AI’s paradox: Can innovation and governance move at the same speed?

Food for Thought: AI's paradox

At a HotTopics Food for Thought discussion, in partnership with Okta, senior technology leaders explored why AI governance must evolve alongside the technology it seeks to control.

As AI continues to move at extraordinary speed, enterprise governance is struggling to keep pace. For CIOs, CISOs and technology leaders, this creates a fundamental dilemma.

Businesses are now demanding faster innovation, employees are experimenting with increasingly powerful AI tools, and cybercriminals are exploiting the same technologies to develop more sophisticated attacks. Meanwhile, regulatory requirements and internal approval processes threaten to slow progress before initiatives even reach production.

During a recent Food for Thought discussion, held in partnership with Okta, challenged whether existing governance models are equipped for an increasingly autonomous technological landscape. The emerging consensus? Organisations cannot afford to choose between and governance; they need to rethink how the two work together.

The AI governance dilemma

One participant described the challenges of enterprise AI governance through an analogy: “you’re trying to steer two horses on the same chariot.”

One horse represents technological innovation, accelerating at remarkable speed. The other represents organisational governance, weighed down by legacy processes, lengthy approvals and regulatory obligations. The result is an increasingly difficult journey for leaders attempting to keep their organisations moving forward.

The same participant shared an example from the pharmaceutical industry, where developing an AI-powered chatbot for healthcare professionals required extensive internal approvals. Despite the project receiving unusually fast approval by organisational standards, the underlying AI model had already become obsolete by the time the solution was ready.

The example illustrated a larger problem: traditional governance cycles are becoming more incompatible with the speed of AI development.

Other participants highlighted Europe’s regulatory environment as a potential obstacle to competitiveness, particularly when compared to the pace of innovation in the United States and Asia.

However, there was also recognition that regulation serves an important purpose, particularly in protecting individuals against harmful applications of AI. The challenge here is not necessarily reducing governance but making it sufficiently agile to support more responsible innovation.

Shadow AI: The risks hiding in plain sight

Beyond regulatory complexity, participants identified another pressing concern: the growing visibility gap surrounding enterprise AI adoption.

Employees are increasingly using publicly available AI applications, sometimes without approval or awareness of the potential security implications.

For organisations, this creates an ever-expanding ecosystem of shadow AI, where sensitive information, intellectual property and corporate systems may be exposed through poorly governed connections.

Stephen McDermid, Regional CSO at Okta, warned that AI amplifies many of the identity security challenges that organisations have faced for years:

“It's not a firewall failure. It's not a breach. It's not a hack. It's an identity failure,” he explained, discussing incidents involving compromised OAuth tokens and third-party application access.

The consequences have become particularly significant when AI agents receive permissions to interact with enterprise applications and sensitive datasets.

Unlike conventional software, autonomous agents can perform multiple tasks, interact with other systems, and potentially expose information at a speed that exceeds human oversight.

Participants also questioned whether organisations genuinely understand where AI is being deployed internally.

One executive described establishing an AI governance committee and inventory to identify use cases across the business. Yet informal conversations with employees continued to reveal previously unknown applications.

Overall, this part of the conversation reinforced the importance of visibility as the foundation of effective AI governance. Organisations cannot adequately protect systems they do not know exist.

Don’t put AI lipstick on a broken process

Another recurring theme was the temptation to introduce AI into business processes that were already inefficient, poorly documented or fundamentally unsuitable for automation.

Moderator Doug Drinkwater, Editorial and Strategy Director at HotTopics, questioned whether pressure from boardrooms to demonstrate an AI strategy was encouraging organisations to prioritise adoption over meaningful outcomes.

Participants acknowledged that executives expect visible AI initiatives, even when the underlying business case remains unclear.

For some organisations, decades of accumulated technical debt present a substantial obstacle. Fragmented data architectures, outdated applications and inconsistent processes make it difficult to realise the promised productivity benefits of AI.

McDermid challenged the assumption that AI automatically improves existing operations: “Everybody thinks that we can AI a process where you can just fix the process,” he observed.

Rather than treating AI as a universal solution, leaders argued that businesses should first understand the problems that they are attempting to solve.

This also raised questions about ROI. If organisations continue layering onto inefficient operating models without addressing the underlying weaknesses, the result may simply be higher costs rather than greater productivity.

From AI anxiety to AI literacy

Despite the security concerns, participants repeatedly emphasised that restricting access to AI is unlikely to prevent employees from using it.

Instead, overly restrictive policies may encourage individuals to seek alternative tools outside approved corporate environments.

The discussion explored how organisations can help develop AI literacy while maintaining appropriate security controls.

McDermid shared Okta’s experience of introducing educational initiatives, including workshops, peer-learning communities and an internal programme encouraging employees to experiment with AI prompts.

The organisation subsequently introduced AI proficiency assessments, linking access to more advanced tools with demonstrated understanding of their use.

Other executives described using pilot programmes to encourage adoption, build confidence and involve employees in shaping organisational AI strategies.

The wider lesson was that successful AI governance depends as much on people and organisational culture as it does on technology.

Who gave the AI agent the keys?

As the discussion turned towards autonomous AI agents, identity security emerged as a particularly important consideration.

McDermid argued that organisations must look beyond safeguards built directly into AI models and examine the systems, permissions and connections surrounding them. This includes understanding which applications agents can access, whose identities they operate under, and how their permissions might change over time.

“Governance is not a point in time. Governance is perpetual; it's continuous,” he explained. He outlined four fundamental questions organisations should ask when establishing oversight of AI agents:

1. Where are our agents?
2. What are they doing?
3. What can they do?
4. How do we respond when something goes wrong?

For McDermid, answering the first question remains one of the greatest challenges.

He also emphasised the importance of open standards and interoperable security mechanisms, particularly as AI agents communicate across organisational and supplier boundaries.

Participants considered whether agents might eventually require something resembling a digital “driving license”: a clearly defined identity, permissions, operating boundaries and risk profile.

Such approaches could allow governance to become more automated, reducing dependence on lengthy manual approvals while maintaining that sought-after accountability.

Governance as an enabler

Towards the end of the discussion, a deeper disagreement emerged over whether AI should be considered another business tool or something more transformative.

Some argued that AI remains a means of achieving established business objectives. Others suggested it represents an entirely new operating model, potentially reshaping how organisations structure teams, distribute responsibilities and measure productivity.

One leader envisioned a future in which executives manage both human employees and autonomous digital workers, each operating with defined identities and responsibilities.

Nevertheless, the discussion returned to the importance of business outcomes.

McDermid argued that organisations should focus less on AI itself and more on what it enables them to achieve. “AI is not the thing. Outcome is the thing that they care about,” he said, referring to boardroom priorities.

For technology and security leaders, this means translating AI governance into language that resonates with the wider business: operational resilience, competitive advantage, measurable value and risk reduction.

Ultimately, the conversation suggested that the real paradox is not innovation versus governance. It is the continued reliance on governance models designed for a slower, less interconnected technological world.

Moving forward, organisations will need security frameworks that operate continuously rather than retrospectively.

Join the Oktane on the Road on the 24th of November in Munich to dive deep into the latest AI conversations, connect with your peers, and participate in interactive roundtables featuring amazing customer logos.