AISec Advisory
Note

Governance is what keeps AI experimentation alive

Rajendra Patil · November 3, 2026

A new study from MIT Sloan looked at two organizations that gave their people the same things: a secure AI sandbox, training, and encouragement to build tools that could help the whole organization. Two years later, one had 141 AI solutions in use. The other had three.

The researchers, Katherine Kellogg, Batia Wiesenfeld and Arvind Karunakaran, found that the difference was not the technology, the readiness of the staff, or the rules they worked under. It was the support around the people doing the experiments. (I read MIT Sloan’s summary of the working paper, not the full paper, so treat the details below as that summary’s.)

People did not refuse. They quietly stepped back.

At the law firm in the study, more than 80% of the domain experts eventually dropped out of the AI work. Nobody objected. The work simply kept growing: trial and error to learn what the tools could and could not do, reviewing outputs with colleagues in other departments, and redoing things as models changed. None of it showed up in performance reviews or pay, so people stopped.

That is a different problem from the one most leaders plan for. They expect resistance. What they get is silence.

What the successful organization had

The medical center in the study did four things the law firm did not do as well:

  • Ongoing education, not a one-time training.
  • Shared ways to judge results, so teams could compare and improve their work together.
  • A formal risk-screening process, plus technical help to connect tools to real systems.
  • Credit for the work, written into job duties, reviews and promotions.

Where governance fits

Governance often gets described as the brake. In this study, two of the four practices were governance: the risk screen and the shared evaluation. They worked as support. People knew what was allowed, how results would be judged, and who would help. That removes a kind of friction that otherwise sits on every individual.

The same pattern shows up with AI agents. When nobody can answer “what can this agent see?”, “who is accountable if it gets it wrong?” or “is this allowed?”, careful people hold back, and less careful people work around the rules. Both outcomes look like chaos from the top.

What to do this quarter

  1. Write down the rules in plain language. What data may go to which tool, who approves new agents, and what happens when something goes wrong.
  2. Run a simple risk screen for every new agent, such as the five questions, and publish the outcome.
  3. Agree on how results are judged before teams build, so success is not a matter of opinion.
  4. Make the work count. Name AI experimentation in roles and reviews, and give people time for it.
  5. Ask the people doing the work what is slowing them down, and fix the top item.

If you want help setting up a lightweight risk screen or governance baseline that supports your teams instead of slowing them, book a free 15 minute call.

Working through this yourself?

Fifteen minutes, free. Tell me what you are trying to do.

Book a call