{"id":3847,"date":"2025-10-13T00:57:53","date_gmt":"2025-10-13T00:57:53","guid":{"rendered":"https:\/\/violethoward.com\/new\/heres-whats-slowing-down-your-ai-strategy-and-how-to-fix-it\/"},"modified":"2025-10-13T00:57:53","modified_gmt":"2025-10-13T00:57:53","slug":"heres-whats-slowing-down-your-ai-strategy-and-how-to-fix-it","status":"publish","type":"post","link":"https:\/\/violethoward.com\/new\/heres-whats-slowing-down-your-ai-strategy-and-how-to-fix-it\/","title":{"rendered":"Here's what's slowing down your AI strategy \u2014 and how to fix it"},"content":{"rendered":"


\n
<\/p>\n

Your best data science team just spent six months building a model that predicts customer churn with 90% accuracy. It\u2019s sitting on a server, unused. Why? Because it\u2019s been stuck in a risk review queue for a very long period of time, waiting for a committee that doesn\u2019t understand stochastic models to sign off. This isn\u2019t a hypothetical \u2014 it\u2019s the daily reality in most large companies.<\/p>\n

In AI, the models move at internet speed. Enterprises don\u2019t.<\/p>\n

Every few weeks, a new model family drops, open-source toolchains mutate and entire MLOps practices get rewritten. But in most companies, anything touching production AI has to pass through risk reviews, audit trails, change-management boards and model-risk sign-off. The result is a widening velocity gap: The research community accelerates; the enterprise stalls.<\/p>\n

This gap isn\u2019t a headline problem like \u201cAI will take your job.\u201d It\u2019s quieter and more expensive: missed productivity, shadow AI sprawl, duplicated spend and compliance drag that turns promising pilots into perpetual proofs-of-concept.<\/p>\n

The numbers say the quiet part out loud<\/h2>\n

Two trends collide. First, the pace of innovation: Industry is now the dominant force, producing the vast majority of notable AI models, according to Stanford's 2024 AI Index Report. The core inputs for this innovation are compounding at a historic rate, with training compute needs doubling rapidly every few years. That pace all but guarantees rapid model churn and tool fragmentation.<\/p>\n

Second, enterprise adoption is accelerating. According to IBM's, 42% of enterprise-scale companies have actively deployed AI, with many more actively exploring it. Yet the same surveys show governance roles are only now being formalized, leaving many companies to retrofit control after deployment.<\/p>\n

Layer on new regulation. The EU AI Act\u2019s staged obligations are locked in \u2014 unacceptable-risk bans are already active and General Purpose AI (GPAI) transparency duties hit in mid-2025, with high-risk rules following. Brussels has made clear there\u2019s no pause coming. If your governance isn\u2019t ready, your roadmap will be.<\/p>\n

The real blocker isn't modeling, it's audit<\/h2>\n

In most enterprises, the slowest step isn\u2019t fine-tuning a model; it\u2019s proving your model follows certain guidelines.<\/p>\n

Three frictions dominate:<\/p>\n

    \n
  1. \n

    Audit debt: Policies were written for static software, not stochastic models. You can ship a microservice with unit tests; you can\u2019t \u201cunit test\u201d fairness drift without data access, lineage and ongoing monitoring. When controls don\u2019t map, reviews balloon.<\/p>\n<\/li>\n

  2. \n

    . MRM overload: Model risk management (MRM), a discipline perfected in banking, is spreading beyond finance \u2014 often translated literally, not functionally. Explainability and data-governance checks make sense; forcing every retrieval-augmented chatbot through credit-risk style documentation does not.<\/p>\n<\/li>\n

  3. \n

    Shadow AI sprawl: Teams adopt vertical AI inside SaaS tools without central oversight. It feels fast \u2014 until the third audit asks who owns the prompts, where embeddings live and how to revoke data. Sprawl is speed\u2019s illusion; integration and governance are the long-term velocity.<\/p>\n<\/li>\n<\/ol>\n

    Frameworks exist, but they're not operational by default<\/h2>\n

    The NIST AI Risk Management Framework is a solid north star: govern, map, measure, manage. It\u2019s voluntary, adaptable and aligned with international standards. But it\u2019s a blueprint, not a building. Companies still need concrete control catalogs, evidence templates and tooling that turn principles into repeatable reviews.<\/p>\n

    Similarly, the EU AI Act sets deadlines and duties. It doesn\u2019t install your model registry, wire your dataset lineage or resolve the age-old question of who signs off when accuracy and bias trade off. That\u2019s on you soon.<\/p>\n

    What winning enterprises are doing differently<\/h2>\n

    The leaders I see closing the velocity gap aren\u2019t chasing every model; they\u2019re making the path to production routine. Five moves show up again and again:<\/p>\n

      \n
    1. \n

      Ship a control plane, not a memo: Codify governance as code. Create a small library or service that enforces non-negotiables: Dataset lineage required, evaluation suite attached, risk tier chosen, PII scan passed, human-in-the-loop defined (if required). If a project can\u2019t satisfy the checks, it can\u2019t deploy.<\/p>\n<\/li>\n

    2. \n

      Pre-approve patterns: Approve reference architectures \u2014 \u201cGPAI with retrieval augmented generation (RAG) on approved vector store,\u201d \u201chigh-risk tabular model with feature store X and bias audit Y,\u201d \u201cvendor LLM via API with no data retention.\u201d Pre-approval shifts review from bespoke debates to pattern conformance. (Your auditors will thank you.)<\/p>\n<\/li>\n

    3. \n

      Stage your governance by risk, not by team: Tie review depth to use-case criticality (safety, finance, regulated outcomes). A marketing copy assistant shouldn\u2019t endure the same gauntlet as a loan adjudicator. Risk-proportionate review is both defensible and fast.<\/p>\n<\/li>\n

    4. \n

      Create an \u201cevidence once, reuse everywhere\u201d backbone: Centralize model cards, eval results, data sheets, prompt templates and vendor attestations. Every subsequent audit should start at 60% done because you\u2019ve already proven the common pieces.<\/p>\n<\/li>\n

    5. \n

      Make audit a product: Give legal, risk and compliance a real roadmap. Instrument dashboards that show: Models in production by risk tier, upcoming re-evals, incidents and data-retention attestations. If audit can self-serve, engineering can ship.<\/p>\n<\/li>\n<\/ol>\n

      A pragmatic cadence for the next 12 months<\/h2>\n

      If you\u2019re serious about catching up, pick a 12-month governance sprint:<\/p>\n