The share of organizations in the driving-adoption phase of AI maturity jumped from 13% to 22% in Q2, the largest movement anywhere on the maturity curve, according to the latest KPMG AI Pulse Survey. Yet only about a third of organizations say roles, responsibilities, and processes for AI governance are clear and well managed, and just 29% have a named C-suite executive accountable for AI-informed decisions. The gap between scaling AI and governing it threatens to fill innovation pipelines with projects that should never have been funded.
Steven Hill, managing partner at cybersecurity and AI governance advisory firm OakTruss Group, offers a blunt test for whether strategy and governance are aligned. "Can the CIO answer, without a project, what every AI system in the company did last month and who is accountable for each?" he said. "If that takes a fire drill, then AI strategy and governance are running on separate tracks."
Move risk tiering upstream
Most organizations tier risk and governance systems at deployment, which turns governance into a tax that arrives late and gets contested. Hill argues tiering should begin at portfolio assessment, when leadership decides what to fund. "The tier sets the control load, the control load sets the true cost, and the true cost determines whether the use case clears its hurdle rate at all," he said.
AI initiatives often look attractive until continuous oversight costs are priced in. The range between high and low oversight can be dramatic. A CIO who surfaces that information early prevents the portfolio from filling with initiatives that never made financial sense. For executives building an AI for Executives & Strategy framework, this means embedding coarse and fine-grained risk tiering into every stage-gate of the innovation pipeline - starting at the workshop phase where ideas are first evaluated for project risk and complexity.
Own observability
CIOs frequently inherit AI governance because AI looks like technology, but the accountable owner of a system that denies credit is the one who owns credit, not the platform. Hill said the CIO's real competence is making behavior observable through inventory, logging, telemetry, and standing reporting. Risk appetite, tiering decisions, and named ownership belong to the business and the board.
"A CIO who accepts the whole thing takes unbounded liability for decisions they don't make, and lets the business skip the work," Hill said. The practical move is building an observability layer and handing the business an AI register that forces the naming conversation. This extends beyond implementing a governance platform - full observability must reach into original AI idea repositories and use case registers. The US federal government's Federal Agency AI Use Case Inventory demonstrates how such a register provides upstream data on mission and business objectives. For CIOs navigating these responsibilities, an AI Learning Path for CIOs can help build the technical and strategic skills required.
Observability must also cover AI economics and ROI, both estimated and actual. KPMG's research shows organizations with full cost visibility are five times more likely to report established ROI than those without it.
Make technical artifacts platform, not policy
AI governance policies written as documents are easy to ignore. When governance lives in the platform itself, sidestepping becomes far harder. "Strategy and governance drift apart when governance lives in a document, and strategy lives in systems," Hill said. Registration and logging should be properties of the platform - no model access, compute, or production path exists without being in the inventory.
If governance is opt-in policy, shadow AI wins and the inventory is stale the day it's finished. If it's infrastructure, every new initiative inherits governance by default, and oversight scales at the speed of adoption. This is the CIO's highest-leverage contribution, and one no one else in the organization can make.
Why this matters for executives and strategy leaders
Scaling AI requires more than governance checklists. It demands clear lines of sight between strategy, governance systems, and processes so governance remains cognizant of strategy and vice versa. The organizations moving fastest through the adoption curve are those where accountability is named, risk tiering happens before funding decisions, observability is infrastructure rather than an afterthought, and the business - not just IT - owns the outcomes. If your CIO cannot answer what every AI system did last month without launching a project, the two tracks have already diverged.
Your membership also unlocks:
