This article is adapted from The Privacy Filter podcast series, a Barnes & Thornburg briefing on data security and privacy. To subscribe to The Privacy Filter, click here.

AI Is Changing the Role of Governance

"Here, you see, it takes all the running you can do, to keep in the same place. If you want to get somewhere else, you must run at least twice as fast as that." — Lewis Carroll, Through the Looking-Glass

Lewis Carroll wasn't writing about artificial intelligence. But his famous "Red Queen" quote captures the challenge many organizations face as AI adoption accelerates: moving quickly simply to maintain position and moving even faster to create meaningful progress.

Organizations are racing to adopt AI. New capabilities are emerging at a relentless pace. Enterprise software providers are embedding AI into their platforms. Employees are experimenting with new tools faster than many governance teams can evaluate them.

Legal, privacy, compliance, and risk professionals are being asked to guide adoption while governing technology that continues to evolve faster than traditional processes were designed to handle.

That challenge was the focus of a recent episode of The Privacy Filter, where Barnes & Thornburg attorneys Brian McGinnis and Owen Agho spoke with Ojas Rege, senior vice president of emerging products and technologies at OneTrust, about the future of AI governance. The conversation explored AI agents, regulatory uncertainty, and the evolving role of privacy professionals, while highlighting a broader organizational challenge: governance models must evolve alongside the technology they oversee.

Governance Was Designed for a Different Era

For decades, governance followed a familiar pattern.

• A new technology emerged.

• The business identified an opportunity. 

• Legal, privacy, compliance, and risk teams evaluated the proposal, assessed the risks, implemented controls, and established policies that allowed innovation to move forward responsibly.

The process was not always fast, but it generally kept pace with technological change. AI has disrupted that rhythm.

Unlike previous waves of technology, AI is not arriving as a standalone platform or isolated initiative. It is becoming embedded across virtually every business function — from productivity software and customer service to software development, marketing, finance, and operations.

The result is a volume of governance decisions unlike anything many organizations have previously experienced. 

The scale and speed of AI adoption create challenges that extend beyond traditional compliance processes. Organizations need governance models that can keep pace with innovation while helping the business understand and manage risk effectively.

The Future of Governance Depends on Better Prioritization

When organizations begin developing AI governance programs, the instinct is often to create more oversight: more assessments, more approvals, more documentation, and more policies.

Those tools remain important. But as AI becomes embedded throughout the enterprise, governance teams will need to make increasingly strategic decisions about where to focus their attention.

A practical approach is to prioritize the initiatives where AI, business impact, and data risk intersect.

Rather than asking quantitative questions, like:

• How many AI projects are underway?
• How many assessments have been completed?
• How many policies have been created?

Organizations should ask:

• Which AI initiatives are most closely tied to business strategy?
• Which projects rely on significant amounts of data?
• Where could poor decisions create the greatest operational, regulatory, or reputational impact?

This qualitative, strategic approach allows governance teams to focus their limited resources on the areas where they can provide the greatest value. 

It also changes how governance success is measured. Instead of defining success by completed reviews, teams should focus on how it helps the organization pursue AI opportunities with appropriate safeguards in place.

Governance Is Becoming a Strategic Business Function

AI adoption is moving quickly enough that governance teams cannot wait until late in the process to become involved.

By the time a project reaches a formal review, employees may already be using tools, business leaders may already have committed resources, and vendors may already have incorporated AI capabilities into existing platforms.

Organizations that are adapting successfully are bringing governance into earlier conversations about business priorities and technology investments.

During the episode, Rege compared this evolution to the transformation of human resources. HR became a more strategic function when it moved beyond administrative tasks and developed closer partnerships with business leaders. Governance functions are undergoing a similar shift.

The most effective governance teams understand the business objectives behind AI adoption, identify where risks may emerge, and help teams make informed decisions before challenges become difficult to address.

AI Literacy Is Becoming a Core Governance Skill

AI has created understandable uncertainty among many governance professionals.

Few legal, privacy, or compliance professionals expected their roles to involve evaluating AI agents, understanding model behavior, or advising on autonomous systems.

Developing AI literacy does not require every governance professional to become a data scientist. It does require a working understanding of how AI systems operate, how data moves through those systems, and where meaningful risks can emerge.

Several areas are becoming increasingly important:

• Citizen developer tools. Employees across organizations are using AI-enabled tools to create workflows, automate processes, and develop solutions that previously required technical resources. Governance professionals need to understand what these tools enable and where risks may arise.

• AI agents. As organizations begin deploying systems capable of taking actions on behalf of users or business functions, understanding accountability, permissions, and oversight will become increasingly important.

• Access and authorization. AI systems can only act within the permissions they are granted. Understanding how systems access data — and how those permissions are managed — will be central to responsible deployment.

Perhaps the most important skill is comfort with uncertainty. AI systems will continue to evolve, and governance professionals will increasingly need to make thoughtful decisions while regulations, standards, and technical capabilities continue developing.

AI Is Changing How People Interact With Technology

Some of the most significant governance questions may come from unexpected changes in human behavior.

People interact differently with conversational AI than they do with traditional software. Customers may share more information with an AI-powered chatbot than they would with a human representative. Employees may use AI tools in ways that were never anticipated during implementation.

Those interactions can create new categories of data and new questions about how information is collected, retained, and used.

Organizations should consider where AI is becoming part of customer and employee experiences and evaluate whether existing governance practices reflect those new behaviors.

Governance Helps Organizations Capture the Value of AI

Organizations are investing in AI because they expect it to improve operations, create efficiencies, and generate new opportunities.

Those benefits depend on the ability to deploy AI responsibly and sustain those initiatives over time.

Strong governance helps organizations identify risks early, establish accountability, and create confidence in AI adoption decisions. It provides the foundation necessary to continue investing in AI while reducing the likelihood that projects will need to be significantly redesigned or abandoned after deployment.

As Rege noted during the discussion, governance plays a critical role in protecting the return organizations expect from AI investments.

Preparing for the Next Phase of AI Adoption

Another quote discussed during the conversation may prove equally relevant:

"The pace of change has never been this fast, yet it will never be this slow again." — Justin Trudeau, World Economic Forum, 2018

Organizations should expect AI capabilities to continue expanding and becoming more deeply integrated into business operations. Governance approaches will need to evolve at a similar pace.

The organizations best positioned for the future will be those that treat governance as an essential part of AI strategy — one that helps identify opportunities, manage risk, and build the confidence necessary for long-term adoption.

AI is moving quickly. Governance must keep moving with it.

Watch the Full Episode

Listen to the full conversation with Ojas Rege on The Privacy Filter.

To subscribe to The Privacy Filter, click here.