Most Organisations Deploy AI Before They Can Govern It
A 2024 survey found that fewer than half of organisations conducting AI deployments had completed a formal impact assessment before going live. That is not a compliance footnote. That is the default operating mode for AI right now.
Healthcare systems, energy grids, public services, defence operations, smart city infrastructure: all running on AI-enabled tools, many at national scale. Governance failures at that level are not operational inconveniences. They are high-stakes events by definition.
The gap between deployment speed and oversight capacity is widening. Regulatory scrutiny is increasing. Public expectations around accountability are shifting. Productivity pressure is pushing organisations to move faster. Those forces do not resolve neatly. They compound.
What an AI Impact Assessment Actually Does
An AI impact assessment is the structured process of identifying, evaluating, and responding to the risks that arise from deploying an AI system. Done properly, it is the most practical tool available for turning responsible AI principles into something defensible.
The value is not just risk avoidance.
Impact assessments support regulatory compliance before problems surface, not after. They create early warning systems for issues that only become visible at scale. They align stakeholders around shared expectations and establish accountability trails that matter when things go wrong.
Despite this, they remain underused. Difficult to operationalise, easy to defer, rarely treated as a core part of deployment. Knowing they matter and actually doing them consistently is one of the defining failures of AI governance right now.
Why Governing AI Is Genuinely Hard
Part of the problem is structural. When an organisation deploys AI built on a third-party model, it often cannot get the information needed to conduct a meaningful assessment.
Providers may be unwilling to share how their systems work. In many cases, they are also genuinely unable to. The black-box problem is real: even the organisations building these models do not always have a clear account of how their outputs are generated. You cannot assess what you cannot see.
There is also a timing problem. AI risks are not static. They shift with context, grow as systems become more complex, and can amplify small issues into significant ones with surprising speed.
A one-time review at launch does not capture this. Governance that treats assessment as a launch gate rather than an ongoing practice will consistently miss the risks that matter most: the ones that emerge after deployment, under real-world conditions.
Add the resource burden of assessing every system, every update, every new context of use, and you see why shortcuts happen. Without dedicated capacity, rigorous assessment stalls deployment. That creates pressure to skip it entirely. Meanwhile, the regulatory backdrop remains unsettled. Organisations are being asked to govern against a standard that has not yet been fully defined.
The Deeper Problem: Frictionless Production Breaks Judgement
Underneath the compliance challenges sits something harder to fix.
AI has collapsed the cost of making things. Content, software, analysis, design: the economic friction that once rationed these outputs, and in doing so forced the people producing them to develop real judgement, has largely disappeared. What took weeks now takes minutes. What required expertise now requires a prompt.
The consequence is not a shortage of output. It is a surplus of the merely adequate. Work that is not exactly wrong, but is not meaningfully right either. Work that exists because it could be produced, not because anyone decided it should be.
When production becomes effectively free, volume stops signalling quality. The only question that matters becomes: what deserves to exist? And that question cannot be answered by the tools doing the making.
This is where human judgement becomes irreplaceable. Not judgement in the abstract. The specific, cultivated capacity to look at something and know whether it is right or merely plausible. Taste, in the fullest sense: the compressed verdict that comes from experience, from caring about the outcome, from having made enough decisions to understand what a good one feels like.
That cannot be automated. It has to be built. And it has to be exercised.
What Governance That Actually Works Looks Like
It is not a checklist completed by the team deploying the tool. It requires cross-functional input: people with different skills, different vantage points, different stakes in the outcome. The business owner who wants the tool deployed has a legitimate perspective. They should not be the only voice in the room.
It is not a one-time event. Assessments conducted only at launch will miss most of what matters. AI systems change, contexts change, and risks evolve across the full deployment lifecycle. Governance that does not follow the system into production has already stopped working.
And the most important requirement is the hardest to systematise. Organisations need the human judgement to ask not just whether an AI system can be deployed, but whether it should be. Frameworks can create the conditions for good decisions. They cannot make the decisions themselves.
The organisations that navigate this era well will not necessarily have the most sophisticated AI. They will have built the capacity to govern it. That capacity is not a constraint on progress. It is what makes progress worth having.
If you are building AI into your operations and governance is still an afterthought, the gap is already costing you. Start with the assessment, not the deployment.