What companies are getting wrong about AI

Most companies are already using AI; in fact if you are not using it you risk being tagged as “overly conservative and risk-averse” or too “legacy thinking”… The use is not the problem though, the problem is the lack of control around it.

From a legal and governance perspective there is a clear gap: AI is moving fast inside organisations, taken lightly as “just IT”, or even gatekept by IT teams as a “project within their remit”. Oversight is not keeping up. And don’t take me wrong, I am not talking about legal compliance here, I am talking about data architecture and governance (a concept that is very often repeated but rarely understood).

Wanna make it more concise? Here are the top 5 risks I see:

1. Lack of visibility: No inventory – no clear view of WHAT (ai tools are being used), WHO, WHY.
2. Lack of legal grounding: No purpose mapping (what we call “legal basis”) – no documentation to support the processing activities (often linked to personal data).
3. External dependency: Tools adopted quickly without understanding who your vendors are, where your data goes, if it’s reused or retained and if it contributes to machine learning/AI model training.
4. Lack of internal governance: No policy, no rules, no ownership. In the name of flexibility and innovation.
5. Regulatory positioning: All jurisdictions are in one way or another trying to regulate AI, ignoring this already at the design phase just means having to catch up later under pressure.

AI is not just another IT tool. Nor is it just another law. It eventually affects how organisations innovate. It’s high time organisations got the right people around the table and gave this clear ownership – and please, this does not mean that another committee will save the day!