Hi, everyone. Thank you for confirming that you can see my screen. Okay. And thank you so much for being here.My name is Marina Boudreaux, and I am the senior AI governance program manager at Cornerstone. We're an HR SaaS company that operates within a highly regulated sector. It's a privilege to be a part of Women in Tech Global Conference and to have the opportunity to talk about a topic that is becoming increasingly critical across every industry, operationalizing AI governance. Right now, most organizations are moving quickly with AI. They're experimenting, deploying, integrating, and scaling. And in many cases, that speed is necessary to remain competitive. But there's a growing gap, that I see across enterprises. Many organizations have AI policies. Many have AI principles. Some even have AI committees, but very few have operational AI governance. And that distinction truly matters.

A AI adoption is accelerating, and operational governance determines whether that acceleration creates trust or risk. Today, I want to focus on what it actually takes to move from policy to practice and build governance systems that enable responsible innovation without slowing business momentum. Alright. So this is where we're gonna go today. First, I wanna establish the gap. What is AI governance really and why is it different from compliance? Because if we misunderstand governance as simply legal compliance, we truly limit its value. Second, we're gonna talk about the human side of operationalization. This includes AI literacy, cross functional collaboration, and the relationships that governance practitioners must build internally. And third, we're gonna look at operational systems. And this is going to entail the practical infrastructure that makes governance real and repeatable. My goal today is to make AI governance feel practical, operational, and achievable, not theoretical.

This is not about slowing innovation. It is about making innovation sustainable. Responsible AI governance is often misunderstood as restriction, but operational governance is actually what enables scale. It creates clarity, confidence, and speed. So let's start with understanding the gap. This is the gap that I see repeatedly. Or get organizations often have principles, responsible AI principles, trustworthy AI principles, ethical AI principles, and they often have policies as well. Sometimes acceptable use policies and sometimes they're AI usage guidelines. And they absolutely have AI ambition. They want to move fast, they want innovation, and they want the competitive advantage. But operationally, there are often three things missing. Ownership, so who actually owns AI risk. Process, what happens when someone wants to deploy AI. And infrastructure, where is the visibility? Where is that oversight? And this is where governance often breaks down because policy by itself does not govern behavior. Operational systems do. So let's define AI governance.

AI governance is the organizational organizational system of decision making, accountability, and operational controls that guides how AI is built, deployed, monitored, and managed. That definition is important because governance is not a document and it certainly isn't a checklist. It's a system. And every governance system must answer three questions. First, decision making. Who decides whether AI should should be used in the first place? And then who approves it? Who evaluates that risk? And second, accountability. Who owns the outcomes? If the AI causes harm, bias, or failure, who is actually accountable? And third, control. How do we monitor performance over time? How do we intervene when something changes? AI governance is ultimately about creating organizational trust in AI, and this is both trust internally and externally. When governance is unclear, these questions remain unanswered. And when these questions remain unanswered, risk ownership becomes fragmented. And AI governance is rapidly evolving from a voluntary best practice into an operational exercise.

Organizations today are navigating a growing ecosystem of governance frameworks, management standards, and legal obligations. Some frameworks focus on risk management. Others focus on operational systems, like ISO 42,001. Others establish legally enforceable requirements. But together, they are shaping, what responsible AI adoption looks like globally. And the important thing to understand is that these frameworks are increasingly converging around similar themes. So we have risk management, accountability, oversight, transparency, and continuous monitoring. And one of the biggest misconceptions about AI governance is that organizations need completely separate programs for every framework or regulation, which is not sustainable. In reality, most major frameworks converge around a common operational foundation. They all require organizations to do what's, here on the screen. So we're looking at understanding, their AI systems, assigning accountability, managing risk, documenting decisions, and establishing operational insight oversight. Excuse me. So this is why operational governance matters so much.

When governance is embedded operationally, organizations are far better positioned to adapt as regulations evolve globally, which is happening quickly and often. And this distinction, is one of the most important, in this talk. AI governance is not the same thing as compliance. Compliance is absolutely part of governance, but governance is much broader. Compliance essentially asks, are we meeting our obligations? But governance is asking, should should we build this in the first place? Should we adopt it? If we build it, how should we build it? Who should oversee it? How will we monitor it? And how will we respond if it changes? I always say that as an AI governance practitioner, my main job is to just ask a lot of questions. And compliance tends to be obligation focused.

Whereas governance, as I mentioned earlier, is looking at the entire life cycle. It's a life cycle focused discipline. And compliance often looks backwards or at one point of time where governance is continuous to keep up with the the essence of AI, which is self evolving. And this matters because if organizations reduce governance to compliance, they miss the strategic and operational dimensions of AI risk. So if governance is so important, why does it break down? Usually, it's for these reasons. First, ownership is unclear. AI sits across product, engineering, legal, security, compliance, privacy, and business teams. There's a lot of folks involved. And that means that everyone touches it, but no one fully owns it. Second is collaboration is fragmented.

Engineering engineering moves fast, legal is managing exposure, and compliance is thinking about controls. And those priorities do not always align naturally. And third, literacy is uneven. Not everyone understands AI well enough to make informed decisions, and governance depends on informed decisions. This is why operational governance is not just a framework problem. We're talking about an organizational alignment problem, and governance failure is rarely caused by bad intent. It's usually caused by structural misalignment. So let's get into the meat of things. We're gonna start with a critical dimension, operationalizing through people, and this brings us to AI literacy. I just wanna make sure. Is are folks able to see the presentation? I just saw a comment that only the first slide is showing. Okay. You can see. Okay. Perfect. Glad to hear that. I had a small moment of panic there. Thank you. Thank you for confirming. Okay. So let's talk about AI literacy.

And I want to ground this in the framework of the organization for economic cooperation and development, so the OECD. At its core, AI literacy means understanding enough about AI to engage with it responsibly. So you don't necessarily have to build it. You don't have to engineer it, but you have to participate in decisions about it. That includes understanding what AI can do and certainly what it cannot do. So you have to understand AI limitations. And, of course, a critical dimension is understanding how to evaluate the outputs and when to challenge those outputs and when to escalate. This is operationally important because governance cannot function if the people who are participating in governance do not understands understand the systems that they are governing. So when we're looking at AI literacy, we're not talking about training. It is readiness, and this includes organizational readiness.

As AI changes how work gets done, literacy becomes a workforce capability. And, again, people don't need to build AI, but they increasingly need to understand how to govern and how to work alongside it. And operational governance lives at the intersection of these disciplines. We have technical, compliance, and legal. And at the foundational layer, we have business alignment. So the technical function, builds a system, engineering, product, data science. They understand capability, performance, and technical limitations. Compliance is building the controls and assurance. So this includes privacy, security, and operational risk. And legal builds defensibility. So we're looking at interpreting obligations and exposure. And governance will only work well when all of these disciplines collaborate and all are working toward alignment with business objectives, that foundational layer.

So if engineering works alone, risk is escalating. If legal works alone, innovation is slowing. Governance is truly that bridge. And governance breaks when any of these disciplines, operate independently. It really depends on coordinated participation. And the truth is that governance is deeply relational, and there are three relationships that matter most to a governance practitioner and which you must nurture and build upon. First, engineering and product, because governance has to be upstream. It it doesn't happen after deployment. It doesn't happen after launch. It happens at design and at ideation, responsible AI by design. Second, legal, because legal obligations must become operational requirements. Legal cannot operate in theory. It has to be translated into a process. And third, we have audit, audit risk assurance because governance must be defensible. It's not just design.

It has to be tested, verified, and documented. Along with asking a lot of questions, documentation is essential to AI governance. And one of the biggest mistakes organizations make is focusing only on governance, artifacts. Governance truly scales through relationships first. While structured sys excuse me. Structured systems are certainly, an essential part of the equation, and we'll talk about that more in the next section. Governance maturity is often less about policy quality and more about relationship quality. So now, as I mentioned, let's look at the systems that are required for effective AI governance. Frameworks are they they establish expectations. However, operational governance determines whether organizations can actually execute against them. So let's start with this first layer. If you want to govern AI, you need visibility, and I cannot stress this enough. That starts with an AI inventory.

And an AI inventory is going to answer simple questions. What a do what AI do we have? What models are in use? What vendors are involved? What use cases exist? Who owns them? And what risk level applies? And this sounds very simple, but it is truly foundational. If you don't know what exists, you cannot govern it. You cannot assess risk, monitor, or respond. So inventory is giving you that key piece, that visibility. And visibility is truly a prerequisite for governance. The second essential asset is policy. Policy creates decision boundaries. It clarifies what is allowed, what requires approval, and what requires oversight. Policy matters because it because it creates consistency, and it reduces ambiguity. But policy alone is truly insufficient, and this is important. People excuse me. Policy tells people what the rules are, and operations determine whether those rules are actually followed. That is what we call the policy to practice gap.

Policy should not simply exist. It should actively shape operational decisions. And the third essential layer is an intake system. This is where governance becomes proactive. An intake system creates a structural entry point for AI before deployment, launch, or adoption of a new system, before that risk actually materializes. And an intake process captures the business process and the AI cape capability and the data involved and, of course, the potential impact. So this is allowing organizations to assess before acting and that changes everything. If governance begins after deployment, it's truly already too late. Intake creates preventative governance instead of reactive governance. And the intake system is where governance becomes, as I said, proactive and allows governance to begin before risk enters production. So if we bring all of these components together, operational AI governance requires three key elements. First, literate people. People who understand enough about AI to make informed decisions.

Second, trusted relationships. Cross functional collaboration built on trust and shared understanding. And third, governance systems. So the infrastructure that makes governance repeatable and scalable. This is how we move from policy to practice. Policy establishes intention, people operationalize it, and systems sustain it. And the outcome is responsible innovation. It's not it doesn't slow innovation. It's better innovation. It's trustworthy innovation, and it's more resilient innovation. AI governance is the discipline that transforms AI ambition into organizational trust and leads to faster, safer scaling. The goal is not governance for its own sake. The goal is trusted innovation. And as we close, I want to leave you with something practical because AI governance can feel like a massive undertaking. And the truth is it it can be. But operationalizing AI governance does not begin with building the perfect framework. It begins with building the right foundations.

First, start with visibility. You cannot govern what you cannot see, so build that AI inventory. Second, create governance before scale. One of the most common mistakes is waiting until AI is already embedded in products, workflows, or decision making before thinking about governance. By then, governance becomes reactive. So build those intake processes early and establish ownership early. Third, invest in enterprise wide AI literacy. Not because everyone needs to become an AI expert, but because everyone who touches AI needs enough understanding to make informed decisions. Executives need to understand accountability, managers need to understand operational impact, and employees need employees need to understand responsible use. And, ultimately, moving from policy to practice requires a mindset shift. So from documentation to operationalization, from o, isolated oversight to shared responsibility, and from reactive control to proactive governance.

And if there's one thing that I hope you take away today, it's this. Responsible AI is not a document. It's an operating model. And the organizations that build that operating model now will be the ones best positioned to innovate with trust, resilience, and confidence. The future of AI will not be defined only by what systems can do. It will be defined what by what organizations can responsibly operationalize, and that is the work of governance. And thank you. I know that we only have a couple of minutes, but I'd love to.