\n\t\t Entrepreneur \t<\/p>\n
Back in 2013, Target made headlines globally when a cyberattack exposed the payment card information of 40 million of its customers, along with the personal data of 70 million others.<\/p>\n
At the time, the breach was widely described as a cybersecurity failure, but it was more than that. It was also, by and large, a governance problem, one that mirrors what we\u2019re seeing today as organizations look to scale through AI.<\/p>\n
With no federal framework in place to guide how AI is governed in practice, organizations are defining their own guardrails to support responsible implementation and build trust. But the absence of regulation doesn\u2019t mean the absence of risk. Organizations deploying AI today are still operating within existing legal structures that govern areas like data privacy, consumer protection, and employment practices, to name a few. If an AI-assisted decision exposes personal data or introduces a material error, the organization remains accountable.<\/p>\n
AI governance can\u2019t afford to wait for regulation to catch up. The Target breach and the years that followed marked a watershed period that elevated cybersecurity to a board-level risk. During that time, I was brought in to lead information security for an operator of critical internet infrastructure. Like many in that moment, I was forced to examine where governance hadn\u2019t kept pace with operations.<\/p>\n
As someone who\u2019s spent her entire career in technology, I\u2019ve come to know one constant. Technology moves, and governance rarely keeps up until it has to. Enterprise resource planning, or ERP, implementations, for example, have been widely adopted for decades and rarely fail because of the technology itself. The challenge is getting an organization to align on a single version of the truth across data, processes, and systems.<\/p>\n
AI is that same forcing function, one generation later. Organizations that haven\u2019t resolved those underlying issues are about to encounter them again with AI adoption, but at a much higher speed.<\/p>\n
Here are three considerations every organization should consider before deploying AI at scale.<\/p>\n
One of the greatest challenges in governance isn\u2019t access to information; it\u2019s a lack of shared understanding of its impact.<\/p>\n
Over the course of my career, I\u2019ve learned to translate information across legal, security and operations, and have experienced how differently each function interprets risk. A technical risk assessment may resonate clearly within a security team for example, but it doesn\u2019t always translate effectively in a boardroom or in an operational review.<\/p>\n
In the months following the Target breach, the risks associated with third-party vendor access weren\u2019t broadly understood at the executive level. Making the case for investing in the right security protocols to manage that risk required translating a technical issue into business terms that leaders could evaluate and act on.<\/p>\n
That same dynamic is playing out with AI. According to IBM\u2019s 2025 CEO Study, 61 percent of CEOs say they aren\u2019t fully prepared to manage the complexity they face. The challenge isn\u2019t awareness, it\u2019s alignment. Different parts of the organization understand different pieces of the risk, but often no one is translating how those risks connect.<\/p>\n
Effective governance depends on that translation. When it\u2019s missing, risks are more likely to be acknowledged than acted on, and governance becomes something the organization observes rather than something it actively practices.<\/p>\n
Not long ago, I served as a data protection officer, personally accountable for the organization\u2019s data protection posture. That kind of accountability changes the questions you ask, the risks you surface, and the decisions you\u2019re willing to stand behind.<\/p>\n
In that role, I learned that monitoring tells you what a system is doing, but responsible oversight is the organizational ability to understand it, evaluate it, and change it when necessary. Many organizations are still trying to move AI from pilot to production. Far fewer have established clear ownership over who is accountable for how those systems behave.<\/p>\n
According to McKinsey\u2019s 2025 State of AI report, while most organizations are investing in AI, clear ownership and governance structures are still developing. Every organization implementing AI should be able to answer who is accountable for how each system behaves. If that answer isn\u2019t clear, the governance structure isn\u2019t complete.<\/p>\n
Over the course of my career, I\u2019ve led teams with a wide range of technical abilities, but what consistently sets the strongest ones apart is their level of curiosity combined with their ability to think critically.<\/p>\n
In the context of AI, preventing flawed or biased data from influencing outcomes begins at the point of data collection, in the decisions about what to collect, what to measure and what to count. Curiosity, combined with the confidence to question those decisions when something seems off, is often what allows organizations to identify and close governance gaps before they scale into larger issues.<\/p>\n
Having worked in highly-regulated environments, I\u2019m acutely aware that governance frameworks provide structure, but they only work when they\u2019re supported by behaviors that reinforce them. Human curiosity remains one of the most powerful assets a strong governance system has, and it should never be underestimated.<\/p>\n
The lesson from 2013 wasn\u2019t simply about a breach; it was about visibility. Target had contracts, relationships and controls in place, but its governance model hadn\u2019t kept pace with how the business actually operated.<\/p>\n
For those of us who\u2019ve spent our careers in technology, this pattern is familiar. Technology rarely fails. What it reveals are the inconsistencies, assumptions, and governance gaps that were already there. The real question isn\u2019t whether your AI works, it\u2019s whether your organization is prepared for what it exposes.<\/p>\n<\/p><\/div>\n
Back in 2013, Target made headlines globally when a cyberattack exposed the payment card information of 40 million of its customers, along with the personal data of 70 million others.<\/p>\n
At the time, the breach was widely described as a cybersecurity failure, but it was more than that. It was also, by and large, a governance problem, one that mirrors what we\u2019re seeing today as organizations look to scale through AI.<\/p>\n
With no federal framework in place to guide how AI is governed in practice, organizations are defining their own guardrails to support responsible implementation and build trust. But the absence of regulation doesn\u2019t mean the absence of risk. Organizations deploying AI today are still operating within existing legal structures that govern areas like data privacy, consumer protection, and employment practices, to name a few. If an AI-assisted decision exposes personal data or introduces a material error, the organization remains accountable.<\/p>\n<\/p><\/div>\n