The first two articles in this series examined how to rebalance technology governance toward platform engineering in contexts of high human variability, and why tool positioning is becoming a strategic liability in a world of accelerating AI. This third article steps back from the technical layer to address a more basic challenge: the organizational resistance that makes any of these transformations genuinely difficult, and the asymmetric risk of not moving fast enough.

Organizations have spent decades building systems to control technological risk. They have not built systems to detect technological irrelevance.

An Organization Does Not Have Processes: It Is Its Processes

There is a common way of framing organizational change that sounds reasonable but is misleading: the idea that an organization has processes, in the same way it has office space or software licenses, assets that can be evaluated, updated, or replaced through a sufficiently deliberate management decision.

The reality is more unsettling. An organization does not merely possess its processes. In a meaningful sense, it is its processes. They define how decisions get made, how work gets coordinated, how risk gets assessed, how value gets delivered. They encode the accumulated responses to past failures, regulatory pressures, and hard-learned lessons. Rather than a layer sitting on top of the organization, they are its operating identity.

This is the central insight behind Allen Holub’s work on systems of work: you cannot remove or change one element without affecting the entire system, and the system will actively resist changes that threaten its coherence, pulling the organization back toward its previous state. Organizational resistance to change is therefore not a failure of leadership courage or a deficit of innovation culture; it is the system functioning exactly as designed. The challenge is not to overcome that resistance through force of will, but to understand which parts of the system need to transform, and how to do so without collapsing the coherence that holds everything together.

AI Is Not Waiting at the Door: It Is Already Inside

Regulated organizations (financial institutions, healthcare systems, energy companies, public sector bodies, legal and professional services firms) have historically managed technological adoption through deliberate, controlled processes. This was rational. In a stable technological environment, moving carefully reduced integration risk, ensured regulatory compliance, and preserved operational continuity.

That posture is increasingly misaligned with the current moment. AI does not present itself as a discrete technology that organizations can choose to evaluate and adopt on their own timeline. It is infiltrating through every layer of operations: the productivity tools individual contributors are already using, the platforms vendors are embedding AI capabilities into, the competitors who are quietly compressing delivery timelines and cost structures, the talent market where expectations about AI-augmented work are shifting rapidly.

In financial institutions, the question is no longer whether AI will affect credit risk modeling, fraud detection, regulatory reporting, or client-facing services. It already does, whether through internal adoption or through the competitive and regulatory environment that surrounds the institution. The relevant question has shifted from should we adopt AI? to at what rate are our current processes becoming a competitive and operational disadvantage, and are we measuring that rate?

The Asymmetry of Risk That Does Not Appear in Governance Reports

This is the most structurally important challenge for regulated organizations, and it is one that their governance frameworks are poorly designed to surface.

The risk of moving too fast with AI is visible and auditable. It manifests as compliance failures, model risk incidents, data governance violations, operational disruptions. It appears in risk committee reports, regulatory examinations, and audit findings. Regulated organizations have spent decades building sophisticated machinery to detect, quantify, and contain exactly this type of risk, and they are genuinely good at it.

The risk of not moving fast enough is structurally different. It is diffuse, cumulative, and largely invisible to conventional risk measurement frameworks. It does not generate an incident or trigger a regulatory finding. It accumulates silently as a widening gap between the organization’s operational capabilities and those of its environment: competitors, technology providers, talent expectations, and eventually regulators themselves.

By the time this second type of risk becomes visible, it typically manifests not as a discrete event but as a condition: an inability to attract engineering talent with relevant AI skills, a growing gap in delivery speed relative to competitors, a technological debt so deep that transformation becomes structurally prohibitive.

Consider a concrete illustration. A major bank’s regulatory reporting process relies on manual data consolidation across legacy systems. The cycle takes three to four weeks per quarter, absorbs dozens of analyst hours, and produces results that are already partially stale by the time they reach the board. An AI-augmented equivalent could compress that cycle to days, reduce error rates, and free the analysts for higher-judgment work. The risk of implementing such a system is visible and manageable (model validation, auditability, change management). The risk of not implementing it accumulates invisibly: mounting operational cost, growing talent frustration, and an expanding gap relative to institutions that have already made the transition. The first risk has a line in the risk register; the second does not.

The asymmetry is this: the governance machinery of regulated organizations is optimized for the first type of risk and structurally blind to the second.

Regulation as Constraint, and as Underestimated Lever

In conversations about AI adoption in regulated industries, regulatory constraints are frequently invoked as the primary justification for caution. This framing is not wrong; regulatory constraints are real and consequential.

But it is increasingly incomplete, and in some cases it has become a rhetorical convenience that obscures something less comfortable: the pace of adoption is often constrained less by regulation than by organizational inertia dressed in regulatory language.

Regulators themselves are not standing still. Financial supervisory authorities, including the AMF, OSFI, the European Banking Authority, and others, are actively developing AI governance frameworks, publishing guidance on responsible AI use, and in some cases explicitly encouraging institutions to build AI capabilities in areas such as real-time compliance monitoring, fraud detection, and operational risk management. The implicit message from regulators is not “wait until we have figured this out” but “develop the governance maturity to use these tools responsibly.”

An organization that waits for the regulatory framework to be fully stabilized before investing in AI capabilities is making a specific bet: that the cost of early compliance investment outweighs the cost of late adoption. In a faster-moving environment, that bet is becoming harder to justify.

Regulation, properly understood, is a constraint on the speed and form of AI adoption, not a justification for its absence.

Navigating the Transition: Changing Without Breaking

The response to this challenge is not a wholesale transformation that attempts to change everything at once. Holub’s insight about systems of work applies with particular force here: an organization that tries to revolutionize its entire operating model in response to an external pressure is as likely to collapse its coherence as to improve its capabilities.

This requires organizations to develop a capability that is itself relatively new: the ability to map their own processes according to their strategic value in an AI-augmented environment. Not all rigidity is equivalent. Some processes derive their value precisely from their stability and resistance to change: regulatory compliance mechanisms, audit trails, risk controls, fiduciary obligations. These are not candidates for AI-driven transformation. They are anchors that must be protected even as the surrounding system evolves.

Other processes derive value from their efficiency and adaptability: knowledge management, delivery pipelines, onboarding, tooling, internal reporting, operational monitoring. These are precisely the areas where AI augmentation offers the highest return, and where the cost of inaction is accumulating most rapidly. Treating them with the same conservatism as core compliance processes is a category error, not prudent risk management.

The practical implication is a dual governance posture: rigorous protection of the processes whose value is their stability, combined with active transformation of the processes whose value is their performance. The organizations that handle this transition most effectively will be those that can hold both imperatives simultaneously, and resist the temptation to use the first as cover for avoiding the second.

This is not a call to abandon prudence, but to redefine where prudence actually applies.

Gabriel Mailhot
Software Architect and Software Engineering Quality Advisor
Series: Organizational Engineering for the AI Era