Why governance, risk and compliance should be built into AI integration from the start

Governance, risk and compliance can often be viewed as the brake for AI and its integration into core products or systems, especially in regulated industries like insurance and pensions.  In most cases, the real problem is timing.

Teams build functionality, and it’s often not until they  are ready to launch, questions arrive about certification, regulation, security and the evidence regulators may expect. As a consequence, initiatives slow.

Governance or “red-tape” can often foot the blame for the delay, but the reality is it came from addressing it too late. That’s why at the core of innovative product developments, teams must bake controls in from the start, allowing AI to be the accelerator for innovation, not the brake.

Featured in this article:

• Governance can reduce delays when it is built in from the start. Organisations avoid much of the rework that appears when questions around controls, security, regulation and evidence only surface at the point of deployment.
• Speed and safety do not have to compete. With the right architecture, trust can support faster progress because teams know which boundaries apply, what needs to be recorded and where human intervention is required.
• The EU AI Act can be treated as design discipline rather than a checklist. Understanding the use case, assessing risk, applying controls and keeping evidence as part of the process creates a more practical route than adding those requirements afterwards.
• Evidence should be created as the process runs. When compliance, oversight and auditability are built into the system itself, organisations spend less time reconstructing decisions later and create a stronger foundation for moving AI from experimentation into live operations.

Reframing governance as an AI accelerator

There’s pressure to keep up with AI, whether that’s from boards keen to leverage its power, customers expecting faster and smarter service, or competitors already putting it to work.

And AI projects do often move quickly at the start. Teams test use cases, deploy early solutions and prove that the technology works. But then the harder questions arrive. What controls apply? What evidence will a supervisor expect? How should security, regulation and certification be handled?

When those questions come late, teams have to stop and revisit work they have already done. Governance appears to be the cause of the delay, but its place in the process is the real issue.

It’s the organisations who build controls in from the start are the ones who can move faster.

John Reynders, CEO of Keylane, puts it directly:

There are risks on both sides. Uncontrolled experimentation creates one. Waiting for certainty while the market moves creates another. When thinking about regulation, and innovation, there is a useful parallel with the development of the car. The technology alone did not make driving something billions of people would trust every day. Roads, traffic rules, speed limits and safety measures developed around it.

Iris Reynisdottir, Head of Product at Keylane, makes the point clearly:

Governance does not have to limit ambition. It can make that ambition trustworthy enough to scale.

Read the EU AI Act as design discipline

Since August 2026, AI used for risk assessment and pricing in life and health insurance is classified as high-risk under the EU AI Act. Treat the Act as a checklist and it creates work. Treat it as design discipline and the requirements become part of the process: understand the use case, assess the risk, apply appropriate controls, be transparent and keep evidence of what happened.

Insurers and pension funds already work within frameworks including Solvency II, IFRS 17, GDPR and DORA. Evidencing decisions is not new. AI increases the number and speed of decisions that may need to be evidenced. That makes the way organisations capture that evidence more important.

Make evidence part of the system

If a platform creates evidence while the process runs, compliance becomes part of the system rather than a separate exercise afterwards. That reduces and even avoids the need to pause an AI programme later to reconstruct decisions, add controls or explain how a process operated. This is where governance becomes operational rather than procedural. Controls, transparency and evidence are built into the way the process works from the start, so teams know which boundaries apply, what needs to be recorded and where human intervention is required.

This becomes more important as AI takes on a larger role in day-to-day operations. As the number of AI-supported decisions and actions grows, governance becomes much harder to manage as a final review step. Building evidence into the architecture gives a clearer route from experimentation to deployment because control, oversight and accountability are already part of the process. It does not remove the need for governance, but it does remove much of the friction that comes from adding it afterwards.

The real value goes beyond compliance. It gives a more workable way to scale AI across operational processes. When governance, evidence and oversight are designed into the architecture from the start, teams spend less time revisiting what has already been built and more time improving the processes where AI can create value.

The broader perspective

This article draws on Innovation Built on Trust, Keylane’s whitepaper on AI in insurance and pensions. Read the full whitepaper for Keylane’s broader view on governance, trusted data and the foundations needed to use AI in regulated environments.