What regulated delivery teaches you about governance

I’ve spent most of my career in environments where “just ship it and see” was never an option: a nuclear-sector data system under strict information governance, a national evaluation of digital forensics software across every police force in England and Wales, a security integration programme for a government department where a requirement without a traceable owner didn’t survive the week. Those years left habits I didn’t expect to still be using once I moved into hands-on AI delivery — but they’re the habits doing most of the work now.

Traceability isn’t paperwork, it’s the actual product. On the Sellafield and Home Office programmes, every requirement had to be traceable from origin to test evidence, across multiple contractors, because the cost of “we’re not sure why this was built this way” was too high to accept. That’s exactly the discipline an AI system needs and often doesn’t get. If you can’t trace a model’s output back to the data and the decision that shaped it, you don’t have an audit trail — you have a black box with good manners.

As-is before to-be, always. BPMN process mapping feels slow to teams who want to move fast. It’s slow on purpose. You cannot responsibly automate or augment a process you haven’t first described accurately, and “accurately” includes the exceptions, the workarounds, and the step everyone does but nobody wrote down. Skip that step with an AI project and you’ve automated the wrong thing very efficiently.

Governance is a design constraint, not a gate at the end. ISO 19650, GDS service standards, TOGAF-aligned architecture — none of that is bureaucracy layered on top of good delivery. It’s what good delivery looks like when the cost of getting it wrong is measured in more than money. The same is true of responsible-AI assessment: data readiness, bias, and explainability aren’t a checklist you run after the model works. They’re part of deciding whether to build the model at all.

None of this makes AI delivery slower than it needs to be. It makes it delivery you can actually stand behind when someone senior asks how the answer was reached — which, sooner or later, someone always does.