For years, conversations about data sovereignty followed a predictable pattern. Compliance teams wanted to know where sensitive data was stored, legal teams ensured regulatory requirements were met and IT focused on delivering the infrastructure to support the business. Once those requirements had been satisfied, the conversation largely moved on.

Today, that approach is becoming increasingly difficult to maintain.

Enterprise infrastructure has changed significantly over the past decade. Applications now span multiple cloud platforms, workloads move between on-premises and cloud environments, and AI is creating entirely new ways for organizations to generate, process and analyze data. At the same time, geopolitical tensions, changing regulations and growing dependence on a relatively small number of global cloud providers are forcing organizations to think differently about the relationship between their data and the infrastructure that supports it.

As a result, data sovereignty is evolving beyond a compliance exercise. It is becoming an important consideration in how organizations design infrastructure, manage operational risk and maintain long-term flexibility.

The business consequences of losing visibility and control over enterprise data have become increasingly difficult to ignore. According to IBM’s 2025 Cost of a Data Breach Report, the global average cost of a data breach reached US$4.9 million, highlighting why decisions about how enterprise data is governed, protected and managed are now attracting board-level attention rather than remaining solely within IT. As organizations distribute data across cloud platforms, AI services and third-party environments, maintaining control is becoming just as important as deciding where that data resides.

Data sovereignty is no longer just about location

Traditionally, demonstrating data sovereignty often meant showing that information was stored within an approved geographic region. For many workloads, that was sufficient to satisfy both regulatory and organizational requirements. Modern IT environments are considerably more complex.

A single business application may rely on infrastructure spread across multiple regions, cloud services from different providers and data replicated for resilience and availability. Administrative functions may operate from different jurisdictions, while AI services may process information in entirely separate environments from where it is stored. This means that physical location is only one part of the picture.

Today’s CIOs are often asking broader questions. Who has administrative access to critical data? Which jurisdictions have legal authority over the platforms storing or processing it? How easily can workloads be moved if business requirements change? What dependencies exist on individual providers? And how resilient is the organization if those dependencies become a constraint?

These are infrastructure questions as much as governance questions. They influence architectural decisions around workload placement, identity management, backup strategies, disaster recovery and the degree of flexibility built into an organization’s technology estate. Rather than being addressed after infrastructure has been deployed, they are increasingly shaping infrastructure decisions from the outset.

Cloud has made sovereignty more strategic

Cloud computing has given organizations access to almost unlimited compute capacity. It has accelerated application deployment and enabled businesses to scale in ways that would previously have been difficult or expensive. However, cloud has also introduced new considerations around control.

Most organizations now operate hybrid environments that combine public cloud, private cloud, colocation facilities and on-premises infrastructure. Few enterprises rely on a single operating model because different applications have different performance, security, regulatory and commercial requirements. The challenge for CIOs is not deciding whether cloud is the right answer. It is determining which workloads belong in which environments while retaining the flexibility to adapt as business priorities evolve. That flexibility is becoming much more valuable.

AI is driving significant changes in infrastructure requirements, while geopolitical uncertainty and evolving regulations continue to reshape the technology landscape. At the same time, infrastructure planning is becoming increasingly influenced by factors such as hardware availability, power, cooling and supply chain resilience. Data sovereignty adds another dimension to those decisions, requiring organizations to think not only about where workloads run, but how much control they retain over the data those workloads generate and process.

Organizations are also rethinking the physical form of infrastructure itself. Containerized modular data centers allow enterprises to stand up sovereign capacity on their own sites, under their own governance, without waiting on constrained colocation markets or multi-year grid connection queues. The workload, the hardware and the jurisdiction all sit within the organization’s direct control. What was once dismissed as a temporary fix has evolved into something more strategic: purpose-built AI pods that deploy in months rather than years and scale in increments matched to demand.

Decisions that once appeared relatively static may now need to be revisited much more frequently. Infrastructure strategies that preserve workload portability and avoid unnecessary dependencies are often better positioned to respond to those changes than environments built around a single platform or provider.

This is not an argument against public cloud. Public cloud remains an essential component of modern enterprise infrastructure. But it reflects the growing importance of maintaining choice. Organizations that can move workloads, adopt new technologies or adjust operating models as circumstances change are likely to be more resilient than those with fewer options.

Control is becoming the foundation of resilience

Resilience is often discussed in terms of cybersecurity, disaster recovery or business continuity. Increasingly, it also depends on how much control organizations retain over their own infrastructure. This is reflected in the NIST Cybersecurity Framework (CSF) 2.0, which introduced Govern as one of its six core functions, recognizing that effective cybersecurity starts with governance, risk management and organizational oversight rather than technology alone.

An organization that understands where its data resides, who can access it, how it is protected and how quickly it can be moved if circumstances change, is generally better prepared to respond to disruption. That disruption may take many forms, from regulatory changes and geopolitical developments to commercial decisions made by technology providers or the rapid adoption of new AI capabilities. This is where data sovereignty becomes a strategic capability rather than simply a compliance requirement.

Infrastructure decisions increasingly determine how easily organizations can adapt to change. Building flexibility into architecture today makes it easier to respond to future business requirements without unnecessary complexity or costly re-engineering.

Looking ahead, the conversation is likely to extend beyond data sovereignty towards AI sovereignty. As organizations deploy AI models across customer services, software development, business operations and decision-making, many of the same questions will apply. CIOs will need to understand not only where enterprise data is stored, but where AI models operate, what information they can access, how they are governed and who ultimately retains control over the intelligence embedded within critical business processes.

While AI sovereignty is still an emerging concept, it reflects the same underlying principle. Organizations are no longer simply deciding where technology runs. They are deciding how much control they retain over the technologies and data that underpin their business. For CIOs, that represents an important shift in perspective.

Data sovereignty should no longer be viewed as a compliance checkpoint to address once infrastructure decisions have been made. It has become a strategic consideration that influences cloud adoption, infrastructure architecture and long-term operational resilience. As enterprise environments become increasingly distributed and AI becomes embedded across the organization, the ability to maintain visibility, flexibility and control will become just as important as where data happens to reside.

Your agent compares a banker’s calendar with the legal team’s and recognizes a pattern: an unannounced transaction is underway. No one told the agent about the deal. It inferred it correctly. Then it adds one line to an executive briefing for a recipient who was not cleared to know about it: “the deal is moving.” Every calendar read was legitimate, and no confidential document was opened. The conclusion is the breach, and no existing permission covers it.

Last month I wrote that your next insider threat carries an API token, and that the breach is the sequence of permitted actions, not any one of them. That piece was about what an agent is allowed to do. This one is about what it is allowed to know. The runtime check I argued for there inspects each action before it fires. Here, that check approves every read because each one is permitted.

Authorization can travel correctly through every step of the task graph and still miss the synthesized result. Session-based authorization ties access to the current authenticated session. Task-based access control (TBAC) narrows that authority around a specific task; one recent agentic application checks whether the tools an agent requests align with its assigned task. But task scope alone does not automatically answer whether a new conclusion produced from permitted inputs is authorized for a particular recipient.

The danger isn’t in any single action. It’s in the join: the agent connects information from authorized sources and produces a conclusion that no single source revealed on its own. That’s aggregation inference. The synthesized result, not the individual inputs, is a new authorization object. It did not exist when the underlying permissions were granted, and no individual permission was written to cover it.

What TBAC cannot determine from task scope alone

Aggregation inference has predecessors. Intelligence agencies and courts have recognized the mosaic effect for decades: details that appear harmless on their own can reveal sensitive information when combined. Privacy researchers encountered the same limit from another direction. Dwork and Naor examined a formal version of Dalenius’s disclosure-prevention goal: a database should reveal no information about a person that could not be learned without it. They showed that no useful database can meet that standard because a system cannot account for all the outside information a reader may already possess. Access control still has no general answer to either version of the problem.

In my recent research, I have been examining aggregation inference as one of three subproblems of authorization propagation in multi-agent systems. An agent can be cleared for every source it touches and still manufacture a conclusion no single clearance covers. The result did not exist until the agent produced it. That work treats the problem as unsolved in the general case.

What’s new is that you now employ something that performs the join a thousand times a day, on its own, across everything you let it read — a model whose behavior is not formally specified in advance. It may discover resources dynamically as the workflow unfolds, and the recipient may not know which ones contributed to the conclusion.

The shape shows up frequently in the design reviews I sit in. When I threat-model an agent before it ships, the first question is no longer which sources it can read — it’s which sources it can read together. The agents that worry me are never the ones with access to a single sensitive system. They are the ones holding standing read access across two domains whose combination nobody ever reviewed, because each grant looked routine on its own.

A January 2026 study by Tianshi Li, run against transcripts from a publicly released interview dataset, shows what individually permissible searches can reveal in combination. The study conducted re-identification tests on 24 interviews in which scientists discussed published work. Web-enabled LLM agents linked six of those transcripts to specific publications, recovering associated authors and, in some cases, uniquely identifying the interviewee. The process bypassed existing safeguards by breaking the re-identification effort into individually benign tasks.

Why the floor is not the ceiling

One natural response is to classify the conclusion using its source files: take the strictest sensitivity label among what the agent read and apply it to the result. It’s a reasonable instinct, and versions of it are already patented. But the strictest-label approach still cannot solve the problem, and the reason is worth sitting with.

Combine the labels of what the agent read, and you learn the floor of sensitivity. You never learn the ceiling. What makes “the deal is moving” sensitive is usually not in any document the agent touched. It is a fact about the world that the agent could not read at all: the board has not announced the transaction yet; an acquisition NDA is in force; a quiet period applies. You can inspect every row the agent saw and never find it because it is not in the data. It is in the world.

That is the whole problem. If the property that makes a conclusion dangerous is not in the inputs, then no rule computed from the inputs can catch it. Not the strictest label, not the intersection, not any function of what the agent read. You are trying to classify a fact using only the materials that fail to contain it.

That sounds like a dead end. It is actually a direction. If the fact that classifies a conclusion is not in the data, it has to enter the system somewhere a rule can reach, and for the facts anyone can name in advance, there is one place left: the moment a human says what the agent is for. You cannot label the output from the inputs, but a person can label the purpose.

The practical starting point is to bind an agent’s authority to a declared purpose. The person who knows what is still secret this quarter can then attach the world-facts that gate that authority: the deal, the embargo and the quiet period. Now the missing fact is in the system, and the machine can enforce policy using it rather than trying to derive it from the inputs. You did not solve the classification. You stopped asking the data to carry a fact it never held. That is the shape of the answer, and it is a long way from shipped. But it tells you which way authority has to point: at the purpose a human declared, not at the files an agent happened to read.

So, I will not sell you a fix. Anyone who tells you their product classifies emergent conclusions is selling you the floor and calling it the ceiling.

What policies can gate and what requires human judgment

What follows isn’t a solution to that classification problem — it’s the lever available today. Cross-domain access rules and combination policies can limit which resources an agent combines and gate delivery based on those inputs. They cannot tell you what the resulting conclusion means. Those controls reduce risk, but they do not solve synthesis authorization in the general case and should not be presented as if they do.

In the deal-and-calendars scenario, the immediate step is not to remove access altogether but to assign responsibility for the combination. Someone responsible for the deal’s confidentiality can approve it for a window tied to the matter’s expected duration, re-certify it each quarter while the matter remains open and narrow access when it closes. That turns standing access into an explicit governance decision rather than a default no one remembers granting. Organizations do not need to wait for tooling to name an owner and set the terms.

The architectural direction — a design target today, not a shipped control — is to make resource combinations first-class objects of policy: declare which combinations are permitted, evaluate those declarations before a synthesized result is returned, and give agents scoped identities with explicit permissions.

Any agent holding standing read access across two sensitive domains at once — people and finance, customers and roadmap, deals and calendars — is not a provisioning ticket. It is a governance decision, and it belongs to someone who knows what is still secret this quarter.

Be honest about what this buys you. Gating cross-domain access reduces the number of agents that can perform a dangerous join on their own. It won’t stop every version of this problem.

An agent can still read one domain and hand a summary to a person who connects it to something only they know. No access policy will see that final step, because that residual lives in a head, not a document. That exposes the control’s boundary: it can govern what the agent reads but not the conclusion a person ultimately draws from it, a new object that no existing permission covers. The compositions are where the risk lives, and per-resource access control is blind to them by design.

If you cannot name the person who owns each agent’s cross-domain access decision, close that gap first.

Over the past few years, much of the conversation has focused on autonomous AI and how quickly organizations can remove humans from decision-making. In financial services, we’re seeing the opposite trend. The organizations making the most sustainable progress aren’t eliminating human oversight—they’re redesigning it.

The model taking hold within the banking industry isn’t AI that operates independently and makes decisions; it’s AI that operates with intent and oversight. Human-in-the-loop is quickly becoming the standard, combining the speed and scale of machine-driven insight with the accountability, judgment and control that organizations can’t afford to lose. The shift is increasingly aligned with how regulators and industry frameworks are shaping responsible AI adoption, from the NIST AI Risk Management Framework to the revised U.S. banking agencies’ model risk management guidance, both of which reinforce governance, monitoring and accountability over blind automation.

From my perspective, this is not innovation slowing down; it’s AI adoption growing up. The first wave of enthusiasm focused heavily on what could be automated, but now the more important question is where can AI create meaningful value while keeping the right human judgment, oversight and accountability in place? In financial services, that distinction matters. In an industry built on trust, those capabilities are not optional— they are foundational to how we serve customers, manage risk and earn confidence every day.

Banking offers one of the clearest examples of why human-in-the-loop AI is becoming the default operating model for enterprise AI more broadly. Some of the most valuable AI use cases sit in environments where mistakes carry real consequences, customer impacts are significant and explainability is essential. In those moments, human oversight is what allows institutions to scale AI responsibly.

In banking, AI usually doesn’t operate in a vacuum. Whether it supports customer service, fraud detection, compliance, underwriting or internal productivity, it is touching workflows that affect customers, colleagues, regulators and the reputation of the institution. That is why responsible scale matters. Global bodies including the Financial Stability Board and the Bank for International Settlements have recognized the efficiency and analytical benefits AI can bring, while also warning that it can amplify model, cyber, concentration and governance risks if controls do not keep pace. For financial institutions, the mandate is clear – move with ambition, but scale with discipline.

Where human oversight matters most

The next phase of enterprise AI adoption will be defined by how well institutions understand where AI can move work faster, and where human judgment still needs to lead. For financial institutions, that starts with materiality. The greater the potential impact on customers, regulatory obligations or financial resilience, the stronger the case for meaningful human oversight.

Customer service is a good example. AI can help teams summarize inquiries, recommend next-best actions and reduce manual handling time. But when the issue involves a disputed transaction, a vulnerable customer, a complaint or product suitability, human judgment must remain central. AI can make service faster. It can make it more consistent. But it cannot replace empathy, context or accountability.

Fraud and financial crime are areas where AI can create real value, but human oversight remains essential. AI can detect patterns, anomalies and suspicious behavior across large data sets at a speed and scale people cannot match, but fraud is dynamic. Typologies evolve, bad actors adapt quickly and authorities have warned that AI can also increase the sophistication of scams, fraud and disinformation. In that environment, analysts and investigators play a critical role — validating signals, reducing false positives, escalating the right cases and applying judgment as the threat landscape changes.

Risk, compliance and credit are similar. AI can help synthesize internal data, identify control gaps and strengthen monitoring. But when outcomes affect lending decisions, regulatory obligations, capital or liquidity, institutions need governance that preserves challenge, review and accountability. The EU AI Act’s human oversight requirements for high-risk systems point to a broader direction of travel — the more consequential the use case, the more important it is that people can understand the system’s limitations, override outputs and intervene when needed. For U.S. institutions, the specific rule may differ, but the principle is already part of how banking operates. High-impact decisions require accountable oversight.

At the same time, human-in-the-loop cannot mean putting a manual checkpoint in front of every AI-assisted task, which would slow adoption and reduce the value AI can create. The goal is risk-based oversight. Lower-risk use cases may be managed through periodic review, testing and monitoring, while higher-risk applications may require real-time review before action is taken. What matters is that institutions define those thresholds clearly, rather than assuming one oversight model fits every use case.

Why collaborative AI is winning in financial services

The financial institutions that are embracing human-in-the-loop AI do so because they understand both the opportunity and the stakes. AI can process transactions, summarize complex information and identify patterns at a scale humans cannot match. At the same time, consumer expectations make clear that scale alone is not enough.  TD Bank’s 2026 AI Insights Report found that 78% of Americans now use AI-powered tools in their daily lives, yet only 18% are comfortable allowing AI to make important financial decisions independently. That gap says a lot about where the market is heading. Consumers are not rejecting AI, but they are drawing a clear line around accountability.

That is why speed cannot be the only measure of success. When customer outcomes, regulatory obligations or enterprise risk are involved, people still need to challenge the output, apply context and remain accountable for the decision.

That oversight matters because AI does not always fail in obvious or familiar ways. Generative AI can produce confident but inaccurate answers. Machine learning models can drift as data changes. Even highly accurate systems can deliver biased or poorly reasoned outputs when the data, assumptions or prompts behind them are flawed. NIST’s Generative AI Profile highlights risks including confabulation, privacy concerns, misalignment and automation bias.

For financial institutions, the lesson is that responsible AI requires people who understand how to use the technology, and also when to question it.

Building the organization for responsible AI at scale

In addition to being a technology challenge, responsible AI is also an operating model challenge. The institutions that scale AI well tend to do three things with discipline: establish clear governance, redesign workflows around the technology and build the skills employees need to use AI responsibly.

Governance starts with ownership, but it cannot sit with one executive or one team alone. It requires coordination across business lines, risk, compliance, legal, technology and model risk functions. That cross-functional model is becoming more common as organizations move beyond experimentation.  McKinsey’s State of AI report found that AI governance is often jointly owned and that CEO involvement in governance is correlated with stronger reported bottom-line impact, suggesting that firms derive more value when AI oversight is treated as an enterprise priority rather than a side initiative.

Workflow redesign is just as important because the real value of AI comes from reimagining processes end-to-end. That means identifying where AI can handle summarization, pattern recognition or drafting and where people should focus on exception handling, complex decisions and relationship-driven work. Human-in-the-loop is not about preserving the old operating model; it’s about building a better one.

That also requires new capabilities across the workforce — employees need to know how to use AI tools effectively and how to challenge them. They need to understand prompt quality, output limitations, data handling expectations and the warning signs that a system may be producing unreliable results. The  World Economic Forum’s 2025 report on AI in financial services underscores that while adoption is accelerating, responsible scaling depends on workforce adaptation, governance maturity and a clear understanding of risks alongside value creation. Responsible adoption depends as much on human capability as it does on model performance.

Looking ahead, enterprise AI in financial services will become more embedded, more specialized and more agentic in targeted domains. But that does not mean the human role becomes less important; if anything, it becomes more important. As AI takes on more analytical and operational work, people will increasingly serve as orchestrators, reviewers and decision-makers at the points that matter most. They will set objectives, define controls, interpret edge cases and know whether the AI results can be relied upon.

The organizations that lead in AI will be the ones that make human judgment a deliberate part of the design—clear about where AI can accelerate work, where people must remain accountable and how both can operate together with discipline. For financial institutions, the call to action is to treat human-in-the-loop AI as the operating model that makes innovation more trusted, more durable and more worthy of the customers and communities it serves.

There are few professions where part of the job is literally to read the newspaper, watch television or continuously check what is happening across every channel. In a media organization, that is not confined to journalists. Keeping up with events is, in one way or another, part of the work of much of the organization. A newsroom is also one of the most paradoxical professional environments I know. Before moving into media, I was director of New Technologies at Spain’s leading franchise consultancy, a role that allowed me to work with companies of almost every size and across almost every sector.

After years as CIO of Canarias7, I have seen how some of the most senior journalists approach almost anything related to technology with suspicion while looking back fondly on an idealized newsroom of typewriters, cigarettes and whiskey. It may sound like a caricature, but there is truth behind the nostalgia. Few professions have gone through so many technological transformations while continuing to defend the essence of their craft.

That is precisely why I believe CIOs have a great deal to learn from newsrooms in the age of artificial intelligence. Not because journalism is an example of frictionless technology adoption, but because newsrooms have spent decades solving a problem that is now spreading across the enterprise. They absorb huge volumes of information, distinguish what matters from what does not, make decisions with incomplete data, change priorities within minutes, verify before acting and keep accountability for the outcome clear.

As AI evolves from assistants that generate information into agents that can recommend, decide and execute actions inside enterprise systems, the challenge is no longer purely technological. It is also an operating model problem. That is where the experience of a newsroom becomes particularly relevant to a CIO.

Human attention should be treated as a scarce resource

In a newsroom, it is impossible to subject every piece of information to the same level of review. The credibility of the source, the relevance of the story, the consequences of a possible error and the existence of conflicting accounts all influence how much effort is devoted to verification. Some routine decisions are made quickly, while others pass through several levels of checking before publication.

Companies are beginning to face the same problem with AI. The most common response has been to place a person at the end of the process, the familiar human-in-the-loop, to validate what the machine does. But if AI multiplies the number of analyses, recommendations and decisions, it can also multiply the workload of those expected to supervise them. Human attention, just as in a newsroom, has to be allocated according to risk.

CIOs should apply the same principle. A routine, reversible, low-impact action can be automated, while an anomalous or low-confidence decision involving sensitive information or consequences that are difficult to reverse should escalate to a higher level of supervision. A 2026 study of automation bias in computational pathology involving 28 specialists found that in 7% of cases, an initially correct assessment was overturned after the specialist received an incorrect AI recommendation. Simply adding a person to the process does not automatically remove AI risk.

The Associated Press offers a useful example of this logic. Its updated AI standards from July 2026 allow AI to assist with early-stage research, transcription, translation, document summaries and headline suggestions, while keeping editorial judgment, verification and accountability with journalists. The point is not to require human supervision for everything, but to reserve it for tasks where context, interpretation or the consequences of an error justify that control. For a CIO, that means determining which decisions can be automated and which should escalate to a person, based on risk, impact, and reversibility.

Governance must be built into the architecture, not the prompt

A newsroom does not control its work through instructions alone. Reporters, writers and editors have different responsibilities and decision rights and the workflow itself establishes points where a story can move forward, be sent back for further verification or be stopped. Control depends not only on each person remembering what they are allowed to do, but also on how far their authority extends.

The Replit incident in July 2025 showed why the same principle matters in AI systems. Jason Lemkin, founder of SaaStr, was using Replit’s coding agent to build an application when the agent deleted a production database despite explicit instructions not to make changes during a code freeze. The agent had direct access to the same database used by the live application. Replit subsequently introduced automatic separation between development and production databases so that changes made during development could not directly affect live customer data. What a written instruction in a prompt failed to prevent became constrained by the architecture itself.

For a CIO, the parallel with a newsroom is straightforward. A reporter can prepare a story without having the final say over whether it is published. In the same way, an agent can analyze data or recommend an action without necessarily having permission to execute it. The system that generates a transaction should not always be the same one that validates it. Separating functions, limiting permissions, distinguishing between read and write access, isolating environments and maintaining audit and rollback mechanisms translate into AI architecture a principle that newsrooms have applied for decades: the person or system proposing an action does not have to be the one with authority to approve and execute it.

Humans need power, not simply a place in the process

Human-in-the-loop has another limitation. A person can be inside the process without having meaningful control over it. Researcher Madeleine Clare Elish coined the term moral crumple zone to describe situations in which responsibility for the failure of an automated system is attributed to a human operator who had limited control over what happened.

An “Approve” button does not guarantee effective supervision if the person clicking it does not understand why the system is recommending an action, does not have time to review the evidence or lacks the authority to stop it. In a newsroom, an editor can challenge a source, demand additional verification, delay publication or stop it altogether. The editor is not simply part of the process but has authority over it. That is why I find it more useful to think in terms of a human-in-power model, where responsibility, context and veto authority remain connected.

This logic also applies to organizational design. When a major story breaks, a newsroom first tries to understand what is happening and then decides how to cover it on the website, in print or on social media. Something has changed in recent years: the story comes before the channel. Many companies still operate the other way around. Information and processes remain fragmented across CRM, ERP, finance, marketing, customer service and data platforms. If we introduce autonomous agents into each silo, we can increase speed without ensuring that all of them are acting on the same version of reality.

Data, identity, context, permissions and traceability should therefore become shared capabilities on which different AI systems operate. Otherwise, automating faster may simply mean producing inconsistencies faster.

There is one final characteristic of newsrooms that I find particularly relevant. A plan agreed first thing in the morning can be obsolete ten minutes later. At Canarias7, we hold daily meetings with the different teams involved, from journalists and homepage editors to SEO, analytics, multimedia and other support functions, to review what is happening, what has changed since the last decision, which stories require more attention and where resources should be concentrated. When something important happens, priorities change, teams reorganize and decisions are made again. This is not a failure of planning. It is a normal condition of the job.

AI is taking companies toward the same environment of continuous decision-making. As systems absorb more information and agents gain more autonomy, they will need to update their context and reconsider actions when reality changes. The operating model has to make that possible without losing accountability along the way.

After years of working between journalism and technology, I still find it paradoxical that a profession that so often greets each new tool with skepticism can now offer some of the best clues for organizing the AI-driven enterprise. Artificial intelligence can accelerate our ability to observe and act, but the advantage will lie in what happens between those two points: how we interpret information, set priorities, verify what matters and determine who has the authority to decide. In that sense, the CIO in the AI era is becoming the editor of how the organization observes the world, makes decisions and acts.

Every other week, there’s a new story about AI solving a math problem that took mathematicians decades to touch. Most recently, it was a conjecture that had sat unsolved since 1939, cracked with an assist from an AI model. Meanwhile, the typical team still can’t ask ChatGPT what we sold last week without pulling three dashboards and arguing over whose number is right. That begs the question: why is AI intelligent enough to outsmart MIT professors, but it can’t outsmart the sales intern?

Here’s part of the answer. AI doesn’t get to guide a real business decision until it can answer with real accuracy, not 95%, not 99%, all the way. Getting there means clearing three hurdles: context, determinism and cost. Solve those three and you get accuracy. Right now, none of them are solved, which is why accuracy, not intelligence, is the actual blocker nobody wants to admit.

Grounding is the first wall

Ask an AI model a question about your company and it doesn’t actually know your company. It doesn’t know who owns which decision. It doesn’t know why your warehouse manager overrides the forecast every October, or which of two conflicting reports your team trusts. A new hire picks this up by working somewhere long enough. AI needs it handed over, deliberately, in layers.

The first layer is your teams, roles and workflows: who does what, and who is allowed to change it. The second is your industry and business context; the reason a service outage means something different for a bank than it does for a media company. The third is your data itself, the tables, definitions and history that make an answer true rather than plausible. All three have to be handed over deliberately. None of them show up on their own.

What I have observed is that companies skip straight to buying an agent and skip this grounding work entirely, which doesn’t end well. The agent still sounds confident. It’s also wrong in ways nobody catches until a decision has already been made on top of it.

Businesses do not want a coin flip

A client once told me something I have not stopped thinking about. We proposed solving their facility allocation problem with a classic optimization algorithm, deterministic and auditable, the kind where the same input always produces the same output. They were disappointed, stating, “I hired you because you are AI experts. Classic optimization gives us deterministic results. We want AI that gives us indeterminate results.”

I understood what they meant. They wanted something that felt like AI. But indeterminate is not a feature you want in a system telling you how much inventory to order. In the pursuit of using AI for the sake of using AI, it is easy to lose sight of the outcome the business actually needs.

That conversation still shapes how I scope every new engagement. When a client asks for AI without naming the decision it needs to support, I ask what happens the day it’s wrong. If the answer is a bad number in a board deck, we’re not talking about the same kind of AI they think they’re asking for. Sometimes that conversation ends the engagement before it starts. More often, it reshapes it into something smaller and more useful, an agent that handles the easy 80% of questions and flags the rest for a human, instead of one system trying to do everything at once.

Here is a number to think about. Anthropic recently published how it automated its own internal business analytics queries using Claude, and even with a purpose-built system, aggregate accuracy landed around 95%. That is one of the best AI labs in the world, building for its own internal use, still getting roughly one answer in twenty wrong. Tell any CFO that number and watch how fast they walk back to their deterministic BI dashboard.

I don’t think 95% is close enough. Not when the number ends up in a board deck. Not when a wrong answer becomes a real decision with real money behind it. In my experience, executives will forgive AI for being slow to learn. They will not forgive it for being confidently wrong. AI doesn’t earn a seat at the decision table by being right most of the time. It earns it by being right every time, the same way the deterministic system it’s replacing was. That’s not a popular thing to say in a market excited about what AI can do, but popularity was never the bar a business decision needed to clear.

Cost swings before the ROI math holds still

The variance in the cost of running an AI agent is enormous. I have watched the same agent perform the same task use up to 30 times as many tokens in one run as in another. Try defending a Well Architected Framework, or any ROI model, against a cost that swings that hard.

The trend lines pull in opposite directions at the same time. The price per token has generally been falling, which should make agents cheaper over time. At the same time, multi-agent architectures are burning through more tokens to do the same job. And an agent genuinely grounded in your teams, industry context and data — the grounding I described above — will use even more tokens than a shallow one. Full accuracy costs more, not less. The good news, if the trend holds, is that this improves rather than worsens over time. But “if the trend holds” is doing a lot of work in that sentence.

Not every question your business asks needs the same level of AI maturity. How many customers are in the system is easy, and I’ll trust an agent’s answer. How revenue has changed over time is medium. Forecasting future demand by product, week and store gets harder. Figuring out how to allocate demand across factories and manufacturing lines is super hard. Crafting a strategy that takes into consideration the three layers of context plus macroeconomic trends is, honestly, impossible for AI or a human to answer with certainty. The higher you climb that ladder, the more a wrong answer costs you, and the less I’m willing to accept anything short of fully right.

The mistake I see most often is a company jumping from easy straight to hard, expecting an agent that can answer “how many customers do we have” to also handle causal questions like “why did we stop selling a product.” Context requirements, accuracy requirements and token cost all climb together as you move up that ladder. That’s also the difference between handing an agent a task and handing it a role; the judgment a planner, buyer or analyst brings to a job every day sits at the top of the ladder, not the bottom.

The mathematician who cracked that 87-year-old conjecture and the CFO who wants last week’s sales are asking for different things. The mathematician wanted a collaborator: someone to try a thousand wrong paths and surface one interesting idea, where a 5% hit rate is a triumph. The CFO wants a number she can put in front of a board, where a 5% miss rate is a liability. AI has earned the first seat. It hasn’t earned the second.

It will, but not by getting smarter. It gets there when someone does the unglamorous work of grounding it in the company’s context, constraining it to be right the same way twice, and paying for that at a cost the ROI math can survive. Intelligence was never the blocker. Accuracy is. So, until an agent can clear all three hurdles, give it the easy 80% of the ladder, keep a human on the rest and don’t let the fact that it disproved a conjecture convince you it’s ready to order your inventory.

Recently, I sat in on a conversation among CIOs about “the democratization of agents”: putting large language models directly in employees’ hands, connected to business logic so people could build on top of them. The mood was bullish, CIOs sketching out what their teams could do with agents they trained and managed themselves.

Soon after, I was in a room full of CISOs talking about non-human identity. The contrast was stark: instead of excitement, apprehension; instead of use cases, a long list of risks and mistakes not to repeat.

Eventually, the CISOs turned the question back to me: Manage agent identity largely as we manage human identity, or are the differences fundamental enough to rethink our approach from the ground up?

That moment pointed at something I think a lot of security and business leaders are quietly dealing with. The identity programs most of us have spent years building assume every identity is either a human or a machine. Human identities get a joiner-mover-leaver lifecycle, a manager, a role, a review cycle. Non-human identities get a service account, a defined purpose and, if we’re disciplined, an owner. AI agents don’t sit cleanly in either column.

An agent acts on behalf of a human user, so calling it a human identity doesn’t quite work. In my experience, many organizations start by assigning it permission on behalf of the user who invoked it, which works for short, simple tasks but breaks down as they run longer or touch more systems. The next instinct is a service account, which solves delegation but creates over-permissioning and access that outlives its purpose. A more mature approach is to treat the agent as its own workload identity: short-lived, tightly scoped, ephemeral.

That’s the right target. But even a well-built workload identity assumes predictable behavior. It runs the code it was given, and that’s it. Agents don’t. An agent’s actual access can shift mid-task based on the prompt it received, the tool it decided to call, or the plugin it reached for. It has no fixed job role to provision against, and its lifecycle doesn’t align with the joiner-mover-leaver process built for human identities.

So even the mature version of workload identity gets you only part of the way there.

Why this is urgent now

In many enterprise environments, that’s already a structural problem, not a hypothetical one. Non-human identities already outnumber human ones, and that was true before agents showed up. Cloudflare has reported that automated traffic has overtaken human traffic in requests to the websites on its network, earlier than its own CEO had predicted.

That’s a measure of web requests rather than headcount, but the direction of travel is the same one I see inside the enterprise. Agents bend the curve upward because they can request their own tokens, call other services and spin up activity at machine speed. It gets more complicated once agents delegate to each other, a parent agent handing part of a task to several child agents, each inheriting a slice of permission from the one above it. A few layers deep, that’s a permission chain that may evolve beyond what any individual approver originally contemplated.

This growth is what turns the category problem from an interesting edge case into an operational one. Part of what makes this hard: non-human identities have never felt real to people the way human ones do. A human identity has a face. You can track down the person, ask why they need a given level of access and get a straight answer about their job.

A service account or an agent typically gives you none of that. It’s easy to leave alone until it’s compromised, and then you’re reconstructing what it was for and what it could reach. We tend to underestimate how many of these we have, and we underestimate what they can touch. That’s part of why the category problem went unaddressed for as long as it did. It’s not urgent until you can put a number on it, and the number is growing fast.

One CIO.com contributor recently argued the real question with agents is authority, the judgment an agent is allowed to exercise on the company’s behalf, not just access. I agree, but in my experience, many organizations aren’t yet able to answer the authority question because they’re still working out where these identities fit within existing governance frameworks.

The gap shows up in the same place most times I look for it: governance.

Where today’s identity programs break

In my experience, the failure point is rarely authentication. Increasingly, security teams have a handle on phishing-resistant multi-factor authentication, least privilege and continuous verification, or at least have them on the roadmap. Governance is the harder capability, and it’s where I see programs stall, and it’s where the category problem actually shows up day to day.

Visibility tells you what access exists. Ownership tells you who to call about it. Governance is what you do with that information, and it’s a different thing entirely: blocking risky access combinations before they’re granted, raising the approval bar automatically when a request is high-risk, catching and unwinding out-of-bounds access without waiting for a quarterly review to surface it.

What I’ve come to believe is that governance lags for reasons that have very little to do with technology. It needs executive backing, agreement across teams that don’t report to you and a willingness to change processes people would rather leave alone. Application owners have their own deadlines, and teams resist central controls that slow them down. You can buy a tool. You can’t buy the alignment, and that’s the part that stalls. Too often, agents make it worse, because they push a flood of identities that don’t fit your existing categories through a governance process that was already your weakest link.

Where to start

I don’t think waiting for the tooling to mature is an option because the agents are already here. Here’s the order I’d work in.

1. Build the foundation before you add complexity. Clean directories, enforced least privilege, offboarding that actually fires. Jumping to sophisticated continuous verification before those basics hold up just gives you a more elaborate version of the same gaps.
2. Know when to rebuild. When you design access models and policies, the instinct is to mirror what exists. That approach can reproduce years of accumulated permission creep into the new system. Start from least privilege and work up, and be willing to push on “we’ve always done it this way.”
3. Inventory your non-human identities now. Before agent deployments grow that footprint further, know what you have, who owns each one and what it’s allowed to do. This is more a governance problem than a technical one. Discovery is the hard part here; even mature tooling can struggle to give full visibility into NHIs, and that gap isn’t closing as fast as the agent count is growing.
4. Treat MFA as a floor. If your organization leans heavily on SMS or push-based authentication, build a path toward phishing-resistant methods. Attackers worked out the common ones long ago. And in the agentic era, some agentic systems can interact with authentication workflows on a user’s behalf, so a hijacked session token doesn’t just expose one account; it inherits that user’s full automated reach. Phishing-resistant architecture now means securing the token supply chain, not just passwords.
5. Assume credentials will be compromised. The useful question isn’t whether, it’s how much damage one stolen credential can do. Least privilege, segmentation, RBAC, short credential life spans and continuous monitoring are what limit the blast radius.

You’ll notice none of these are agent-specific, and for good reason. The discipline that governs agents is the same discipline that runs the rest of your identity program. Agents just take away the option of putting it off.

The administrative model isn’t enough anymore

For many human identities, or even traditional workflow identities, the governing question has historically been administrative: is this identity who it claims to be, and does it have permission to be here? In many environments, that question has traditionally been evaluated primarily at login, at provisioning, and it holds until the next review.

That approach can break down for an agent. Because an agent’s actual access scope can shift dynamically based on the prompt it receives (from a human or another agent), the tools it calls or the plugin it reaches for, knowing it authenticated successfully isn’t enough. That model was built for an identity whose attributes and permissions generally remain stable after authentication.

That’s the piece that has to be new, on top of the workload foundation. Identity governance should likely extend from something checked periodically into something that watches what the identity is doing, in real time, and flags the moment it drifts from what it was built for.

The teams that start building that layer now, while their agent count is manageable, are the ones who won’t be doing it in a hurry later.

Brands like Snickers, M&M’s, and Twix are familiar to most consumers, but Mars Inc. doesn’t just produce snacks. The family-owned company, with a revenue of approximately $65 billion, is also one of the largest manufacturers of pet food and ready meals, and its more than 100 production facilities operate around the clock. Of course, this places considerable demands on its IT.

“Our team must ensure that every system, including production lines, runs at maximum performance so we can continuously deliver the products and services our customers value,” says Luciano Batista, the company’s VP of enterprise services delivery.

However, Batista and his team realized that the existing data infrastructure could no longer reliably support operations, especially during peak periods such as Halloween and the pre-Christmas shopping season. So with the support of hybrid, multi-cloud data storage service Everpure, Mars is rebuilding its data and IT infrastructure.

“The Everpure platform met all our requirements,” says Batista. “It’s a scalable platform that futureproofs our operations and integrates seamlessly with our hybrid cloud infrastructure.”

Unified storage environment 

Mars initially consolidated its complex network of storage systems for business-critical databases like Oracle and applications like SAP onto a single Everpure Flash Array system. These software-defined, all-flash storage arrays are available in versions for different workloads, and typical use cases include databases, virtualized environments, SAP applications, and AI and analytics applications. 

Mars has since expanded its flash array infrastructure and now supports mixed workloads, including VMware, Windows, and Linux in areas of production, development, and quality assurance. It also uses Everpure Flash Blade as the basis for the global SAP file system. And while Flash Array is optimized for structured data, the scale-out systems of the Flash Blade series are designed for unstructured information.

“At peak times, Everpure supports up to 300,000 IOPS without any performance degradation,” says Lincoln Silva, product owner for Linux and on-prem storage at Mars. From his perspective, another point speaks favorably of the new platform in that he estimates his team saves approximately three months of planning time thanks to the Evergreen subscription model. This is because the vendor provides regular updates for the storage platform’s hardware and software. As a result, Mars’ IT professionals can focus on more critical tasks. 

Basis for hybrid cloud strategy

Mars also works with choice vendors to implement its approach to cloud. Dedicated local storage capabilities, for instance, are being integrated into Microsoft Azure cloud workloads, which simplifies restore processes and increases resilience.

Snapshots from the local environment can be replicated to the cloud, too. Recovery point objectives (RPEs) of four to 24 hours are available, depending on system priority. “Our success is also the success of our partners,” Batista says. “We embrace a spirit of reciprocity to get the most out of our collaboration.”

The hybrid cloud allows Mars to run VMware workloads and extend its IT infrastructure to the cloud as needed. And the company aims to expand its use of cloud-native applications via Microsoft Azure at a lower cost.

“We’re seeing a data reduction ratio of 18 to one. That’s nine times the expected compression rate,” Batista adds. “This puts us on track to save up to 50% on cloud storage costs. We can now work more efficiently and make better decisions thanks to intelligent solutions and automation.”

Fewer racks and lower power consumption

By consolidating on the flash platform, Mars has also reduced the space requirements and power consumption of its data centers so they only use one sixth of the power, and the number of racks has decreased significantly.

“We’re shaping a sustainable future by changing the way we work,” says Batista. “The decisions we make today will impact the world we leave behind, and Everpure aligns with our commitment to thinking in generations, not just business quarters.”

A fraud model looks at an insurance claim and returns a score of 0.23: low risk. A SHAP explanation lays out exactly why: no prior claims, a modest claim value, an unremarkable claimant profile. A human adjuster reads the explanation, agrees with it and signs off. Every box that explainable AI asks us to check has been checked. The claim is settled and closed.

By any current standard for responsible AI, this is exactly what a good outcome looks like.

Two months later, an audit

Two months after the claim closes, it’s pulled into a routine quarterly audit sample (no suspicion attached, just standard sampling). The auditor isn’t reviewing the model’s reasoning. She’s asking a narrower question: can this decision be reconstructed, independently, from its own evidence trail?

She doesn’t start with the fraud score. She starts with the paperwork.

Her first question: what established the date of the incident? She pulls the document meant to corroborate it and checks something the claim file itself never surfaces, the document’s own creation metadata. It was generated two days after the claim was filed. She asks the obvious follow-up: did anyone check this before the claim reached the model? Nobody had. Document provenance was never captured anywhere in the intake pipeline as a fact to be verified; the claim reached the model looking exactly like every clean claim before it.

Knowledge gap: This doesn’t establish that the claim is fraudulent. A prior version of the document may exist and say the same thing, in which case the late timestamp is a non-event. What it establishes is that the system has no way to answer that question either way. Document lineage was never captured, so there’s no way to know whether an earlier version existed, or whether it agreed with this one.

Her second question: when was the insured asset last valued? The figure the model used is 22 months old relative to the date of loss. Nothing about it is wrong or falsified; it’s simply the most recent valuation on file, resolved to the wrong point in time and handed to the model as though it were current.

Knowledge gap: This doesn’t establish that the valuation is wrong. The asset’s value may not have moved materially in 22 months, in which case the old figure and a fresh one would say the same thing. What it establishes is that the system has no process for knowing which is true. There’s no trigger for re-valuation and no record of whether the figure was ever checked against current conditions.

Her third question: as of what date was the claimant’s risk profile evaluated? The “current risk” features the model consumed were pulled at query time (the day the claim happened to be scored) rather than resolved back to the date of loss. She asks whether that was a deliberate design choice. Nobody can tell her. There’s no rule on record, no document, no named owner for the decision “risk features should reflect the date of loss, not the day the system happens to be queried.” It’s simply how the pipeline was built.

Policy version gap: This doesn’t establish that the score would have come out differently under incident-time data. The claimant’s risk profile may not have changed since the date of loss, in which case query-time and incident-time features would produce the same result. What it establishes is that nobody decided which point in time should govern the decision, so there’s no way to know whether the two agree, only that nobody checked.

Three questions. Three gaps. Not one of them touches the model, and not one of them would have shown up in a model audit, but all of them question the explainability of the decision taken.

The blind spot in explainability

This is the uncomfortable pattern showing up across banking, insurance, healthcare and government AI deployments: the model is explainable, the explanation is faithful and the decision is still wrong. It’s worth being precise about why, because the instinct is to reach for a better interpretability technique, or a smarter document-reading agent, and neither fixes this class of failure.

Every mainstream explainability approach shares one architectural trait, whether it’s SHAP, LIME, DARPA’s XAI program, the EU AI Act’s Article 13 disclosures, or IBM’s AI FactSheets: they all operate after the model has reasoned. They take the inputs as given, assumed correct and explain what the model did with them. That’s legitimate and valuable. It’s also, structurally, a blind spot for the class of failure the audit just surfaced.

An enterprise decision isn’t just a model output. It’s a reasoning process running over a knowledge base and a policy set, both of which have to be current, correctly sourced and resolved to the right moment in time before the model ever sees them. A model can reason perfectly over compromised inputs and produce a perfectly explainable, perfectly wrong decision. No amount of post-hoc transparency catches that, because post-hoc transparency was never looking at the inputs; it was only looking at what the model did with them.

Put precisely: a decision is explainable only when its reasoning, its knowledge and its policy are all explainable at the same time. Explainable AI delivers exactly one of those three: explainable reasoning. It can be flawless, and the decision can still be unexplainable overall, because an unverifiable knowledge input or a misapplied policy breaks the chain regardless of how good the reasoning layer is. That’s the precise sense in which explainable AI is necessary but not sufficient. Sufficiency is a property of the whole decision (knowledge, policy and reasoning together), not of any one component, however mature that component’s tooling has become.

Where the audit’s three questions actually point

Map the auditor’s three findings back onto that structure and the pattern sharpens.

Her first and second questions (the backdated document, the stale valuation) are both knowledge failures. Neither is a data-entry error; both are facts that were never traceable to an authoritative source, versioned and resolved to the right point in time before reaching the model.

Her third question (features pulled at query time rather than incident time) is a policy failure. No rule existed to say which moment in time the decision should be evaluated against, so the system defaulted to whatever was easiest to compute: now.

Governing the inputs, not just the output

The fix isn’t a better explanation of the model, and it isn’t a more sophisticated agent reading the documents more carefully. It’s governance that sits before the model, a framework I call Explainable Decision Systems (EDS), built on three pillars plus a temporal layer that ties them together.

This tracks a broader shift already visible across enterprise AI deployments: the stacks that win aren’t the ones that ship fastest, but the ones that get data and decisions governed before anything downstream runs.

• Explainable Knowledge (EK). Every fact fed into a decision has to be traceable to an authoritative source, versioned and (critically) resolved to the valid time of the event being decided, not the time someone happened to query the system or the date typed into a form field. An asset valuation from 22 months ago isn’t wrong data; it’s data resolved to the wrong point in time.
• Explainable Policy (EP). The policy version that governs a decision is the one that was active when the event occurred, not the one currently in the system. A claim from November has to be judged against the policy wording in force in November (exclusion schedule and all), retrieved and locked before reasoning starts, not looked up after the fact.
• Explainable Reasoning (ER). This is where existing XAI actually earns its keep, but EDS splits it into two accountable parts: AI reasoning (EAI), which needs interpretability techniques like SHAP, and Human Decision (HD) (overrides, approvals, escalations), which needs an identified actor, a timestamp and a documented justification. EDS doesn’t claim human judgment is formally explainable in the way a model’s math is; it just insists that it’s attributable and auditable.

The layer that binds all three together is bi-temporal governance: knowledge and policy have to resolve to the real-world moment the decision concerns, not the moment the system happens to be queried. In EDS, this resolution (called a temporal witness) isn’t a report generated after the decision, the way the audit in this piece was. It’s a gate the decision has to pass before reasoning is allowed to start. Had the witness been in place, the claim in this scenario would never have reached the model at all; it would have been flagged as a governance exception the moment the document’s creation timestamp failed to match its claimed valid time.

Why no AI agent can catch the hospital record

This is worth slowing down on, because it’s the clearest illustration of why EK has to be its own dimension, entirely separate from model explainability or agentic sophistication.

Every clinical or administrative record system has two different dates living in it. There’s the stated field value (“date of incident,” “date of visit”), which is just a form entry: whatever a person typed, told a clinician or was asked to record. And there’s the system-of-record creation timestamp: the moment the backend actually inserted that row, logged that transaction or wrote that file. That timestamp sits in the origin system’s audit trail, not on the document itself.

A claimant doesn’t need to forge anything to exploit the gap between those two dates. They need only have a record created on 30 November whose stated incident-date field reads “15 November.” The document is completely genuine. Nothing about it is altered, and no forensic check (pixel analysis, formatting consistency, metadata inspection of the file itself) will find anything wrong, because there is nothing wrong with the document. The lie isn’t in the artifact. It’s in the mismatch between what the artifact claims and when an entirely separate system actually created it.

Hand that document to an AI agent, no matter how advanced, and ask it to check for fraud. It will read the stated date, assess whether the narrative is internally consistent, run every forensic technique available and come back clean; it’s answering the wrong question. It’s checking whether the document is coherent and unaltered. The question that actually matters is whether the document’s claimed date matches the creation-time metadata logged by the system that produced it. That answer doesn’t live in the document. It lives in a separate system, under separate access control and requires a deliberate governance step to retrieve and cross-reference. No amount of model capability substitutes for that step, because the information the model would need simply isn’t present in what it’s being asked to read.

This is exactly the gap enterprise surveys keep flagging. In Grant Thornton’s 2026 AI Impact Survey of nearly 1,000 senior business leaders, 78% said they lacked confidence their organization could pass an independent AI governance audit within ninety days, precisely because most are scaling AI they cannot explain, measure or defend. That’s the downstream version of the same problem this claim ran into: explainability treated as a reporting exercise rather than a precondition the case has to clear before it ever reaches the model.

That is precisely what Explainable Knowledge formalizes: a requirement that every input be provenance-linked to its origin system, with independently retrieved creation-time metadata checked against the claimed valid time; not a soft appeal to “make sure your data is good,” but a specific, checkable technical control. Under EDS, if that cross-reference can’t be performed, the claim doesn’t proceed to the fraud model. It’s blocked as a governance exception, regardless of how convincing the document looks or how confidently any reader, human or AI, assesses it.

These aren’t academic distinctions, either. In the UK and international context, failures like these map to live regulatory obligations: FCA claims-handling rules on treating customers fairly, Federal Reserve SR 11-7 guidance on model risk management, and the EU AI Act’s Article 9 risk-management requirements for high-risk systems. Regulators are already asking questions that XAI, and the agents built on top of it, cannot answer.

What this means for the people building these systems

For enterprise architects, the practical shift is this: stop treating knowledge and policy governance as documentation you produce after a model runs (or worse, as something an audit uncovers two months later) and start treating it as a gate the model has to pass through before it runs. This is the same direction major risk-consulting practices are now pushing clients toward: governance embedded as a control layer across the AI lifecycle, rather than a compliance sign-off at the end of it. Concretely, that means:

• Bi-temporal data stores for anything that feeds a decision, so “valid at the time of the event” is a queryable property, not an assumption.
• Provenance links from every document or claim to its origin system’s own creation-time metadata, captured independently of the stated field values on the document (not derived from them).
• Policy version registries with effective and expiry dates, so the version applied is probably the one that was active when the event occurred.
• A pre-inference middleware layer that checks provenance, versioning and temporal validity before forwarding anything to the model, and blocks or flags the case if it can’t.
• Explicit, attributable records for human overrides: who, when, under what authority and why.

None of this replaces SHAP, LIME or your existing model-risk documentation, and it isn’t a call for a smarter document-reading agent either. It sits in front of both, deciding whether they’re even looking at trustworthy, independently verified inputs.

The bar has moved

Explainability was always going to be necessary. Regulators demand it, customers expect it and no serious enterprise AI deployment should ship without it. But “the model is explainable” and “the decision is governable” have quietly become two different claims, and treating them as one is how a technically pristine 0.23 fraud score sails through, gets closed and sits untouched for two months until an auditor asks the one question explainability was never built to answer: not what did the model do, but what was it allowed to look at, and when, and against what independent record?

Architectures that can’t answer that question will keep producing decisions that are perfectly explainable and quietly wrong, right up until the audit finds them.

Snowflake on Tuesday unveiled a dynamic model routing capability for its Cortex AI Gateway, designed to help enterprises reduce AI spending by automatically directing workloads to the most appropriate model based on cost, performance, and latency requirements.

The new capability, which is expected to be in private preview soon, will allow enterprises to define which models they approve for use and the tradeoffs they want the system to prioritize, such as cost, performance, and latency, for an individual application or workload, CEO Sridhar Ramaswamy wrote in a blog post.

Once those policies are defined, Cortex AI Gateway then evaluates each task against those policies and real-world model performance and cost data to determine which model should handle the workload in the most efficient manner, Ramaswamy added.

Further, the CEO pointed out that Cortex AI Gateway also creates a feedback loop by evaluating the quality of a model’s output after it completes a task, which allows the routing system to adjust its decisions as model capabilities, pricing, and performance change, with the aim of continuously optimizing the balance between quality, cost, and latency.

According to Snowflake’s internal benchmarks, the new capability can improve token efficiency compared with using a frontier model for every task.

In one internal test, agents using dynamic routing built a dbt pipeline with up to three times greater token efficiency than a frontier-model-only approach while maintaining the same quality, the company said in a statement. In another test, engineering teams completed the same number of pull requests with 25% greater token efficiency, it added.

Routing could lower AI costs, but adds governance complexity

The new capability will have the largest impact on high-volume, low-complexity workloads where many requests do not require frontier-model reasoning, like classification, extraction, summarization, routine data engineering, and repetitive agent steps, said Stephanie Walter, practice lead of AI stack at HyperFRAME Research. “Routing those requests to smaller models could materially reduce inference costs while preserving expensive models for genuinely difficult tasks,” said Stephanie Walter, practice lead of AI stack at HyperFRAME Research.

Agentic applications could specifically benefit from dynamic model routing, said Advait Patel, senior site reliability engineer (SRE) at Broadcom.

“An agent loop spends most of its steps on plumbing, reading a file, parsing a result, and picking the next call. Very few of those need deep reasoning, but they all hit the same model today. When I pulled telemetry on our own coding agent usage, the spend wasn’t in the hard problems at all. It was the volume of ordinary calls,” Patel said.

However, Walter cautioned that enterprises should not treat token efficiency as the same as cost savings, especially in agentic applications, despite Snowflake’s “promising” internal benchmarks.

“Enterprises must also measure retries, failed tasks, latency, human correction, and the cost of operating the routing layer,” Walter noted.

More so because routing, despite removing the repetitive model-selection work from individual applications, shifts operational complexity into the orchestration and governance layer and doesn’t eliminate it completely, according to Phil Fersht, CEO of HFS Research.

“Enterprises would still need to determine which models are approved, establish routing policies, monitor quality, control costs, and manage security and compliance,” Fersht said, adding that if policies are not defined well, the system can make a poor decision, which at scale, could either produce inconsistent outcomes or unnecessary costs.

That shift of operational complexity into the governance layer, according to Manoj Chandra Jha, principal analyst at Nord-IQ Research, could be challenging for most enterprises: “Short-term complexity can rise, since most teams lack the governance and monitoring maturity routing now requires.”

Routing also adds a new variable for developers to track

The governance burden also has implications for developers, who will have to account for routing decisions as another variable when building and troubleshooting applications.

“Dynamic routing makes visibility essential. If different requests go to different models, developers need to know which model handled a request, why it was selected, and whether the result met expected quality and performance levels,” said Robert Kramer, managing partner at KramerERP.

“When something breaks, they need to determine quickly whether the fault came from the application, the model, or the routing decision. That third failure mode is new, and it is the one teams are least equipped to diagnose today,” Kramer added.

Snowflake, however, is looking to address concerns around changes in routing decisions driven by model pricing changes.

It would integrate Cortex AI Gateway with its AI coding assistant CoCo’s existing role-based access and tagging framework, which will allow enterprise administrators to set default models, attribute AI usage to teams or cost centers, establish per-user quotas, and receive alerts as consumption approaches predefined limits.

These controls could help enterprises maintain visibility into how routing decisions affect AI spending as models, pricing, and workloads change, the company said.

Model routing becomes a new battleground in the AI stack

That enterprise focus on controlling AI spending via model selection and routing hasn’t escaped the attention of other vendors.

Nvidia has been expanding its efforts around model routing, while Cloudflare and OpenRouter have also emerged as players in the space, reflecting growing interest in helping enterprises route workloads across multiple models based on factors such as cost, performance, and capability.

The shift, according to Fersht, is partly a consequence of the growing number of models available to enterprises and the differences between them in cost, performance, latency, and capabilities.

That shifts the strategic value towards the layer that decides which model to use and orchestrates it across enterprise workflows, Fersht noted.

However, Patel cautioned that enterprises should evaluate model routers based on the level of control and transparency they provide.

Let’s say one of your teams builds an AI agent that actually works. Word gets around, and seemingly overnight, there are twenty more built by people in finance, legal, HR, and support. Most of them are useful, but when someone suddenly gets a chatbot response showing customer data they shouldn’t have access to, reality hits.

The real test of enterprise AI readiness isn’t at all whether your coworkers can confidently work with AI. Instead, it has everything to do with governance and security, global, cross-cutting policy, and privacy. Many enterprises are underprepared to face these issues: a survey from Databricks and the Economist found that “40% of respondents believed their organization’s AI governance program is insufficient.” And Microsoft’s Data Security Index reports that “only 47% of organizations across industries report they are implementing specific GenAI security controls.”

Having worked with many CIOs to develop strategies to govern their AI systems, this piece is a deep dive into the specifics of what works and what doesn’t. Keeping employees, customers and your entire organization safe must be your top priority before you even start rolling agents out.

8 layers of governance every enterprise needs

It’s no doubt that the enthusiasm for AI is real, but so is the list of questions that bubble up a month later: Who’s allowed to publish an agent to the rest of the company? How do we track versions, and can we roll one back? Can we require SSO on every agent? What data does this have access to, and does it respect the permissions on those documents? Where do the logs live, and how quickly can we see them?

I think of enterprise AI governance as a set of layers, each answering one of the questions above. You can build them incrementally, but ideally all eight are in place before you have more agents than you can list off from memory.

1. Roles and groups. Whatever platform you choose, ensure that it offers granular role-based access control. At the level of abstraction higher, map groups to real departments (Legal, HR, Capture Team) and assign those groups to their own. Keep the admin count small enough to list out loud. Though this is the coarsest measure, it still bears a big responsibility down the line — according to Fortune Business Insights, “RBAC solutions help reduce unauthorized access incidents by nearly 30%, enhancing data security.”
2. Scope. It’s extremely helpful to build out private folders with explicit allowlists, so a project, agent, or workflow isn’t merely locked to outsiders but invisible to them. Agents with access to sensitive customer data shouldn’t advertise their own existence.
3. Change control. Those who are building AI agents should be able to place locks on so that only the owner can edit it, with admin override. Every change should land in a version history with a diff and a commit message, and rolling back should take one click so that you know exactly what was edited if an agent stops performing. According to Google’s DORA State of DevOps research, teams with strong version control and rollback practices recover from failed changes in under an hour, versus a week or more for teams without them.
4. Publication. When a builder finalizes an agent and wants to release it to the rest of their team, depending on the use case, they should consider adding one-click SSO, a password option for external collaborators, and restrictions on which origins and which users can reach it. OWASP’s 2025 Top 10 keeps broken access control at #1, observing that every application they tested had some form of broken access control.
5. Org-wide policy. This is the layer CIOs underuse. Require SSO on all interfaces rather than hoping. Restrict who can publish, so shipping to the company is an admin action. Create approval workflows, where a builder requests review and an admin does the publishing (similar to traditional SDLC best practices around pull requests). Allow or deny specific tools and connectors across the enterprise, so nobody connects a data source that procurement hasn’t approved yet. Lastly, vary policy by group, so only Legal can reach the legal agents.
6. Data access. Obsidian Security’s 2025 AI Agent Security Landscape report found that 90% of deployed AI agents are over-permissioned relative to the actual scope of their assigned tasks, and separately estimates that agents are typically granted about 10 times more access than their workflows need. That’s why connections and knowledge bases deserve their own permission model. Credentials should be encrypted and owned by whoever created the connection to a given tool, app, or data lake, with sharing as an explicit decision. Here’s where it gets tricky: if a builder connects SharePoint with their own account, the agent sees what that person can see. Connect through a service account and the agent inherits the service account’s entire scope, which is usually far wider than anyone intended. The safer pattern is to check end-user access at runtime, so the person asking has to authenticate before retrieval happens and only gets what they’re already entitled to.
7. Observability. It’s imperative to have exportable records of who ran what, when, against which model, with token counts and latency, plus per-step traces showing inputs, retrieved chunks and outputs. Give builders the ability to mask or disable logging where the data is too sensitive to retain. Then push those records out of the platform on a schedule so security’s pipeline consumes them automatically.
8. Authentication. SSO over passwords, MFA through whatever authenticator your org already runs, and defaulting new users into the lowest-privilege role until an admin promotes them. According to Microsoft, MFA can block more than 99.2% of account compromise attacks. And SSO gives you the email address of everyone using your interfaces, which makes for an additional layer of security.

None of these are new inventions; they’re the same controls you already apply to internal software. But most organizations haven’t extended them to AI that both talks to customers and writes to the CRM.

Don’t forget about deployment

After governance, the other half of enterprise AI readiness is deployment. Regardless of what platform you choose, there are four realistic postures:

1. Multi-tenant SaaS, where you share infrastructure with others and rely on tenant isolation at the database layer.
2. Dedicated single-tenant, where the vendor operates a VPC that only you occupy.
3. Bring-your-own-cloud, where the software runs inside your own cloud account and your data never leaves it.
4. On-premise, where you own the infrastructure, the control plane and the data plane outright.

It’s well known that multi-tenant is available as soon as possible and updates itself continuously. Dedicated takes a couple of weeks to stand up and updates on a schedule the vendor applies. Bring-your-own-cloud runs two to four weeks and splits responsibility, with the vendor managing the application through a scoped cross-account role while your team owns networking and IAM. On-premise starts at a month or more, and after that your team applies every release itself.

My honest read? Most organizations are well served by multi-tenant, and choosing it doesn’t compromise on security or privacy. Bring-your-own-cloud and on-premise make sense when you have a data sovereignty requirement and a mature internal platform team, but they result in manual updates and slower time to value. There’s no right or wrong answer here — but it’s helpful for CIOs to understand the trade-offs between each of these common deployment methods so they can choose what fits best for their enterprise.

A readiness test you can run this week

So, are you ready for enterprise AI? Here’s a quick self-diagnostic that I like to run with CIOs. Pick your three highest-privilege AI agents or workflows in production and try to list these attributes yourself:

Who owns each one by name. What changed in it most recently, and who approved that change. Which connectors and knowledge bases it can reach, and whose permissions those reads run under. Whether accessing it requires SSO. Where its logs are, and how long they’re retained. What happens to it if the model version it depends on is deprecated next quarter.

If most of those answers are “I’d have to ask around,” you’re not ready to scale, and that’s fine. All it means is that you have a week of policy work ahead — but you’ll thank yourself later for figuring the tough stuff out first.

For many organizations, AI is proving easy to pilot but difficult to scale. Pilots often look inexpensive because they run on narrow datasets with a handful of users, explains Ben Schein, chief AI and analytics officer at cloud software company Domo. “But the cost lives in deployment, the moment you connect that capability to real workflows and the systems of record behind them,” he says. “That’s when the real bill appears.” So CIOs must always budget for the gap between when it works in a demo and when it produces governed and durable value.

Organizations can easily get caught out because they run pilots as a technology experiment instead of a business initiative, he adds. “The interesting question is never whether AI can do the thing in a demo,” he says. “It’s whether it should run in this process, and whether it survives contact with production.”

There’s also a lot of pressure on IT teams to be doing something with AI simply because everyone else is, says Naren Gangavarapu, chief transformation and AI officer at Australian Cruise Group.

He calls it AI theater because there’s a big show around AI even though there aren’t that many successful applications of the technology in production environments.

AI costs out of control

According to John D’Emic, CTO at AI observability platform Revenium, one of the big traps when running a pilot is failing to anticipate how quickly consumption can spiral as adoption grows. “As an example from our own engineering org, back in May, a developer opened an AI coding session on his laptop, and it stayed open for four days,” he says. “By the time it closed, it had run 4,819 calls and cost us $3,762. We didn’t budget for this, and no alert fired. But that one session cost more than a lot of teams spend on their entire monthly AI tooling.”

While this showcases how a developer can make a costly error, Dmitriy Anderson, CIO and digital and social commerce leader at home and gardening retailer Leroy Merlin South Africa, believes the pilot trap frequently happens when employees with little or no software development experience vibe code applications. “It doesn’t matter if you can create something in 15 or 20 minutes if the result is AI slop,” he says. “Think dirty code, no consideration for safety, security, and possible data exposure.” In most cases, these pilots are developed with one of the frontier apps, and someone probably used their personal AI subscription, so the costs are negligible, he adds. But if you have a company of several thousand people, and you now want to roll this tool out more broadly, that’s where costs can get out of control.

This scenario is only exacerbated by the introduction of agentic AI, D’Emic adds. “Agents don’t spend money at human speed,” he says. “In the old cloud days, an engineer could spin up infrastructure in minutes and finance might not see the bill for a month, which was painful but recoverable. Agents, though, call APIs around the clock without waiting on anyone’s approval.”

Mind the trap

While cost is a big factor in the AI pilot trap, it should be treated as a symptom of a bigger problem, says Schein. The underlying issue is governance and observability. “An autonomous workflow can fan out into more queries, API calls, and model invocations than anyone scoped,” he says. “So if you can’t see what it’s doing, and spend compounds quietly, you only find out once the invoice arrives.”

In a recent LinkedIn post, Anderson outlined how in just six weeks he built a platform for a fraction of the sticker cost using three AI models orchestrated together. The traditional estimate to build the same tool would have required 2,472 engineering hours from a team, and was expected to take around nine months. “I went through the proper engineering steps and planning, and made sure the application passed a series of cybersecurity frameworks,” he says. “The purpose of this exercise was to showcase that AI can still speed up the process even if you take the time to work through the necessary steps. You can build with AI rigorously and securely.”

So to turn AI experiments into enterprise value, every AI interaction must be attributable: who triggered it, against what data, on which model, and at what cost, Schein says. For each workload, be sure to ask how often it runs, which model tier the job actually needs, and what triggers it, human or automatic. “A frontier model on an automatic trigger and a small model called on demand are completely different cost curves for the same task,” Schein adds.

For Anderson, it’s helpful to use AI to highlight potential gaps, assumptions, or blind spots in your ideas early on. “When you start building an idea, ask the agent to interview you,” he says. “It will go through every phase and ask questions about the important facets of the process, from scalability and budget to deployment options. You can even make AI write a prompt for itself, because it knows its capabilities and quirks better than you ever will. It’s called meta prompting.”

Anil Inamdar, global head of data services for the Instaclustr BU at NetApp, suggests CIOs cost out the whole program, not just the demo. “Generally, the model itself is the cheapest part of the program,” he says. For him, it’s important to have security and governance people in the scoping meeting, not the launch meeting.

He believes the pilot trap is also, or perhaps mostly, a sequencing trap. “A lot of teams are wired to build first and ask permission later, only to discover months down the line they can’t pass a security review or data privacy audit without a painful and costly rebuild. It’s also valuable to define what failure looks like before you define success.

“Pilots tend to die because of no result, which isn’t the same as a bad result,” Inamdar says. “Emphasize to the deployment team on day one that if a target result by a certain month isn’t seen, we shut it down. Otherwise, you’re funding a zombie pilot because everyone’s invested and no one wants to be the one to call it out.”

For most of the IT era, technology leaders have treated information as an asset. It is something to be stored, secured, processed and monetized. Organizations generated vast amounts of data, and technology processed that wealth and made it useful.

Then AI arrived, and the framing broke.

AI changes the relationship with information. It interprets it, compresses patterns within it, and generates new language from those patterns. It does so with such fluency that it converts accumulated human expression into outputs that are coherent, meaningful, and often persuasive in ways that are difficult to examine or trace. The arrival of AI is a deeper shift in how organizations produce language, remember knowledge, establish authenticity and decide what deserves trust.

Generally, the discussion about AI’s impact on language, memory and meaning gets swept into the social or philosophical bucket too quickly. But these are not just philosophical questions. They are enterprise questions, because they directly affect knowledge management, brand trust, customer engagement, regulatory exposure, institutional memory, decision-making and employee learning. CIOs who brush this dimension aside will govern AI infrastructure competently and miss its deeper institutional consequences entirely.

Language is humanity’s most powerful mechanism for collective learning. We speak not only about what is present, but about what is absent, imagined, remembered, feared and hoped for. That capacity is what allowed us to preserve experience, transmit it across generations and convert it into culture, knowledge, law, philosophy, science and enterprise memory.

CIOs must govern meaning, not just data

This is why large language models are consequential in a way that earlier software was not. LLMs train on enormous volumes of text. They learn patterns, structures, associations, idioms and contextual relationships within language. By doing this, they create a dynamic simulation of human language itself. Unlike traditional software that executes defined instructions, LLMs operate within encoded human expression. They observe documents, reports, messages and public knowledge, and they generate responses that sound almost like understanding.

Almost. And that almost is where the situation gets hairy.

The power is real. AI can widen access to sophisticated knowledge. It can digest complexity, translate across domains and reveal patterns invisible to a single analyst. Inside an organization, the impact can be significant: a junior employee can consume decades of internal documents in minutes; a manager can synthesise thousands of customer interactions before a single meeting; a compliance team can identify patterns across audit data that would take months by hand. Knowledge work has a new definition.

But it is precisely this power that creates the crisis of synthetic culture.

While writing “The AI Codex: Power, Ethics and the Human Future in the Age of Intelligent Machines,” I chose to leave the engineering largely aside and follow the subtler human consequences that are easier to ignore.

Synthetic culture is one of those consequences, and it should concern CIOs immensely.

Culture is not office decoration, value posters or elaborate town halls. Culture is how an organization thinks, decides, explains, rewards and justifies its actions. It lives not only in documents but in stories, habits, unwritten rules, leadership behaviours, institutional scars and the memory of battles won or lost. It is what people have lived through and passed on. Your document management system and knowledge management system are not the custodian of your culture. The people around you are.

AI preserves the digital residue of culture. It cannot preserve the lived meaning behind it. That distinction matters enormously.

Consider what happens in practice. If AI generates a memo in the style of a CEO, does it carry the judgment of that leader, or does it merely carry the pattern of her language? When generative AI summarises a complex customer dispute, does it carry the flavour of the relational history, or does it just compress text? When it drafts a new policy, does it reflect institutional accountability, or does it mimic the average structure of similar policies? When AI produces a cultural narrative for employees, is it transmitting memory or manufacturing a convincing imitation of the same?

These are not rhetorical questions. They describe a genuine ambiguity that is already embedded in enterprise operations.

AI takes what is human, learns from it, and produces something that comes close to human expression. But proximity is not identity. AI can sound human without being human. It can produce language without emotion. It can generate meaningful output without moral agency. It can create efficiency without bearing responsibility for the consequences.

And this is where authenticity begins to fracture.

There was, until recently, something like a one-to-one relationship between content and its source. A document had an author. A speech had a speaker. A photograph recorded an event. A policy had an accountable authority behind it. These relationships were not perfect, but they were there, and they allowed organizations and societies to trace meaning back to a human being who could be questioned, challenged or held responsible.

AI can weaken or obscure that link. It can produce synthetic truths that spread rapidly, appear credible and influence decisions without being anchored to any lived reality. Deepfakes are the obvious example. But the real danger is subtler and already present inside organizations: the synthetic summary, the automated narrative, the AI-generated recommendation that nobody can fully trace. A synthetic truth is not a lie. But it can be more dangerous than one, because it poses as a plausible construction with no real thing behind it.

The new enterprise risk: synthetic truth

For CIOs, this is a new category of risk for which many organizations have no mature controls. The question is no longer only whether organizational data is secure. The question is also whether organizational meaning is secure. Can employees distinguish between original knowledge and synthetic synthesis? Can customers trust that they are interacting with accountable institutional communications, or with an automated approximation? Can leadership trace the lineage of a recommendation or a decision?

These are operational questions. The failure mode is not just a data breach but more of a memory breach.

When AI systems generate from enterprise knowledge, they shape what the organization remembers and how it remembers it.

AI is changing what organizations remember

The consequences follow from the quality of what goes in. If the underlying data reflects poor documentation, AI amplifies that poverty. If institutional knowledge records only dominant voices, dissenting experience is subdued and eventually forgotten. If past mistakes have been quietly buried, AI may reproduce the organization’s confidence without preserving its caution. The organization becomes more efficient at forgetting what it should have remembered.

CIOs also need to rethink what knowledge management means. For years, KM was treated as a repository problem: store, tag, search, retrieve. AI retrieves knowledge and generates new formulations from it. Each time a model runs, it can produce a slightly different answer. Knowledge becomes fluid and unstable. A document may be old, but it is static and accountable. An AI-generated answer may be elegant but untraceable. Both can exist in the same organization, and most people cannot tell them apart.

Those who complained about information overload in the internet age have no idea about the blizzard the AI age is about to bring. AI can identify patterns invisible to humans, but it can also manufacture alternative truths that are difficult to challenge. It can reduce noise, but it can also generate noise at industrial scale.

This is why AI governance cannot be a downstream compliance exercise. It must be a first-principle commitment. Not just checking whether the model works but asking what kind of institutional memory the model is helping to create. Where did the information come from? Who approved its use? What has been included, and more importantly, what has been excluded? Where does the audit trail begin? Where does human judgment remain mandatory and non-negotiable? These questions belong on the Post-it notes sitting on every CIO’s desk as the AI agenda gathers speed.

The search for truth cannot be a human pursuit alone in this environment, but it cannot be outsourced to machines either. It must be a governed exercise, with explicit architecture and explicit accountability.

The crisis of synthetic culture will not announce itself dramatically. It will arrive quietly, in the form of convenience: automated memos, summarised knowledge, AI-generated reports that nobody has the time or the inclination to question. Machines will not become human. But organizations will gradually grow comfortable accepting machine-generated statistical approximations as human judgment, institutional memory or cultural truth. That comfort is the real risk.

The CIO now carries an institutional mandate: scale intelligence without surrendering trust. Productivity matters and must be pursued. But the real challenge is building trust while scaling intelligence. This means ensuring AI output is traceable, sources are visible, human authority is explicit and institutional memory is always protected from synthetic distortion.

CIOs have to become not just custodians of organizational systems, but of organizational memory. In the new Badlands of the AI age, the CIO is the morally upright gunslinger. Organizational memory is the line she must defend.

Speed-to-market dominates enterprise AI priorities in 2026. Beyond upfront resourcing costs of prioritizing speed, organizations face a more insidious risk:  the compounding cost of ungoverned AI.

In November 2019, a tech entrepreneur signing up for the newly launched Apple Card publicly complained that he received a credit limit 20 times higher than his wife’s, despite joint tax filings and her higher credit score. Steve Wozniak had a similar experience: a limit 10 times higher than his wife’s. Retrospectively, these revelations were the canary in the coal mine.

In the years that followed, Apple and its credit partner, Goldman Sachs, drew legal and regulatory scrutiny over gender bias and consumer protection issues. The CFPB’s 2024 order documented that Apple had forced Goldman Sachs to accelerate deployment by attaching a $25 million penalty to every 90-day launch delay. 

Prioritizing launch speed — ship first, address problems later — over building a functioning disputes process created years of cascading failures. Apple and Goldman Sachs were ordered to pay $89 million in penalties and consumer redress. Prohibited from launching another credit card until it could demonstrate a credible plan to comply with the law, Goldman Sachs lost money on Apple Card for years and ultimately sold its consumer credit line. The legal and compliance penalties were only a fraction of the total costs.

If a deterministic underwriting system can create liability at this scale, the risks posed by agentic AI are substantially greater:  autonomous systems can multiply and scale errors, quietly and invisibly, at machine speed.

The accelerated cost of ungoverned speed

In software engineering, shortcuts taken to ship are called “technical debt.” When teams sacrifice robust architecture, processes or solutions to reach deadlines, interest accrues in the codebase as brittle integrations and expensive refactoring. When it comes to agentic AI, technical debt accrues faster. AI portfolio returns are estimated to drop by 18% to 29% when technical debt is ignored.

Similar to technical debt, AI governance debt accumulates when speed-to-market routinely takes precedence. Unlike technical debt, which can wait silently in a repository without immediate consequence, governance debt is neither patient nor pausable. Deployed without clear authorizations, boundaries, or constraints, AI systems scale defects across an enterprise at machine speed.

The agentic multiplier: Scaling decisions and outcomes

When a standard LLM produces an output, a person receives it and decides what to do with it. That pause is a crucial point of control:  a “human gate” stands between the generative AI model and the consequence. AI agents operate in continuous, (semi-)autonomous loops, without human gate friction. With agents, a model error can cascade downstream unimpeded through enterprise systems. Multi-agent systems inadequately governed have error rates of nearly 20%. Generative AI scales outputs, and agentic AI scales outcomes. Put another way, agentic AI scales outcome-producing actions, and every autonomous action carries a decision that a human used to make. 

AI governance is often mischaracterized as “putting the brakes on” speed-to-market. In practice, omitting it causes “velocity decay.” While 54% of leaders consider governance to be an obstacle to scaling, its absence or inadequacy creates sociotechnical bottlenecks that ultimately stall deployment and operations. To prevent both velocity decay and governance debt, governance must “shift left” to be architected throughout the AI system lifecycle.

Accountability reduces the debt

Technical accountability within an autonomous system cannot exist in a vacuum; it requires both structural and cultural accountability throughout an organization.

Structural accountability

Structural accountability assigns formal ownership over agent actions to specific human decision-makers. A July 2026 white paper, Safeguards for Agentic Finance at Runtime (SAFR), provides specific case studies from the financial services industry that include and advocate for structured human accountability.

• Individual ownership of agent decisions:  Any decisions made by an agent that are highly consequential require a human owner. Think of a CFO signing her name to financial statements: if auditors or regulators take issue with those documents, she is named as responsible for the numbers. Her successor inherits the same accountability. Consequential decisions, such as a denied insurance claim, a moved financial asset or a rejected job applicant, require a human owner and a process to identify them (detailed below).
• Shared ownership of agent outcomes:  When an autonomous workflow crosses traditional siloes, such as a logistics agent altering supply chain routes based on real-time marketing data, ownership becomes distributed. While externally, an organization remains a single liable entity,  internally, it must assign accountability across organizational boundaries. Mechanisms like a Joint Accountability Agreement (JAA) can facilitate this by explicitly aligning cross-functional decision rights, escalation protocols and continuous monitoring metrics. 

Cultural accountability

Cultural accountability means everyone has a role to play, and everyone owns both the final result and the process to get there. Think of a crew team rowing: everyone rows to win, and everyone is responsible for both individual performance (like erg times) and the team’s overall success (race speed and ranking). High-ownership cultures ensure that accountable behaviors are recognized and rewarded, and visible consequences exist when accountability is lacking. Just as accountability is instilled in a crew team through clear, shared goals and transparency on individual and team effort, metrics and results, employees can be incentivized to own individual and collective actions, outputs and outcomes. Importantly, these accountable behaviors enable accountable AI. If these employees are also empowered to challenge AI, they are equally empowered to own its results. Knowing they will be rewarded or recognized for interceding – not punished – is critical to reduce governance debt and prevent velocity decay.

Human accountability in the agent workflow

The diagram maps structural and cultural human accountability with an agent’s workflow:  monitor context, make decisions, coordinate, complete tasks, and deliver an outcome. When decision-making is consequential, a single human owner must be accountable (Step 2), whereas shared ownership of agent outcomes, across all of the teams and individuals that contributed to the workflow or are impacted by its results (Step 5), is typically necessary. Underpinning all five steps is cultural accountability, which facilitates accountable human behaviors and enables human workers to detect and prevent unaccountable agent behaviors.

Importantly, whether an agent’s decisions (Step 2) require a single named owner depends on the severity of consequences for the enterprise and its key stakeholders. A named owner signs off on the risk criteria and thresholds, and answers for any consequences that occur if risk thresholds are surpassed. The SAFR white paper recommends evaluating five risk criteria: action reversibility, financial materiality, customer impact severity, regulatory sensitivity and novelty or anomaly. Risk thresholds are set pre-deployment, and proposed agent actions (Step 2) are evaluated continuously at runtime. While “above threshold” risks trigger a real-time human-in-the-loop (HITL) review, the executive owner remains ultimately responsible for any resulting repercussions or systemic issues.

Too often, model decision-making oversight is lacking. While agent orchestration and escalations to HITL reviewers are established practices, scrutiny over the risk or consequences of the model’s decisions is the exception, not the rule, even in high-risk industries. As recently as 2023, roughly 40% of hospital systems did not evaluate AI models for accuracy and 56% did not evaluate them for bias. This clear lack of oversight is governance debt with acute liability. Preventing and reducing the debt requires formal structural ownership and a culture that rewards accountability. 

Strategic recommendations

A unique organizational impact of agentic AI is that it collapses traditional operational boundaries, like safety and security, converging performance metrics, systemic risks and multi-jurisdictional compliance requirements over time. To address this convergence of performance and governance issues, we recommend systemic interventions, including that leadership:

• Streamline governance efforts strategically to account for the collapsed operational boundaries and eliminate organizational friction and bottlenecks.
• Structure accountability into roles:  assign names to consequential decisions and set up JAAs to manage shared accountability.
• Shift governance left by embedding oversight early and continuously across the system lifecycle.
• Design governance ex ante, not ex post: consider it a core architectural and infrastructural requirement, rather than post-launch remediation.
• Scale efficiently with policy-as-code: supplement or replace siloed and unnecessary manual oversight with automated computational controls.

Final takeaways

For CIOs, the ultimate mandate is to anchor AI governance directly in day-to-day infrastructure, roles and responsibilities. When autonomous agents scale risks instantly, traditional manual reviews and human-controlled workflows simply cannot keep pace. Oversight must “shift left” and be strategically built into system logic from the start.

Unchecked speed-to-market is an expensive illusion. As Apple Card’s costly errors and losses demonstrate, a rushed launch and a lack of oversight can result in financial penalties, remediation and loss of trust, reputation and business. To avoid the repercussions – including the velocity decay – that accompany governance debt, leaders must proactively architect accountability across the enterprise, the system lifecycle and critical decisions.

Eliminating systemic blind spots doesn’t require perfect foresight; it requires intentional architecture, well-designed collaborative ownership across silos and explicitly named human decision-makers. It’s possible to prevent the compounding liability that falls between AI decision-making and unstructured human accountability by answering two key questions early on:  Who owns which decisions? And how do we clearly incentivize accountability?

Enterprises have built their data systems for humans, but AI agents need a whole new infrastructure.

Separate research from Cloudera and Google/MIT found that, not surprisingly, there is fervent enterprise interest in AI agents, but underlying infrastructure struggles to keep up. Deployments continue to be hampered, sometimes even abandoned, largely due to issues with data access, context, and governance.

“Enterprise adoption of agentic AI is on the cusp of an extraordinary acceleration,” the Google/MIT report noted. “As organizations look to scale agentic AI across the enterprise, they cannot ignore their data systems.”

Resolving data bottlenecks, then, should be an immediate priority.

Projects delayed, inaccessible data

Cloudera’s report, created in partnership with Wakefield Research, describes the need for a “great AI re-architecture.”

Of the 1,500 enterprise architects and cloud infrastructure leads surveyed, a stunning 95% said they had delayed or cancelled AI projects, in some cases six or more, in the past year, due to issues with data governance, compliance, or regulatory issues.

A wide majority also reported that AI integrations have changed their data storage and architecture practices, AI workloads have increased infrastructure costs, and current data architecture requires a “significant overhaul” to meet AI goals.

“Even if enterprises are ready to use AI, many are coming to the realization that the foundational infrastructure it relies on is not,” the report noted.

Similarly, more than half of the 300 IT execs and heads of product, IT, data, and AI responding to the Google/MIT survey said they have paused or delayed the deployment of AI agents to address foundational data issues, such as siloes or lack of context. Further, more than half reported that legacy data systems are preventing them from scaling agentic AI and are having a “significant negative impact” on their AI ROI. High latency has also hampered AI from making decisions at “high velocity.”

“To make good decisions and take effective action, agentic systems need a data foundation that is multimodal, context-aware, and instantly available,” the report noted. “Legacy data systems struggle to meet these demands, ultimately compromising AI trustworthiness.”

Google and MIT identified several reasons that enterprises struggle to deploy AI agents, most notably:

• Entrenched siloes: Data sits in disconnected systems, or is “pocketed away” in different departments with no integration layer; it could also be in outdated formats, old management platforms or logs, or on obsolete IoT devices.
• Difficult-to-access data: “Dark” or unstructured data is contained in different formats like images, video, or PDFs.
• Insufficient access to real-time data: Legacy batch processing architectures can make in-time action a challenge.
• Lack of context: Agents often receive basic metadata rather than enterprise-specific semantics, so they struggle to make relevant connections or suggestions.

“Without this deep understanding, data cannot be highly relevant to specific use cases,” the report noted.

‘Data leaders’ versus ‘data laggards’

This is not to say that enterprises aren’t deploying AI; quite the contrary. Nearly all respondents (98%) to the Google/MIT survey are already using agentic AI or plan to soon. One in 10 is using it widely and nearly three quarters have deployed it in a limited fashion.

The most common uses for AI agents right now are in customer service (routing requests and resolving issues), IT systems management (managing user access and incident response), and IT security (anomaly detection and threat scanning). In the near future, the survey said, enterprises also plan to use AI agents in HR, finance, and supply chains.

“It is easy to understand why companies are eager to put AI agents to work,” the report noted. Agents can supercharge productivity and efficiency so employees can turn to more strategic work.

The enterprises seeing the most success are what Google and MIT refer to as “data leaders,” those that give AI systems access to more than 70% of their data. “Data laggards,” by contrast, share just 30% or less of their data with AI. Interestingly, 100% of data leaders say their agents make “mostly” or “consistently” accurate and relevant decisions, while just 22% of data laggards say they have that trust.

Agents need what the report calls “frictionless access” to operating systems, multimodal data, and context, helping them understand how data maps to different teams’ goals. “The most important initiative to enable scaling among all respondents is improving access to structured and unstructured data for AI agents.”

To successfully scale agents, the report recommended that enterprise leaders prioritize several data initiatives. First, improve access to data; discover, inventory, and classify data, both structured and “dark”/unstructured. After governance principles are applied, information can then be extracted and connected to AI agents.

Next, “put a premium on context” by giving agents enterprise-specific data. Replace batch processing with streaming and event-driven pipelines as well.

Finally, think AI-native. “AI-native systems are designed to operate in an AI environment and built from the outset to leverage AI for data management and decision-making,” the report noted.  

AI needs multimodal cloud environments

AI needs a lot of data that is often spread across on-premises systems and cloud, SaaS, and edge environments. In fact, 97% of respondents to Cloudera’s survey said they move data between environments monthly, and nearly one-third do so daily.

However, nearly three-quarters (73%) said AI integration makes data governance more complex.

“Enterprises had good governance systems when humans were the only ones accessing data manually,” the report noted. “But when thousands of agents provide support to employees, customers, or partners the story changes and governance requires another dimension.”

This makes private AI and data sovereignty critical, Cloudera said. Enterprises should have a data foundation that is unified and provides control over 100% of organizational data, wherever it resides. They must also think about where AI workloads run, while still maintaining control over sensitive data and keeping cost controls and flexibility in mind.

One notable trend Cloudera uncovered is a “resurgence” of on-premises and private cloud environments. Over the last 12 months, 66% of respondents moved AI workloads from public cloud back to on-premises or private cloud environments. And 25% said they plan to place more emphasis on a hybrid-first approach, 24% said they are planning to increase on-premises spend, and 22% plan to increase edge spend.

“IT leaders are putting more emphasis on moving workloads to the environments that they are best suited for, based on performance, cost, latency, governance, availability, and accessibility,” the report stated.

CIOs are under pressure to deploy more AI agents and demonstrate their business value. But a “move fast and break things” approach can lead to rogue AI agents, AI debt, business impacts, and compliance issues.

Avoiding mistakes starts with a strong plan and foundational practices. CIOs must have a process to evaluate an AI agent’s business value before investing in its development. Buy versus build is a consideration; organizations can leverage AI agents deployed on SaaS platforms or consider developing them using vibe coding or spec-driven development practices.

When building AI agents, IT leaders should develop the security model before implementing the POC and ensure robust observability is in place. Top CIOs and CISOs communicate non-negotiable AI agent release criteria, providing teams standards for what meets compliance, security, and operational requirements. Organizations scaling from a few to hundreds of production AI agents must also develop AgentOps practices across incident management, modelops, and end-user feedback.

Guilherme Soubihe, co-founder and CEO at Latitude.sh, says, “Your first concern shouldn’t be avoiding mistakes when you deploy agents; it should be avoiding them before you deploy at all.”

Deployment mistakes can be made even with the best-laid plans. The following seven mistakes occur before building, during the engineering process, and once deployed.

1. Using AI agents where deterministic automation would do

Matt Graney, chief product officer at Celigo, says many organizations treat agents as a default solution for processes that already work with known inputs, consistent outputs, and reliable execution at scale. “Agents add cost, latency, and variability that erode exactly what made those processes reliable. Before deploying an agent, ask whether the task requires judgment, or does it just need to work?” Graney says.

Even when an existing workflow requires modernization, deterministic forms of automation, predictive models, and integrations may be more effective solutions. Another concern with agentic AI solutions is costs, which can be hard to predict as frontier model pricing changes.

“A good AI agent has to be four things at once: cost-efficient, fast, accurate, and secure,” says Vinod Jayaraman, co-founder and CTO at NeuBird AI. “Companies routinely underestimate cost, and I’ve watched teams ship an agent that was fast and accurate, only to pull it weeks later because it was too expensive to run at scale.”

How to avoid the mistake: Have a defined process to evaluate ideas based on business value and an architect’s review before locking in building or buying AI agents as the solution.

2. Building AI agents with no ownership or decision accountability

One of the biggest gaps in data governance is identifying data owners, and many chief data officers have to backpedal their way to assign responsibilities and educate owners about their roles.

AI agents also need owners, especially ones automating all or parts of decision-making in business-critical areas.

What happens when AI agents make incorrect or suboptimal decisions? Someone has to own the outcomes, and it’s a best practice to define the governance model well before any AI experiments are commissioned. CIOs should also partner with risk management to establish criteria for when AI augmentation of humans is mandatory, when human-in-the-middle is required, and when AI agents can have autonomy.

“Too many enterprises launch agents with no named owner, no exception queue, and no plan for quality drift,” says Anirudh Shah, CTO at MediaMint. “They treat autonomy like a switch, going full-auto after a demo instead of earning trust, decision by decision. Start with tightly scoped micro-tasks, human oversight, measurable trust thresholds, and knowledge that expires unless revalidated.”

As organizations deploy MCP servers and enable agent-to-agent collaboration, CIOs have more complexity in defining decision-making authorities.

Kandarp Desai, CTO at Xactly, says, “This accountability gap becomes especially risky in multi-agent systems, where no single agent is ultimately responsible for the final result. Before deploying, you must answer: When the agent makes an error, who is responsible, and is it possible to trace back its decision process?”

How to avoid the mistake: Clearly establish AI agent owners and review decision-making risks and costs. These factors should be evaluated against guidelines for deciding when to automate and where in workflows to delegate to people.

3. Planning AI agents without trustworthy data

It’s easy to attend conferences and get excited about how AI agents are shaping the future of work. But CIOs have to perform a reality check with business leaders, because commissioning AI agents on top of poor data quality and dysfunctional business processes can lead to costly programs and deployment disasters.

“Point an agent at duplicate records, conflicting definitions, and documents nobody has updated in two years, and it won’t clean any of that up; it will confidently act on all of it, then repeat the same mistake at scale,” says CJ Combs, AI strategy executive at Columbus Global. “The agent didn’t fail; it surfaced the data and governance debt you already had, now compounding at machine speed across every workflow it touches.”

CIOs are investing in data fabrics and addressing data management debt as prerequisites for deploying AI agents.

“One of the biggest challenges organizations face with agentic AI is scaling too soon before establishing a unified business data foundation,” says Michael Ameling, president of SAP Business Technology Platform and member of the extended board at SAP. “Agents depend on trusted business data, business context, and governance to operate reliably across the enterprise.”

How to avoid the mistake: Measure data quality and establish a minimal trust score for data sets used for training AI models or for providing context to AI agents during runtime.

4. Granting AI agents access to too much information

The organization’s subject matter experts often have access to a wide range of platforms and data sources. Experts advise against providing AI agents with the same or greater level of access to information.

“AI agents actually behave more like semi-trusted external contractors or unvetted employees,” says Shad Malloy, senior managing consultant at Bishop Fox. “You wouldn’t hand a new intern unrestricted access to your email, file share, and accounting platform, so there’s no reason to grant an agent broad permissions either.”

Organizations need policies and platforms to secure confidential data, ensure compliance with data privacy regulations, and protect intellectual property.

“If an agent can reach sensitive data, production systems, or high-impact workflows by default, governance becomes reactive instead of architectural,” says Gal Ordo, co-founder and CPO at Native. “Define the zones the agent can operate in, the boundaries it can cross, and the baselines that must always hold, so teams can move quickly without creating risk that scales faster than they can control.”

How to avoid the mistake: Businesses in regulated industries and others deploying AI agents with sensitive data will need AI governance platforms to map data sources to AI agents and centralize data access rules.

5. Testing AI agents like traditional software

Robust regression tests deployed in continuous testing and automated continuous deployment are the goal for applications and APIs. Extend these objectives when building, testing, and deploying AI agents to account for variability in data, models, and real-time inference context.  

“The most common mistake is treating an agent like a traditional app: You test it before deployment, sign off, and assume it’s safe in production,” says Sanmi Koyejo, co-founder and head of AI at Virtue AI. “But agents are non-deterministic and stateful, so the same request can trigger a different sequence of tool calls every time. Pre-deployment testing can’t enumerate those paths, and worse, a chain of individually permitted actions can still add up to data exfiltration or an unauthorized transaction.”

Koyejo suggests that testing also needs runtime enforcement, checking every tool call before it executes and either blocking or alerting on risky actions as they occur.

Patrick Phillips, CIO at Vasion, recommends CIOs build four controls before deploying AI agents.

• A kill switch that suspends any agent in seconds.
• A behavioral baseline, so they know what normal activity looks like.
• A post-incident review after every near-miss that asks which control should have stopped it.
• A feedback process for implementing improved controls.

How to avoid the mistake: Blur the lines between testing and monitoring AI agents, as their recommendations and actions should be evaluated consistently across both environments.

6. Deploying AI agents without a people strategy

The CHRO may own the AI agents for recruitment and define their decision-making authorities, but what about the recruiters and hiring managers? AI change management programs must consider the business objectives related to decision-making authorities, evaluate AI agent accuracy, and gain buy-in from the people most directly impacted by workflow changes.

“The biggest mistake I see enterprises make is deploying AI agents without defining a clear ‘human in the loop’ escalation model before go-live,” says Krish Mantripragada, chief product and technology officer at Seismic. “Teams spend a lot of time mulling over what the agent can do autonomously but skip the harder question: at what confidence threshold, business risk level, or action type does it stop and ask?”

How to avoid the mistake: Deploying AI agents is only the start of its lifecycle of evolving business processes. Leaders must consider how to help employees adapt to workflow changes, and then develop a skill set for managing AI agents.

7. Treating an AI agent’s deployment as the finish line

Many of the mistakes add up to one critical AI agent reality: Deployments are not the endgame; business value is the goal; and what agents respond to in production may look very different from what they were exposed to during testing.

Iris Adae, VP of data and analytics at KNIME, says, “The mistake I see most when deploying AI agents is assuming the pilot is the finish line. Agents behave very differently in a curated pilot than in production, where edge cases and messy integrations finally surface.”

CIOs are plagued with technical debt, and one source is when businesses stopped funding a technology’s maintenance and support. That same approach can not only lead to AI cost debt but also erode efficiencies and increase operational risks.

How to avoid the mistake: While there’s been significant debate on business-unit chargeback models for production applications and SaaS, the approach must be considered for AI agents deployed to production.

CIOs looking to deploy more AI agents to production need a well-defined operating model that addresses a continuous lifecycle of delivery, deployment, measurement, feedback, and improvement.

On the modern factory floor, the phrase “industrial equipment” no longer tells the whole story. It conjures images of steel, hydraulics, conveyor belts and machinery built to perform the same task with unwavering precision day after day. Physical engineering remains fundamental, of course, but it’s no longer the sole measure of a machine’s value. The next generation of machines have capabilities that depend on far more than the factory floor, continuously exchanging information with cloud platforms, data centers and AI systems that allow them to act autonomously and “self-improve” long after they’ve been deployed. A robotic arm isn’t simply running a predefined script anymore – it’s generating a constant stream of operational intelligence that reveals how it is performing, when and whether it needs attention, and how production can independently improve itself and become faster, safer and more efficient tomorrow than it is today.

This new functionality is redrawing the concept of ownership for manufacturers. Increasingly, the asset is not just the machine itself, but the flow of data that supports it and reveals clues about its functionality. Every production cycle enriches digital models, refines predictive algorithms and deepens operational understanding, turning what was once a static piece of equipment into something that continuously improves over time. The term “phygital” has emerged to describe this convergence of physical infrastructure and digital intelligence, but whatever terminology ultimately sticks, the outcome will be the same. As manufacturing enters an era where competitive advantage is increasingly shaped by software, analytics and real-time AI inference, CIOs are having to think very carefully not just about who owns the machine on the factory floor, but who controls the data that turns that machine from “dumb iron” into something that can “think” intelligently.

Manufacturing has entered its software-defined era

The physical engineering on display on factory floors is already impressive. Autonomous haul trucks can navigate vast mining sites without drivers, robotic arms can self-adjust their movements in relation to contextual cues, and in the case of so-called “dark factories,” entire production lines can operate 24/7 for a long time without a single person on the factory floor. Every movement, vibration, temperature change and production cycle becomes part of a data-driven feedback loop that allows software to refine performance, anticipate failures and adapt operations contextually in ways that simply weren’t possible when industrial equipment functioned in siloes.

According to Deloitte’s 2025 Smart Manufacturing and Operations Survey, 92% of manufacturers believe smart manufacturing will be the primary driver of competitiveness over the next three years, while 78% are allocating more than a fifth of their improvement budgets to smart manufacturing initiatives. Those figures bring home the fact that industrial performance is no longer determined solely by what happens inside a machine, but by how effectively the data ecosystem it lives in functions as a whole.

Every smart factory runs on an invisible supply chain

Every intelligent machine exists within a much broader ecosystem that stretches far beyond the walls of a factory, connecting equipment manufacturers, cloud platforms, systems integrators, AI providers and operational teams through a constant flow of data. It’s easy to think of a production line as a collection of individual assets working side by side, but the reality is far more interconnected. Each machine is both producing and consuming information throughout the working day, allowing decisions made in one environment to influence outcomes somewhere else. A software update developed by an equipment manufacturer, for example, might be informed by performance data gathered from thousands of identical machines operating around the world, with improvements delivered back to the factory almost as quickly as they’re identified.

From that perspective, data begins to resemble a supply chain in its own right. Manufacturers have spent decades refining the movement of raw materials because every unnecessary delay carries a measurable operational cost, and that same principle now applies to information. The data flowing from production equipment, the analytics returning from cloud platforms, and the insights generated by AI have become just as vulnerable to delay as the components arriving at the loading dock.  According to the International Federation of Robotics, more than 4.8 million industrial robots are now operating in factories worldwide, and each one contributes to a growing stream of operational data that has become inseparable from the manufacturing process itself. The challenge for CIOs used to be, “How do we connect these environments?”, but now it’s “How do we ensure the data moving between them arrives with the speed, visibility and control needed to keep pace with modern manufacturing?”

The importance of network architecture

The value of data used to be measured solely by its accuracy, but now it depends on how reliably it can move between the organizations that create it, analyze it and act upon it. A predictive maintenance platform can’t identify an emerging fault if telemetry arrives too late, just like a digital twin is only as useful as the information it receives. As we bridge from Industry 4.0 to Industry 5.0, the network itself is becoming an active participant in the production process, prompting CIOs to think differently about connectivity.

Modern manufacturing depends on a growing ecosystem that needs to exchange data in near real time. Rather than relying on unpredictable routes across the public Internet, many organizations are turning to direct interconnection in the form of internet, cloud and AI exchanges, which act as neutral meeting points where enterprises and their suppliers, as well as network operators, cloud providers and digital or AI service providers, can establish direct, private connections with one another. By shortening the path data has to travel and avoiding unnecessary “hops” and congestion, these platforms reduce latency, improve resilience and give organizations far greater visibility and control over how production-critical information moves.

Every revolution in manufacturing has been defined by the emergence of a resource that reshaped how value was created, whether that was steam, electricity or silicon. Industry 5.0 is introducing another, albeit one that can’t be stored in a warehouse or delivered on a truck. Data has become the factory’s most valuable raw material, and controlling its movement is every bit as important as controlling the movement of physical goods. The term “industrial equipment” may continue to describe what’s happening on the factory floor, but it no longer captures where competitive advantage is really being created. Increasingly, the intelligence surrounding a machine is becoming just as valuable as the machine itself, and the networks carrying that intelligence are becoming part of the production process in their own right.

Microsoft is betting that the integration of HorizonDB, the cloud-native PostgreSQL alternative it is developing, with Azure will attract more enterprise AI and agentic workloads to its cloud services.

Enterprises may not be willing to take that bet.

It’s been nine months since Microsoft unveiled HorizonDB, but the service remains in public preview with no announced general availability date. Why put AI projects on hold waiting for HorizonDB to arrive, when AWS, Google, Databricks, Snowflake, and others already have production-ready PostgreSQL services positioned for the same AI workloads that Microsoft says it is building HorizonDB to handle?

AWS has had the longest head start. Aurora PostgreSQL became generally available in 2017 and has since evolved from a cloud-native PostgreSQL database into an AI-ready service with vector search and integrations with Amazon Bedrock. Similarly, Google’s AlloyDB, which followed in 2022, now includes AlloyDB AI with vector search, embeddings and model interaction for generative AI and agentic applications.

Databricks and Snowflake, too, have their own platform-centric services in the form of Lakebase, which became generally available on AWS and Azure this year, and Snowflake Postgres, which was made generally available in February 2026.

As the latecomer, when Microsoft pitched HorizonDB at Ignite in November 2025 it talked up its new architectural approach to cloud-native PostgreSQL, built around disaggregated compute and storage and a database-as-log design. The hyperscaler also positioned native vector search and deep integration with Foundry and Fabric as key differentiators for AI-heavy workloads.

No reason to wait

Those architectural differences may not be compelling enough for CIOs to wait for HorizonDB to become generally available, though.

“Most enterprises with urgent needs will not wait. A long preview window creates uncertainty around SLAs, pricing, operational maturity, and roadmap confidence,” said David Linthicum, an independent cloud consultant.

And, said Stephanie Walter, practice lead of AI stack at Hyperframe Research, enterprises cannot build mission-critical production plans around an undefined GA date, regional footprint or support commitment.

Given the difficulty of unwinding a poor database choice, enterprises will approach unknown quantities with caution.

“Database platforms eventually become sticky control points. Once the database is connected to the rest of the application, analytics, AI, and governance stack, switching becomes a business transformation rather than just an infrastructure swap,” said Michael Ni, principal analyst at Constellation Research.

In the case of a cloud database, there’s also the unwelcome possibility of “huge egress fees” in case of change, said Bradley Shimmin, lead of the data and analytics practice at The Futurum Group.

All that uncertainty is likely to lead enterprises to restrict HorizonDB to experimental use cases for now, Shimmin added.

Performance anxiety

Analysts also questioned whether HorizonDB’s technical differences will show up in performance benchmarks.

Microsoft has said HorizonDB can deliver up to three times the throughput of open-source PostgreSQL, but makes no comparisons with rival offerings such as Aurora or AlloyDB that it will compete with, Walter said.

The bigger question, according to Igor Ikonnikov, advisory fellow at Info-Tech Research Group, is whether those performance advantages, still largely on paper, translate into a meaningful difference in production.

“A database with a better compute benchmark can still be more expensive once resilience and ecosystem costs are included,” Ikonnikov said.

The economics also point to another HorizonDB limitation, particularly for workloads that are not continuously running, said Advait Patel, senior site reliability engineer at Broadcom.

HorizonDB currently uses provisioned compute rather than a serverless, scale-to-zero model, meaning customers continue to incur compute charges while an instance is provisioned, even if its workload is intermittent or idle, Patel said.

There are developer considerations too.

HorizonDB’s PostgreSQL compatibility does not necessarily mean every existing PostgreSQL application will move cleanly as in its current form the database supports only an approved set of PostgreSQL extensions rather than arbitrary ones, Walter said.

Who should wait?

For enterprises already deeply invested in Microsoft’s Azure ecosystem, those limitations may not be enough to rule out waiting for HorizonDB, Patel said: The chance to integrate the database with AI services and the wider Microsoft stack may outweigh immediate availability, he added.

That calculus also reflects how enterprises typically make database decisions in the first place: not by comparing databases in isolation, but by weighing how well they fit into the broader technology stack, including the cloud platform they have standardized on, Ikonnikov said.

For Azure shops, the choice may therefore be less about moving an existing workload away from Aurora or AlloyDB and more about whether a new Azure workload should start on Azure Database for PostgreSQL today or wait for HorizonDB when it becomes available, he said.

That may be an open question for some enterprises, said Devin Pratt, research director at IDC. “Plenty of organizations are still mid-decision, not locked in,” he said.

Microsoft finally offers a timeframe

Microsoft still won’t say exactly when HorizonDB will launch, with Shireesh Thota, corporate vice president for Azure Databases at Microsoft, saying only, “General availability for Azure HorizonDB is currently targeted for the second half of 2026.”

That narrows it down to a period of a little over four months, including Microsoft’s FabCon and Ignite conferences — an eternity in AI.

This article first appeared on InfoWorld.

Earlier this year, the National Bureau of Economic Research released survey results from over 6,000 U.S. leaders showing that while AI adoption is widespread at 69%, we’re seeing little to no impact on productivity. Anecdotally, we’ve seen leaders from top companies echo that refrain.

It’s the reckoning many CIOs, CTOs and COOs are navigating as we enter the last half of the year. The most humbling part is knowing it’s a management problem we created by treating AI like it was exempt from the rules we apply to every other enterprise tool.

Part of this has to do with how AI entered the market. The tools that sparked its mainstream adoption arrived as consumer products before enterprises had governance frameworks to absorb them. Enterprises were left playing catch-up as they grappled with IP and data security concerns, inadvertently fueling shadow AI as employees leveraged these tools to get ahead and eventually, keep pace, at work. What this created was a sense of entitlement that is challenging to unravel.

Like the internet writ large, employees have grown to expect unlimited access, and organizations played along. But this idea warrants a pause. When did we last roll out Salesforce to everyone who asked without a use case? AI got a pass because it felt different. In truth, it isn’t. It’s another tool that enterprises need to manage.

Three levels every information and technology leader has to solve

It’s helpful to look at this as a three-level evolution framework.

Level one is adoption — are people actually using it well? Level two is budget control — what are we spending and on what? Level three is justification — can we demonstrate the return?

Most companies are still at level one. Deloitte reported in their 2026 State of AI in the Enterprise report that only 25% of respondents have moved 40% or more of their AI experiments into production to date. The minority that have moved pilots to production are grappling with the budget and trying to figure out how to justify the costs and quantify the gains.

The problem is, you can’t prove what you didn’t have to hire because of AI. There is no parallel universe where you can walk into the CEO’s office and say I need five more people in finance, but in this universe, with AI, I didn’t.

The organizations that wait for a clean ROI model before making any decisions will spend themselves into the trough of disillusionment before they find one. The smarter move is to start treating it as a discipline you build.

What managing AI like a tool actually looks like

To some, governance sounds like restriction. But the discipline is more about matching the right tool to the right use case, and making the sanctioned path easier than the workaround.

Take shadow AI. The instinct is to lock things down. But when employees start building internal apps with company data and hosting them on free public platforms, the answer isn’t another policy. By the time the policy is written, the data is already public. Instead, you need to build an internal alternative that does the same thing without the exposure. Give people a path. If you don’t, they build their own, and you won’t know about it until something goes wrong.

The same principle holds for conflicting data. Two departments pulling AI-generated recommendations from the same underlying data and arriving at different conclusions isn’t an AI problem. It’s a data and definitions problem. AI just made it impossible to ignore. Say marketing claims they brought $50 million in the pipeline, and sales claim they brought $50 million as well.But the company actually has $75 million in pipeline. Someone is counting the same deals twice under different definitions. The CIO’s job is to enforce one source of truth. If your dashboard doesn’t match the authoritative one, your dashboard is wrong. That’s the only way the organization can function.

And it applies to cost, too. Not every workflow needs the most expensive model. Not every employee needs full AI access. If someone is using a top-tier model to summarize email because nobody told them there was a cheaper option that does the job, that’s a gap that CIOs need to address. The CIO’s job is to build the layer that makes the right choice the obvious one, and to provide sanctioned alternatives so employees aren’t left building their own.

That’s what actually reduces shadow AI, conflicting data and runaway spend: Alternatives, visibility and a single source of truth.

The CIOs getting real value from AI right now aren’t the ones who said yes to everything. They’re the ones who asked the same questions they’d ask about any other enterprise investment: What does it do, who actually needs it and what are we getting back?

AI is a remarkable tool. It’s also just a tool. It doesn’t exempt you from the management discipline you apply to every other system in your stack. We didn’t roll out Salesforce to everyone who asked without a use case. We shouldn’t have done it with AI either, and the organizations that did are now living with the consequences:  Six-figure token bills, shadow apps on public URLs, dashboards that contradict each other and a CEO asking what exactly he got for the investment.

The answer to that question is available. But only if you built the infrastructure to find it.

As an aviation industry veteran with over 30 years of experience, Alaska Airlines CIO Charu Jain is all too familiar with the technology integration process that often follows a big airline merger.

By her count, she’s been involved in four such projects. But none, she says, has brought her greater satisfaction than leading the overhaul of Alaska’s PSS following its $1.9 billion acquisition of Hawaiian Airlines in September 2024.

“This is one of the biggest milestones in any merger work done between airlines,” says Jain, speaking from her company’s Seattle offices just two months after Alaska and Hawaiian completed their transition to a shared PSS.

In its simplest terms, a PSS is an all-encompassing software suite used by airlines to record and manage a passenger’s journey, from booking tickets and checking in baggage at the airport, to boarding the aircraft and accessing the in-flight menu. “A PSS touches almost every function of an airline from employees to guests,” says Jain.

Two brands, one system

At the time of the merger, Alaska and Hawaiian each had its own PSS. No sooner had the ink dried on the deal than the cutover project got underway to bring both airlines’ systems under a single operating platform.

According to Jain, the two airlines agreed from the get-go that they’d retain their own unique historic brands, both with a combined history of close to 200 years, which would be reflected through the system.

“It had never been done before, developing capabilities to enable two brands on one platform,” adds Jain, who also serves as Alaska’s SVP of merchandising and innovation. “We didn’t want a situation where a passenger travelling from Spokane to Seattle on an Alaska-branded flight, and then onto Honolulu on a Hawaiian-branded flight, would have to navigate two separate systems. So we thought about how to make that experience more seamless.”

After settling on a PSS, developed by travel software manufacturer Sabre, Jain and her colleagues began work on migrating the airlines’ millions of bookings and passenger information, while also updating their various guest- and employee-facing tools for the new system.

Selling cutovers and mock flights

Executing a system cutover on such a large scale is a delicate balancing act, not least in a live-environment where, for a major airline, any form of disruption to the passenger experience can be bad for business. So there was no attempt to rush the project.

“To make sure we didn’t have any issues with customers’ bookings, we really took a risk-optimized approach with a phased deployment and a phased cutover,” says Jain.

Much of this hinged on what Alaska refers to as a selling cutover. Starting in October last year, all new bookings were made on the new PSS, which allowed the group to drain old bookings from the legacy system, and start selling tickets six months in advance of the official transition date; the average booking curve for an airline is around six months.

“There was no migration of millions of records and bookings,” says Jain. “This meant when our customers checked in on the first day [of the PSS], it was as if the booking had been made on the native system.”

While this was going on, however, Alaska was hit by a sizeable IT outage that grounded flights across the country and impacted the travel plans of nearly 50,000 passengers. It followed a previous IT outage in July. However, Jain says the disruptions didn’t impact the project in any way.

So in the final months leading up to the cutover completion, Alaska carried out several dress rehearsals to test the system, including mock flights for domestic and international routes in anticipation of the recent launch of several non-stop services to Europe.

This involved real guests arriving at the airport, completing check-in, going through security, and taking their seats as if they were about to take off. Leaving no stone unturned, the simulation also accounted for baggage collection, pets, wheelchair users, and onboard hospitality, stopping just short of passengers being served actual food.

Alaksa completed five such mock rehearsals in all. “The fifth one was when everything worked without any medium or high issues, and gave us the confidence we were ready,” says Jain.

As part of the airline’s scenario planning, it also set up command centers in various locations, including Honolulu and Seattle, to plan for unforeseen and unrelated problems on the day of the cutover.

A dedication to collaboration

A project is only ever as a good as its people, and Jain is quick to hail the collaborative spirit that Alaska and Hawaiian brought to the table. As a PSS involves both the operational side of an airline’s business — touching on everyone from pilots, flight attendants, and baggage handlers — and commercial departments responsible for policies and pricing, this was more than a purely technological undertaking.

“This was about people coming together from two companies to make this one big thing happen,” says Jain.

When Alaska started making bookings on the new PSS last fall as part of the selling cutover, it also began training employees how to use system. It was around that time as well, says Jain, that the airline was confident the transition would be completed by April 2026, just in time for the busy summer travel season.

Since the PSS has been up and running, the company has also introduced a single mobile app to replace Alaska and Hawaiian’s separate existing ones, allowing passengers to personalize their experience to the airline brand they’re more familiar with.

“It’s a much more seamless experience now that there’s no confusion knowing which app to go on, or why they have two booking numbers,” says Jain. Alaska’s employees are also just as happy with their new tools, she adds.

Generative AI is notoriously eager to help, to the point that if it can’t find something matching what you ask for, it’ll create it. So the problem with relying on guardrails is that all too often, a model will be wrong, showing a high confidence score for an incorrect answer because it’s relying on stale or non-canonical data.

Not only do you need to be able to track the lineage of data your model uses from source to token, something the EU AI Act requires, you also need to be able to take into account where the data came from, whether it’s out of date, if it changed in a way that affects the result, or if it was never really relevant or authoritative in the first place.

Gartner expects organizations will abandon 60% of AI projects because they don’t have the right metadata management, data quality, and data observability. IBM’s acquisition of Confluent also highlights the importance of real-time data with lineage, governance, and policy for AI agents, and one of IBM’s 2026 predictions was the importance of smarter data.

The usual approach is adding metadata and validation later in the data pipeline. That’s similar to the way the bronze, silver, and gold tiers of typical lakehouse architecture are supposed to represent how filtering, cleaning, and augmenting data improves structure and quality until it’s ready to use. That can mean an enormous amount of work since nearly three quarters of the CPU work in training a frontier model is data cleansing and validation.

But that can also remove a lot of the context crucial for gen AI. Rather than cleaning data and losing the original context, it’s often more effective to keep as much information about the original state of the data, says David Aronchick, open-source platform Kubeflow founder, and CEO of distributed data pipeline vendor Expanso. “You can’t pursue exactly purely clean data; that’s just not possible,” he says. “As you pull data into your ML model, every line should have some mechanism saying where it came from. Otherwise, you’re never really going to know because you can’t mix them together and tease them apart later. You can search your raw content, your raw logs, but it’s just not going to be there.”

IoT digital twin systems often tag data all the way back to the device capturing it so you can see whether a temperature spike is a critical failure, which you want to react to, or a routine calibration, which you don’t. But that information may well be relevant down the line when you want to use that data more broadly. So unless you capture at least some elements about the source of data before you move it, you’re not going to be able to easily reconstruct the context later, or at all sometimes.

Ulrik Hansen, co-CEO of Encord, a platform for managing and annotating data, calls this in-stream labelling and cautions it’s not an alternative to cleansing data. “Dirty conflates two things: actual corruption you should fix, and context dependence, where a reading only looks anomalous because you threw away the frame that explained it,” he says. “Cleansing kills both. The point isn’t to stop cleaning, it’s to stop normalizing away context you can never recover.”

Context can be cheap to capture at the source and nearly impossible to recover after, he adds. “The question isn’t whether to keep it,” he says, “it’s about curating what actually helps.”

Raw but not rancid

Aronchick characterizes the state of most bronze tiers as toxic waste because raw data doesn’t get validated before ingestion, or have a metadata wrapper on each data point. “You’ve taken raw data and stripped it of context,” he says.

Take a wind farm operator, for instance. When sensor data about the turbines is generated, it comes from a particular turbine at a particular position in a specific wind farm at a known location, running at a specific speed in specific weather conditions, at a particular time. “If you have other turbines also working in the field, the performance of your turbine will go down, but the field performance will go up,” says Aronchick. “The performance of your turbine going down isn’t a negative, but unless you have the context at the point of data collection, you’re going to make your life much harder later on, when someone asks about the efficiency.”

Metadata needs to be much richer, and it needs to be added as early in your data pipeline as possible when you have the most detail available to make sense of the structure and complexity of the data, Aronchick adds. “You want to capture as much about the data you’re collecting as possible, where it doesn’t require insane activity to do so.”

But not all the metadata you need will be generated with the data, he says. You almost certainly need to augment and annotate your data, and provide extra structure, especially for something like a point of sale system with very light metadata. “Data comes off these things in poor structure,” he says. “It’s not OpenLineage, it’s often a CSV or a text record, and you have to reconstruct them into a full structured log. So do smart things where you’re creating data. That might be compressing, sampling, converting, appending metadata to it, and enforcing schema and lineage all before you start moving anything.”

That doesn’t have to mean bloating your data, Hansen points out. He suggests capturing what’s free and unrecoverable. “The system of origin is the label,” he says. “You don’t tag HR policy, you capture that it came from the HR system. Anything a model can derive later, you can skip.”

Structure isn’t static

Routine changes to APIs, schemas, and how data is collected or stored happen in every organization, and need to be reflected in metadata that lives alongside the data or added as data is collected, not reconstructed later in a fragile process that depends on knowing about all those changes. Google’s research into these data cascades shows how easily context gets lost and how badly it affects data quality.

Shifting schema enforcement further left in your data pipeline so you deal with it as soon as possible allows you to make more effective downstream decisions. For a sensor recording temperature and humidity, you need to know the temperature scale it uses, readings, and how the timestamp is recorded. Checking that against the schema before ingesting the data lets you route it differently depending on whether it validates or triggers alerts about data quality.

“Maybe I’ll delete it, or send it off to some place where a human being or other tooling can reconstruct it into something valuable,” says Aronchick. “But what it doesn’t do is allow the polluted or bad data into my pipeline. Saying whether or not something passed your schema makes your downstream systems much more reliable.”

Sensing structure

Unstructured and semistructured data needs more augmentation. A PDF or Word document has an author and a creation date, but doesn’t necessarily include any context about the job title and department of the author, whether it’s up to date, only applies to a particular group of customers, or is based on accounting regulations that can change. If that information is available, it needs to travel with the document, not be left in a compliance spreadsheet.

Data platforms like DataHub and SurrealDB both capture and create context. The latter can analyze a photo, for instance, using vision AI to understand what’s in the image. “From completely unstructured data, we get as much structure as possible,” says the company’s CEO Tobie Morgan Hitchcock.

That’s paired with other data potentially useful for an AI agent down the line. “Understanding what happened around an event becomes a lot easier if you’re tracking the conversation, telemetry, tool and model usage, geospatial data, and the vector search and relationships,” he says. “You’re going to have a far better chance of getting an accurate understanding of that data, which started off completely unstructured, than if you weren’t capturing anything.”

Metadata about document authors, which might come from the company directory, can show how much authority a document has. He describes that as building an understanding of what trust and provenance is over time by the weight and authority of who’s updating the information. After all, he says, company-generated information has more trust or can have traced provenance compared to conversational inputs from a user.

Incentives for annotating

DataHub CTO Shirshanka Das saw how much of a mess data can be even with strong guidelines as former architect of LinkedIn’s GDPR strategy. “The data was a swamp, despite us having had pretty good data-first and schema-first practices,” he says. As well as cleaning up the data governance, they added in the first nuggets of the DevOps’ ‘shift left’ approach.

LinkedIn already required data checked in to its Kafka ecosystem to have a schema, and ran CI/CD pipelines to check backward compatibility. “I attached metadata attribution and collection around compliance metadata into that pipeline, where developers weren’t able to check in a schema until they had declared what every column meant.”

The extra work was unpopular until teams who didn’t participate saw the flood of tickets that came their way, which allowed him to extend that same proactive governance and annotation at source approach to pretty much every data set being produced.

“The starting point of data at most companies is a lot more swampy,” he says. “Many people are using Kafka, which is a very schema forward system, and yet they’re just shoving in JSON and unstructured stuff.”

That’s common, agrees Megha Kumar, research VP for analytics and AI at IDC, because while collecting more metadata provides better context and cleaner data lineage, it’s hard in practice. “Most organizations batch process data, so real-time context capture rarely happens,” she says. “Even the ones that process in real-time tend to have pre-defined schemas, so adding context requires changes to the data, which unfortunately happens later.”

People don’t know how to start, says Das, so DataHub Cloud tries to add back context by collecting operational metadata from multiple systems, including queries and BI tools to extrapolate a semantic model. “We confront the mess by giving them something they can react to,” he says. “They can quickly validate, and then it starts becoming a governance layer on top where humans annotate at source.”

Online whiteboard provider Miro, for example, dramatically improved AI agent query accuracy from about 50% to 90% using DataHub. Then they applied GitOps principles on top of what was inferred with a human in the loop for approvals.

So getting people to do the work happened the same way at LinkedIn, says Das. “When a data scientist gets 10 times more requests because they didn’t document their work well, resulting in the AI making lots of mistakes and stakeholders constantly pinging them for answers, they have the incentive to add the annotation when they produce an analysis, because then they get out of the critical path.”

DBOMs and data contracts

Provenance and lineage of data is critical, Aronchick says, so you can preserve details like who collected the data, when, from where, if the source was authoritative or canonical, what transformations were run, and exactly what the model saw.

“It’s not just about the version and the metadata,” he says. “Where things really start to change is when you can say along the way this data has gone through these steps, this is the root source, and these were the other elements.” You want to be able to find out if there were any experimental flags, like a new customer campaign running when it was collected, as well as what claims the data contributes to.

Aronchick advocates for a SLSA-style data bill of materials using a tool like Makoto, which can add signed provenance and attestation to simplify applying central concepts of governance and structure to upstream data.

The notion of a data contract or a data product spec is starting to become common in the financial sector says Das, defining it as a data set, or a group of data sets, bound together by a contract that defines expectations which aren’t just cosmetic but machine verifiable. They can also include operational SLOs for APIs as contracts describe not just the shape of the data but operational characteristics and guarantees.

Document graph markup language (DGML), a new open source specification from Docugami, promises provenance down to individual data points automatically extracted from documents.

“It’s critical to know the validity and provenance of the information your AI is relying on,” Docugami CEO and XML co-creator Jean Paoli says. “Establishing the validity of data right from the start, at scale, is vital and far more efficient than trying to clean up bad data later.” DGML combines semantic tags describing what content means in its business context with bounding boxes showing exactly where in the document the content comes from, with attestation to prove it.

AI demands provenance

All this context is the kind of metadata Anthropic’s context engineering guide recommends feeding to agents for accuracy. Developers are already used to giving coding agents more context, Das argues. “The same thing is happening with data, as when people realize when AI agents can’t make sense of what they’re doing, hallucinations happen,” he says.

Kumar agrees that organizations realize agents need context to provide better insights. “In many cases, it has to do with ensuring the existing data had clear semantics and relationships,” she says.

If you want to make sure the purchase return window an AI chatbot promises customers is based on your own policy, not a wish list from a user forum, you need rich context. It’s not just metadata. Organizations need to have semantics, data lineage, and ontologies. “Many are also building knowledge and ontology graphs,” adds Kumar. “By ensuring the systems understand what the data means, it’ll be able to provide a better response.”

And if you’re going to the expense of fine tuning, which needs relevant and domain- or task-specific examples, you don’t want noise, duplication, or irrelevant content in your data. You can, of course, exclude poor data if it’s annotated and verified earlier, but you can also improve model performance with extra information, Aronchick points out. “The augmentation of the existing data makes the data you pull out more valuable,” he says.

Expanso recently won an Edge AI award for fine tuning a base level model with only about 3,200 images by augmenting them with metadata. “The reason it worked on that few is because I could tell it deterministically what was in the frame,” he adds. “It’s labeling at the point of capture instead of paying somebody to label it later. What if I developed models for predictive analytics of store behavior on a per city, region, or country basis? If I’m able to take the raw point of sale information and augment it with additional metadata, I’m turning this into a much easier thing to fine tune.”

Or you might even avoid the expense of fine tuning entirely, suggests Das. “You get the short-term advantage by fine-tuning and getting great performance at much cheaper cost on a smaller model, and it gets stripped away in a couple of months as a new model shows up,” he says. “You have to always run that calculus of when’s the right threshold to fine tune an existing model, distil it, and then run it for a fair amount of time to recoup the costs of fine tuning.”

Although regulated or slow-moving industries will see benefits from fine tuning a model they can run for six to 12 months on data with higher quality and better provenance, many organizations may use the improved data quality to get good results without fine tuning.

“We’re taking a more knowledge graph-oriented approach to grounding the model, and betting on the fact that because the knowledge graph is changing often, it’s better to keep it as a runtime artifact than a baked-in one.”