The gap between a promising AI pilot and a system in daily use is now one of the most discussed problems in enterprise technology. The usual explanation is technical: the model was not accurate enough, the integration was harder than expected, the cost was too high. Those things happen. More often, the project stalls because questions nobody answered at the start become blocking once production is in sight.
The questions that stop projects
- Which data is the system allowed to use, and who approved that use?
- What happens when it is wrong, and who is told?
- Who owns the system once the project team moves on?
- How will its performance be measured in operation, and by whom?
- Which actions may it take on its own, and which need a person?
When these are raised for the first time by a security review, a data protection officer or a risk committee weeks before launch, the project pauses while answers are found. Sometimes the answers require redesign. Industry surveys through 2026 have repeatedly placed security, risk and governance among the leading barriers to scaling agentic AI, ahead of model capability.
Governance as a design input
Organisations that move projects into production more reliably tend to treat these questions as design inputs rather than approval gates. The data position is established before the build begins. The risk assessment shapes the architecture rather than reviewing it afterwards. Ownership is assigned when the project is scoped, not when it is handed over. The evaluation plan exists before the first prototype, so that the evidence a risk committee will ask for is produced as a matter of course.
This is not additional bureaucracy. It is the same work done earlier, when it is cheaper and when its conclusions can still influence the design.
Proportionate, not uniform
Governance that applies the same weight to every project will slow low-risk work without adding much protection. A useful approach is to classify projects by their potential for harm, using recognised frameworks such as the NIST AI Risk Management Framework or ISO/IEC 42001 as a structure, and to scale the depth of review accordingly. An internal drafting assistant and an agent that can move money do not need the same process.
A simple test for any pilot
Before a pilot begins, ask whether the team could answer each of the questions above in writing. If they cannot, the pilot may still be worth running, but it should be understood as a learning exercise. If they can, the pilot has a credible route into operation, and its results will mean something to the people who have to approve it.