4 areas where companies need AI guardrails

Artificial intelligence is making it easier for organizations to experiment, build prototypes, and launch new applications. But as AI activity spreads across an organization, so can redundant investments, applications that don’t scale, and unexpected operational costs and risks.

Creating a unique set of controls for every AI application isn’t sustainable, according to a new research briefing from the MIT Center for Information Systems Research. Instead, companies should place guardrails around the parts of the organization where oversight can have the greatest impact. 

Based on interviews with 48 leaders at 28 organizations worldwide, MIT CISR researchers Alan Thorogood, Peter Reynolds, and Asif Gill identified four domains that warrant guardrails: architecture compliance, innovation management, workforce enablement, and supplier governance. 

The goal, researchers say, is to give companies enough visibility and control to step in when needed without slowing their AI efforts. Here’s what that involves in each of the domains. 

1. Architecture compliance

A strong AI architecture can help business units develop and deploy applications faster while giving the organization clearer points for oversight.

One emerging approach separates data, AI models, and AI agents into distinct but connected platforms, with governance built into each of them. The data platform manages access to structured and unstructured data; the AI platform provides a central place to deploy, test, monitor, and track models; and the agentic platform manages AI agents and workflows, including logging agent activity, controlling what agents can access, and escalating decisions for human review when necessary.

“Maintaining distinct platforms enables business units to develop and deploy AI use cases faster because it promotes reuse of existing capabilities [and] clarifies where to implement oversight and auditing, making compliance faster and simpler,” the researchers write.

2. Innovation management

AI has lowered the barrier to turning an idea into a prototype, but decentralized experimentation can leave organizations with overlapping projects or promising demos that prove too expensive or difficult to scale.

The researchers identified two controls to address that problem. The first is early triage: quickly deciding whether an AI initiative belongs in a centrally managed portfolio or should remain within a business unit.

The second is more disciplined project selection. Along with potential business value, portfolio managers should consider factors such as data readiness, integration complexity, production performance, inference costs, observability, and decision explainability. Those criteria can help identify projects that are likely to work beyond the demonstrated stage. 

3. Workforce enablement

Companies need AI talent, but hiring more specialists won’t close every skill gap. Organizations also need to reskill existing employees and design roles for work that will increasingly be augmented by AI.

Giving business units more control over AI development can help engineers build domain expertise and make teams accountable for outcomes. But it can also lead to siloed data and applications that central technology teams struggle to support.

Generative AI Business Sprint

Attend Online

REGISTER NOW

The researchers identified three responsibilities that should remain centralized: 

• Technology teams should oversee the process of moving AI applications into production, including access, security approvals, and integration
• AI centers of excellence should set standards and provide tools, architecture, and secure environments for experimentation, and support the business units. 
• Human resources should establish consistent hiring practices, career levels, training, and structures for AI-related roles and skills; business units should take responsibility for recruiting and reskilling.

4. Supplier governance

As AI advances, companies are relying more heavily on outside suppliers for technology and expertise. That creates new questions about third-party risk, changing capabilities, and costs — particularly given that usage-based pricing can make AI spending difficult to predict.

The researchers recommend implementing controls across AI governance, procurement, and financial operations. Governance forums can establish guidelines for AI use, approve suppliers and product versions, and conduct ongoing supplier-risk reviews. Procurement teams can strengthen contract terms around AI risks, audit rights, and pricing while bringing technical and financial experts into vendor reviews. And financial operations teams can track AI costs and provide frequent reporting to improve financial oversight and the reliability of business cases.

How to get started on establishing AI guardrails 

Companies don’t need to implement every possible control at once. The researchers recommend starting with three moves: 

• Assess all four domains and the controls discussed.
• Identify guardrails that address the organization’s biggest current risks.
• Measure progress over time and course-correct when necessary. 

Read the research: “Establishing Guardrails on the AI Roller Coaster”

Alan Thorogood is responsible for research and member engagement in the Asia-Pacific region for MIT Center for Information Systems Research. He explores how organizations partner effectively with others of various sizes or types. His research draws on his background in financial services, the public sector, and multinational consulting companies. 

Peter Reynolds is an industry research fellow with MIT CISR. He has more than 20 years of experience as a senior executive shaping and leading organizations through their digital journeys. He has served in a variety of roles, including chief technology officer, chief innovation officer, and digital transformation director. 

Asif Gill is a research collaborator with MIT CISR. He is a professor and researcher at the University of Technology Sydney school of computing. His applied research and innovation work focuses on the large-scale data-intensive enterprise software systems that target the challenges of academia, industry, government, and society