?
Observability: Will we know promptly if the situation is deteriorating?
Containment: Can we prevent a local failure from spreading across the organisation?
Low-impact, reversible experiments can often be delegated widely, with clear rules. Actions affecting sensitive data, regulated obligations, customer trust or critical infrastructure require stronger controls. The highest-consequence decisions may need independent authorisation or a safe human override.
Low-impact, reversible experiments can often be delegated widely, with clear rules. Actions affecting sensitive data, regulated obligations, customer trust or critical infrastructure require stronger controls. The highest-consequence decisions may need independent authorisation or a safe human override.
The same discipline applies to executive attention. CEO and board capacity is finite. A capable COO or leadership team must distinguish decisions that can be resolved within delegated authority from those that genuinely require escalation, and present the latter with alternatives, consequences and a clear recommendation.
The same discipline applies to executive attention. CEO and board capacity is finite. A capable COO or leadership team must distinguish decisions that can be resolved within delegated authority from those that genuinely require escalation, and present the latter with alternatives, consequences and a clear recommendation.
This is not internal politics for its own sake. It is sound organisational design: reserve scarce executive attention for decisions where its involvement changes the outcome.
This is not internal politics for its own sake. It is sound organisational design: reserve scarce executive attention for decisions where its involvement changes the outcome.
5. Treat resilience as a tested operating capability
Many organisations can describe a crisis plan. Fewer know whether they can execute it when data, dashboards or automated processes become unreliable.
Many organisations can describe a crisis plan. Fewer know whether they can execute it when data, dashboards or automated processes become unreliable.
Gibson asks a pointed question: can the organisation operate for 48 hours without its digital systems? He also asks whether people can make sound decisions without dashboards or models [1]. The precise test should reflect each business, but the principle travels across industries.
Gibson asks a pointed question: can the organisation operate for 48 hours without its digital systems? He also asks whether people can make sound decisions without dashboards or models [1]. The precise test should reflect each business, but the principle travels across industries.
In safety-critical operations, resilience is not the ability to continue everything at any cost. Sometimes the correct response is to maintain a limited service. Sometimes it is to slow down, isolate a function or stop safely. What matters is whether people know the priorities, authority and operating boundaries before the pressure arrives.
In safety-critical operations, resilience is not the ability to continue everything at any cost. Sometimes the correct response is to maintain a limited service. Sometimes it is to slow down, isolate a function or stop safely. What matters is whether people know the priorities, authority and operating boundaries before the pressure arrives.
AI makes this more urgent. An organisation may become more productive while also becoming more dependent on a small number of models, vendors, credentials or data flows. The dependency can be acceptable — but it should be understood, intentionally chosen and periodically tested.
AI makes this more urgent. An organisation may become more productive while also becoming more dependent on a small number of models, vendors, credentials or data flows. The dependency can be acceptable — but it should be understood, intentionally chosen and periodically tested.
A robust operating model therefore includes rehearsed fallbacks, incident escalation, tested recovery procedures, clear accountability, and the practical ability to suspend systems or agents when necessary. Resilience should not live exclusively in a risk register; it must exist in the way work actually gets done.
A robust operating model therefore includes rehearsed fallbacks, incident escalation, tested recovery procedures, clear accountability, and the practical ability to suspend systems or agents when necessary. Resilience should not live exclusively in a risk register; it must exist in the way work actually gets done.
6. Measure whether governance enables performance — and protection
A governance committee, an AI policy and a training programme are useful starting points. They are not evidence that an organisation can respond well under pressure.
A governance committee, an AI policy and a training programme are useful starting points. They are not evidence that an organisation can respond well under pressure.
Executive teams should test both sides of the equation: how effectively can we act, and how well can we contain the consequences when something goes wrong?
Executive teams should test both sides of the equation: how effectively can we act, and how well can we contain the consequences when something goes wrong?
An operating scorecard might include:
An operating scorecard might include:
Time from a legitimate business proposal to an approved, low-risk experiment.
Share of material AI systems and agents with a named owner, known data dependencies and reviewed permissions.
Time to detect, contain and recover from a material incident or unintended agent action.
Percentage of critical activities with exercised fallbacks and clearly identified decision rights.
Evidence that leaders and teams understand the reasons behind key rules, not merely their existence.
Actual business value delivered, alongside new dependencies and concentration risks created.
Time from a legitimate business proposal to an approved, low-risk experiment.
Share of material AI systems and agents with a named owner, known data dependencies and reviewed permissions.
Time to detect, contain and recover from a material incident or unintended agent action.
Percentage of critical activities with exercised fallbacks and clearly identified decision rights.
Evidence that leaders and teams understand the reasons behind key rules, not merely their existence.
Actual business value delivered, alongside new dependencies and concentration risks created.
These are illustrative indicators, not a universal standard. Their value lies in forcing cross-functional discussion among operations, technology, security, finance, HR and the board.
These are illustrative indicators, not a universal standard. Their value lies in forcing cross-functional discussion among operations, technology, security, finance, HR and the board.
The NIST AI Risk Management Framework already places governance across the functions of mapping, measuring and managing AI risks [5]. ISO/IEC 42001 provides a management-system approach for maintaining and improving organisational AI governance [6]. Both are valuable references. Neither removes the leadership responsibility to make difficult trade-offs in context.
The NIST AI Risk Management Framework already places governance across the functions of mapping, measuring and managing AI risks [5]. ISO/IEC 42001 provides a management-system approach for maintaining and improving organisational AI governance [6]. Both are valuable references. Neither removes the leadership responsibility to make difficult trade-offs in context.
Seven questions for the next executive or board discussion
Strategic intent: Can every leadership level explain what we want from AI, and what we will not compromise to obtain it?
Adaptability: Which decisions must remain stable, and which assumptions or supplier choices are deliberately revisable?
Distributed judgement: Do teams understand the reasons behind our boundaries well enough to innovate safely without constant permission-seeking?
Accountability: Who owns each material AI system or agent, its permissions, its results and the decision to stop it?
Exposure: Are safeguards proportionate to the impact, reversibility, detectability and containment of failure?
Resilience: Could we sustain essential services — or stop safely — if critical data, models or digital infrastructure became unavailable?
Evidence: Can we demonstrate that our governance improves both time-to-value and our ability to prevent, detect, contain and recover from incidents?
Strategic intent: Can every leadership level explain what we want from AI, and what we will not compromise to obtain it?
Adaptability: Which decisions must remain stable, and which assumptions or supplier choices are deliberately revisable?
Distributed judgement: Do teams understand the reasons behind our boundaries well enough to innovate safely without constant permission-seeking?
Accountability: Who owns each material AI system or agent, its permissions, its results and the decision to stop it?
Exposure: Are safeguards proportionate to the impact, reversibility, detectability and containment of failure?
Resilience: Could we sustain essential services — or stop safely — if critical data, models or digital infrastructure became unavailable?
Evidence: Can we demonstrate that our governance improves both time-to-value and our ability to prevent, detect, contain and recover from incidents?
A leadership team need not have a perfect answer to every question. But it should know where its weakest answers lie, who is accountable for improving them, and how progress will be tested.
A leadership team need not have a perfect answer to every question. But it should know where its weakest answers lie, who is accountable for improving them, and how progress will be tested.
The real leadership challenge
AI will keep evolving. Some technology bets will prove wrong. Some controls will need adjustment. People and systems will fail, and not every disruption can be anticipated.
AI will keep evolving. Some technology bets will prove wrong. Some controls will need adjustment. People and systems will fail, and not every disruption can be anticipated.
The answer is neither rigid centralisation nor the hope that a compelling vision will make everyone act perfectly.
The answer is neither rigid centralisation nor the hope that a compelling vision will make everyone act perfectly.
It is to establish a clear direction, delegate meaningful authority, make risk boundaries explicit, support initiative with well-designed safeguards and continuously strengthen the organisation’s ability to learn and recover.
It is to establish a clear direction, delegate meaningful authority, make risk boundaries explicit, support initiative with well-designed safeguards and continuously strengthen the organisation’s ability to learn and recover.
The role of leadership is not to eliminate uncertainty or control every decision. It is to build organisations capable of acting coherently, adapting continuously and remaining resilient when people, systems or assumptions fail.
The role of leadership is not to eliminate uncertainty or control every decision. It is to build organisations capable of acting coherently, adapting continuously and remaining resilient when people, systems or assumptions fail.
That is how AI governance becomes more than a compliance exercise. It becomes a source of sustainable operational performance.
That is how AI governance becomes more than a compliance exercise. It becomes a source of sustainable operational performance.
Sources and further reading
[1] Hise O. Gibson, “AI Is Reshaping Cyber Risk. Boards Need to Manage the Threat,” Harvard Business Review, 7 April 2026. https://hbr.org/2026/04/ai-is-reshaping-cyber-risk-boards-need-to-manage-the-threat
[1] Hise O. Gibson, “AI Is Reshaping Cyber Risk. Boards Need to Manage the Threat,” Harvard Business Review, 7 April 2026. https://hbr.org/2026/04/ai-is-reshaping-cyber-risk-boards-need-to-manage-the-threat
[2] Nolan F. Melson, “How Professor Hise Gibson’s AI Security Article Maps to Resilient Tech Teams,” 15 April 2026. https://nolanfmelson.substack.com/p/how-professor-hise-gibsons-ai-security
[2] Nolan F. Melson, “How Professor Hise Gibson’s AI Security Article Maps to Resilient Tech Teams,” 15 April 2026. https://nolanfmelson.substack.com/p/how-professor-hise-gibsons-ai-security
[3] NIST, SP 800-207, “Zero Trust Architecture.” https://www.nist.gov/publications/zero-trust-architecture
[3] NIST, SP 800-207, “Zero Trust Architecture.” https://www.nist.gov/publications/zero-trust-architecture
[4] CISA and partner cybersecurity agencies, “Careful Adoption of Agentic AI Services,” 1 May 2026. https://www.ncsc.govt.nz/protect-your-organisation/careful-adoption-of-agentic-ai-services/
[4] CISA and partner cybersecurity agencies, “Careful Adoption of Agentic AI Services,” 1 May 2026. https://www.ncsc.govt.nz/protect-your-organisation/careful-adoption-of-agentic-ai-services/
[5] NIST, “Artificial Intelligence Risk Management Framework.” https://www.nist.gov/itl/ai-risk-management-framework
[5] NIST, “Artificial Intelligence Risk Management Framework.” https://www.nist.gov/itl/ai-risk-management-framework
[6] ISO/IEC 42001:2023, “Artificial intelligence — Management system.” https://www.iso.org/standard/42001
[6] ISO/IEC 42001:2023, “Artificial intelligence — Management system.” https://www.iso.org/standard/42001
Back to Insights →