Traditional governance was designed as a brake. It exists to prevent mistakes, manage risk, and ensure compliance. In a world of 18-month waterfall projects, that made sense.

In a world of 6-week AI cycles, governance must be the accelerator.

The EU AI Act illustrates why. The legislation is still being shaped, yet its contours are already shifting organizational behavior. Companies that wait for the final text before building their compliance framework will find themselves years behind. Companies that build adaptable governance – frameworks that can absorb regulatory change without shattering – can move while others freeze.

Good governance in the exponential era does two things: it defines the boundaries clearly enough that teams can operate autonomously within them, and it evolves fast enough that the boundaries reflect reality rather than last year’s assumptions. It is not about removing constraints, but making constraints precise enough to enable speed in adaptation, appropriation and experimentation.

Governance built for 18-month waterfall projects will strangle a 6-week AI cycle. You need guardrails that let you move fast, not walls that stop you moving at all.

The ancient Chinese military general, strategist, and philosopher, Sun Tzu, wrote: “If you know yourself and know your enemy, you need not fear the result of a hundred battles.”

In the context of organizational AI, “know yourself” means having a clear, unsentimental view of where the organization hurts. Where do your customers wait? Where do internal processes break? What work do your best people spend their time on that they should not be doing?

“Know your enemy” means understanding the risk landscape: the technology curve, the regulatory environment, the competitive dynamics, and the emerging threats on the horizon.

Most organizations skip the diagnosis and jump straight to “let’s do AI.” They implemented a chatbot because competitors did. They spin up a pilot without defining which problem it solves. The result is projects that impress stakeholders in demos and deliver nothing of true value in production. You cannot aim a technology you do not understand at problems you have not identified.

An army without training or procedures will fail every time. You need to know yourself – your pain points, your friction, your actual problems – before any model can help you.

There is a difference between understanding a concept and knowing it in your bones. Organizations that have never run an AI project will not suddenly execute when the board demands it. They will fumble. They will pick the wrong problem. They will underestimate data readiness. They will be paralyzed by the first failure.

AI capability is not acquired through strategy documents or conference attendance. It is acquired through deliberate, repeated practice. Each cycle – prototype, test, fail, learn, repeat – builds institutional muscle memory. The first attempt will be clumsy, the fifth will be faster, and by the twentieth, the organization will recognize patterns that are invisible to beginners.

This is why the 80% failure rate on AI projects is not the catastrophe it sounds like. In the old paradigm, an 80% failure rate meant burning years and millions on dead ends. In the new paradigm, where cycles are measured in weeks or months, an 80% failure rate means you attempted five things – and the one that succeeded delivered something that was impossible a year ago. The math flips when the cost of failure drops and the value of success rises.

But the math only flips for organizations that practice. An army without training fails every time, as Sun Tzu understood. An organization without AI practice will fail at the same rate – but without the compensating upside.

80% of your AI projects will fail. That’s fine – if your cycles are short and your organization knows how to learn from each attempt.

The risk landscape is not standing still while you build these capabilities. It is shifting on multiple axes simultaneously.

And so is AI regulation. The EU AI Act is being shaped through negotiation and will continue to evolve after coming into force. Organizations need compliance frameworks that are designed for adaptation, not static checklists.

Meanwhile, broader technology risks continue to emerge. Quantum computing will eventually break today’s public-key encryption standards. This raises an important question: is this a company-specific issue or a systemic, industry-wide challenge? In an ideal situation, your IT function is already monitoring these developments and keeping systems updated. However, once Schrödingers cat is out of the bag, reacting is no longer sufficient. Crypto-agility and preparedness must be embedded in your governance framework well in advance, rather than implemented in response to a crisis.

The principle applies across the entire landscape: the threats you prepare for today are the ones that will not blindside you tomorrow.

You cannot wait for the regulations to settle – they will not. Build adaptable compliance into your operating model now.

Thomas Wisbech is a technologist at Darize. He moves fast and creates results across new frontiers. His track record spans AI strategy, blockchain, public policy, lobbying, IT/OT integration, and quantum security – most notably as the driving force behind Energinet’s early adoption into AI, blockchain secured energy certification and participation in CryptQ quantum key distribution project, which evolved into the QGRID initiative securing Denmark’s critical energy infrastructure. Thomas has collaborated across organizations towards common goals and has resulted in turning them from research and intend into production ready and mature projects. He is a practiced public speaker who builds the coalitions and momentum that turn research into field-tested reality appropriating technology into value.