Pilots start with one sponsor and a credit card, while governance needs an owner, an inventory and a decision about acceptable risk. Pilots finish in weeks, and policy takes quarters. The gap closes when you govern by a short intake step and a living inventory instead of a long policy document.
Where does the gap come from?
Four causes show up repeatedly.
No inventory. You cannot govern what you cannot list. A pilot built on a hosted model, a browser extension or a coding assistant often never enters a register.
Unclear ownership. Security, legal, data and the business each hold a piece. No one holds the whole decision, so it waits.
Frameworks arrive as documents. NIST's AI Risk Management Framework 1.0, released January 26, 2023, is voluntary and organizes work into four functions: Govern, Map, Measure and Manage. It is a good map, but a map does not move a pilot through review on Tuesday.
Moving rules. The EU AI Act entered into force on 1 August 2024, reached general application on 2 August 2026, and the high-risk dates for Annex III systems were pushed to 2 December 2027 by the AI Omnibus. NIST says the AI RMF is itself being revised. Teams wait for the dust to settle, and pilots do not.
Why is waiting expensive?
Pilots become production by accident. A demo that touched sample data gets a real database connection, then a customer. The controls that would have been cheap at week one are expensive at month six. By then several teams depend on it.
What does a working minimum look like?
Govern the pilot, not the technology. A one-page intake form with five questions is enough to start.
- What data does it touch, and is any of it personal or customer data?
- Which model or service, and under what terms?
- Can it take actions, such as sending messages or changing records?
- Who owns it, by name?
- What is the end date or review date?
Anything touching regulated data or taking actions goes to a short review. The rest gets registered and moves on. Because the NIST framework is voluntary, you can scale it to your size.
A constructed example
A finance team trials an assistant that drafts vendor emails. Intake takes ten minutes. It answers: no customer data, a hosted model, drafts only, an owner, a 60 day review date. It is registered and approved. Three weeks later someone asks to let it send directly. The "can it take actions" answer flips, so it goes to review, where the team adds an approval step. Nothing was blocked for a quarter.
How to check or apply this
- List every AI tool in use, including browser extensions and assistants inside developer tools. Ask teams, and check procurement and SSO logs.
- Name one accountable owner per tool.
- Adopt the five-question intake and publish it where teams will find it.
- Map your register to the Govern, Map, Measure and Manage functions so you can show coverage.
- Set review dates so pilots expire or graduate.
- Track EU AI Act dates only for the systems you actually offer or deploy in the EU, and confirm with counsel.
Safeguard offers agent identity and MCP Guardrail controls that give agents named identities and bounded tool access, which supports the ownership and inventory steps.
What should leaders avoid?
Two mistakes recur. One is a ban that pushes pilots underground, where you lose all visibility. The other is a policy so long that no one reads it. Aim for fast, visible approvals with clear triggers for deeper review. Measure the share of AI tools in use that appear in your register, and the days from request to decision. If both numbers improve, governance is catching up.
Quick check
Is the NIST AI RMF mandatory?
No. NIST describes it as intended for voluntary use. Contracts or regulators may still point to it.
Do I need a full AI policy before any pilot?
No. A short intake and a register let you start safely and learn what the policy must cover.
Sources
- NIST, AI Risk Management Framework
- European Commission, AI Act
- NIST NCCoE, Software and AI Agent Identity and Authorization
Last reviewed: 18 October 2026.
