The Governance Gap

I was sitting with a founder recently who had been explaining how her agency was getting on with AI. They'd been running ChatGPT Enterprise for about six months, had a few pilots going well, and she was fairly pleased with where they'd got to. When I asked what level she thought they were at, I use a five-level maturity model, Aware through Active, Governed, Optimised, Native, and she said Governed.

So I asked whether they had a written AI policy that legal had reviewed. She paused and said no.

It turned out they hadn't mapped which client data was going to which tools, and the client contracts still reflected the landscape of 2022. She hadn't been negligent about any of it, she'd just been busy building something real. It hadn't occurred to anyone to sit down and think through the structural side.

This is the pattern I see most often right now. Founders who are genuinely further along than average, with real adoption and tools that work, but sitting at Level 2 in practice because the governance layer hasn't been built yet. The reason that matters is that Governed is the level from which you can safely accelerate. Below it, going faster just means adding speed to a structure that isn't ready for it.

The frameworks are all at scaleatspeed.com/ai if you want to look through them.