And this is only becoming more pressing as agentic AI starts acting rather than simply responding, there's less room to catch problems after the fact. Gartner expects more than 40% of agentic AI projects to be cancelled by the end of 2027, largely because the risk controls were never properly built in.¹ IAPP's research already shows AI governance work has become close to universal among organisations actively using AI, nearly nine in ten now say they're working on it.² Regulations are also heading the same way, with the EU AI Act turning what used to be good practice into compliance obligations, with the heaviest requirements landing on high-risk use cases. As AI takes on more autonomy, responsibility has to be engineered earlier, not enforced later.
Responsibility gets built much earlier, in the inputs: the data a model was trained on, how people actually work with it day to day, the standards that data and training were held to, and the internal and external controls it was evaluated against. None of that has to be perfect on day one. Inputs can be strengthened over time, and keeping them right as models, regulations and use evolve matters as much as getting them right to begin with. But when the input is sound, the output has a far stronger foundation to stand on. The input frames the output, not the other way around.
AI governance can't be static either. Guidelines feel current when written and outdated by the time they're rolled out, because the technology underneath keeps moving. A document signed off once, or a spreadsheet everyone means to keep updated, doesn't solve this. It just relocates the same static problem to a different file, still one manual update behind whatever changed last week. This is where dedicated AI governance software, like Deeploy, earns its place: live monitoring keeps watching the system itself, flagging drift, misuse, or a change in behaviour as it happens, so governance moves at the same pace as the technology it's meant to keep in check.
This matters beyond compliance. Organisations that get the input right - the data discipline, the working practices, governance that keeps pace with the technology - scale AI with confidence rather than caution, and that confidence is what turns AI from cautious pilots into something that actually grows the business. Companies still governing AI only at the output stage are, almost by definition, stuck reviewing every result one at a time. Companies that engineered the input are the ones who can let it run.
Together, this is what Deeploy and BearingPoint work on: helping organisations properly understand their use cases, and get the right tooling in place to solve them, so responsible use isn't a separate step, but the foundation the rest of AI is built on.
This blog post is a contribution from BearingPoint and Deeploy. Want to discuss this more? Come find them both at their stands at Data Expo 2026.
Sources: ¹ Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 ² AI Governance Profession Report 2025 — IAPP