AI governance: from innovation to accountability
December 2026 | TALKINGPOINT | RISK MANAGEMENT
Financier Worldwide Magazine
December 2026 Issue
FW discusses AI governance with Taryn Kilkenny Crane at BDO USA P.C.
FW: How has the conversation around AI governance evolved over the past two to three years? What do you see as the biggest opportunities and risks facing organisations today?
Crane: Over the past two to three years, artificial intelligence (AI) governance has shifted from controlling access to enabling responsible adoption. Early efforts focused on acceptable-use policies and restrictions on generative AI tools. Today, organisations are deploying enterprise platforms, evaluating use cases and vendors, and exploring custom models and agentic workflows. The challenge is governing this activity at scale while keeping pace with business demand and demonstrating measurable returns on AI investment. The conversation has also moved from broad ethical principles to operational governance. Boards and executives now expect clear accountability, human oversight, data quality, privacy, security, intellectual property (IP) protection, regulatory compliance and business value. AI governance is not a standalone discipline – it must build on the organisation’s broader data, risk, security, privacy and compliance capabilities. The opportunities are substantial: greater productivity, automation, better decisions, faster innovation and new revenue. Organisations that build trust, educate employees and encourage responsible experimentation will have an advantage. The strongest use cases often come from employees closest to the business problem, supported by a governance programme that provides guardrails rather than roadblocks. The risks are equally significant, including poor data quality, weak access controls, privacy and cyber security threats, IP concerns, bias, regulatory violations and overreliance on automated outputs. The consequences may be greatest in regulated sectors, where AI decisions could affect rights, safety or access to essential services. Regulators and stakeholders increasingly expect transparency, human oversight, sound data governance and clear accountability. As AI becomes embedded in business processes, governance failures become business risks, not merely technology risks. Organisations must move beyond compliance checklists and operationalise responsible AI practices that support innovation, accountability and trust at scale.
FW: Why do so many organisations still struggle to translate responsible AI principles into practical governance frameworks and day-to-day controls?
Crane: Many organisations are not struggling with the principles themselves. Most leaders agree with concepts such as fairness, transparency, accountability and human oversight. The challenge is operationalising those principles across hundreds of use cases, business functions, technologies and vendors. One common issue is that organisations attempt to build AI governance separately from existing governance structures. In reality, AI governance should build on existing capabilities such as data governance, privacy, information security, risk management, vendor oversight and compliance. When those foundational disciplines are immature, AI governance becomes difficult to scale. Another challenge is the pace of technological change. Organisations are trying to create durable controls for technologies that continue to evolve, while addressing emerging regulatory requirements across multiple jurisdictions. Many organisations also lack visibility into how AI is actually being used. Before they can govern AI effectively, they must inventory use cases, understand and classify the associated risks, and establish clear ownership and accountability.
FW: What are the most important elements of an effective AI governance framework, particularly for organisations scaling AI across multiple business functions?
Crane: Effective AI governance starts with a risk-based approach rather than a ‘one size fits all’ model. Not every AI use case presents the same level of risk, and organisations should apply governance controls proportionately. The core elements begin with executive sponsorship and clearly defined accountability. Organisations also need a comprehensive inventory of AI systems and use cases. Strong data governance is essential; incorporating quality, lineage, retention, access and security. A practical risk-classification methodology should sit alongside this. There should also be policies for development, procurement, deployment and use. Human oversight should be applied according to risk. Ongoing monitoring, testing, validation and documentation are also required. So too are third party risk management and role-based AI literacy and training. Perhaps most importantly, the framework must be flexible enough to evolve with technology. Overly rigid structures can discourage innovation or result in shadow AI, while the absence of governance exposes the organisation to unnecessary risk. The objective is a repeatable operating model that supports responsible adoption across the enterprise.
“Organisations will increasingly need to demonstrate that their AI systems protect people, data and business interests – not simply to satisfy regulators, but to preserve confidence, retain customers and compete effectively.”
FW: What role should boards and senior leadership teams play in overseeing AI adoption, accountability and risk management?
Crane: The board’s role is not to approve each AI use case. Its role is to ensure the organisation has an effective governance framework, appropriate oversight mechanisms and a clear understanding of where AI is creating both opportunity and risk. AI is becoming a board-level issue because it touches virtually every aspect of the enterprise – from operations and workforce management to cyber security, privacy, compliance and corporate reputation. Companies should be able to demonstrate that risks were identified, governance structures were established, resources were allocated and significant decisions were supported by reasonable diligence, documented oversight and adequate visibility to the board. Senior leadership has the operational role. It should establish governance structures, assign accountability, create escalation mechanisms and ensure collaboration among legal, compliance, security, privacy, data, technology and business stakeholders. Senior leadership own decisions about acceptable risk, customer trust and ethical use, within the risk appetite the board oversees. The most effective boards are moving beyond periodic updates about AI and integrating it into broader discussions about strategy, risk, innovation and corporate governance.
FW: How should organisations determine where human oversight is essential and where greater AI autonomy can be deployed responsibly?
Crane: Organisations should begin with the potential impact of the AI system rather than the sophistication of the technology itself. Human oversight should be strongest where an AI-assisted decision could significantly affect an individual’s rights, opportunities, safety, finances, employment, healthcare or access to critical services. In these higher-risk scenarios, ‘human in the loop’ allows humans to remain actively involved in reviewing outputs, addressing exceptions, approving actions, challenging results and validating outcomes. In lower-risk use cases, such as administrative support, content summarisation, workflow automation or other operational-efficiency applications, organisations may permit greater autonomy if appropriate monitoring and safeguards are in place. ‘Human in the loop’ fits here because risk is lower – the benefit is scale. The goal is not to require human involvement in every decision. In fact, the goal is not to require human sign-off at every step, as doing so can lead to issues such as approval fatigue and review degradation. Rather, organisations should embed meaningful oversight where it reduces risk, strengthens accountability and protects against unintended outcomes. That determination should be documented and revisited as the use case, data or technology changes over time.
FW: How can organisations balance the desire for rapid AI innovation with the need for accountability, transparency and risk management?
Crane: Innovation and governance are often framed as competing priorities, but effective governance should enable innovation rather than obstruct it. It should also extend beyond security, risk and compliance to provide a disciplined framework for deciding where the organisation should invest its time, capital and talent in AI. That investment discipline is increasingly important as organisations face pressure to demonstrate meaningful business impact and return on rapidly growing AI spending. Governance can help leaders compare proposed use cases against consistent criteria, including strategic alignment, expected value, feasibility, data readiness, risk, cost and the ability to measure outcomes. This allows organisations to prioritise applications that solve meaningful business problems rather than pursuing AI simply because the technology is available. A governance by design approach supports both speed and accountability. Risk, privacy, security, compliance and value considerations should be integrated early in AI development, procurement and deployment rather than introduced at the final approval stage. Clear intake criteria, risk-based review pathways, controlled experimentation and pilot programmes can accelerate adoption while creating evidence to determine whether a use case should be scaled, redesigned or discontinued. In short, governance should provide guardrails, not roadblocks. Done well, it creates the trust and operational discipline needed to scale innovation responsibly while directing investment toward AI use cases that deliver measurable value.
FW: As AI adoption continues to accelerate, what major changes do you anticipate in governance approaches, regulatory oversight and accountability requirements during the next few years?
Crane: Over the next several years, I expect AI governance to become more formalised and deeply embedded in enterprise governance – not only because of regulatory requirements and enforcement, but because protecting the business and its customers will make it a commercial necessity. Regulators will continue to focus on transparency, documentation, risk management, human oversight and accountability. Although jurisdictions may differ, laws such as the European Union AI Act, and standards such as the International Organization for Standardization and International Electrotechnical Commission 42001 and the National Institute of Standards and Technology’s AI Risk Management Framework, are already shaping how multinational organisations structure their programmes. At the same time, rising customer and stakeholder sophistication will create market pressure for stronger trust and safety capabilities. Organisations will increasingly need to demonstrate that their AI systems protect people, data and business interests – not simply to satisfy regulators, but to preserve confidence, retain customers and compete effectively. Governance will also become more evidence based. Organisations will need current AI inventories, documented risk assessments and decisions, ongoing performance monitoring, periodic validation, and role-appropriate AI literacy for employees, executives and boards. Regulators, customers and litigants will look beyond policy language to whether controls operate effectively in practice. As AI becomes embedded in core business processes, boards and senior executives should expect greater scrutiny of adoption and oversight decisions. The defining question will no longer be whether an organisation uses AI, but whether it can show that it does so responsibly, protects its stakeholders and maintains the trust required to sustain the business.
Taryn Crane is the privacy & data protection practice leader at BDO, focusing on privacy, data protection and privacy technology services. She has consulting experience working across several markets, including hospitality, retail, financial services, insurance, technology, life science, industrial and nonprofits. With a cross-functional background in risk management, data modelling and business process management, she can effectively engage across executive leadership, business units and technology teams to reconcile regulatory requirements and design risk-based, practical solutions. She can be contacted on +1 (301) 354 2583 or by email: tcrane@bdo.com.
© Financier Worldwide