You feel it in every leadership meeting.
Competitors are piloting agents. Vendors are demoing magic. Internally, people already paste contracts into public chatbots “just this once.” The board asks for a plan. The market asks for speed. Standing still feels like falling behind.
And yet: there is no approved AI policy. No clear data classification for prompts. Legal is writing a memo. IT has three shortlists and zero decision. Security wants a risk register before anyone touches a model. Governance is a slide, not a process.
Waiting for perfect governance is how you lose a year. Ignoring governance is how you lose trust.
So the organisation freezes — or it fractures into shadow AI.
Neither is a strategy. This piece is about the third path: how to move with intent while the frames are still being built.
Most organisations act as if there are two options:
- Wait until compliance, architecture and tooling are “done.”
- Rush and clean up later.
Both fail in predictable ways.
Waiting assumes the destination is a finished PDF: policy signed, stack selected, every edge case named. That document ages while the market moves. Teams invent workarounds. The best people leave for places that ship.
Rushing assumes speed is the same as progress. You get twelve tools, four conflicting answers to “where does our data go?”, and a Friday afternoon incident that teaches the board more than any strategy offsite.
The real job is narrower and harder: take steps that create learning and value without creating irreversible mess.
Strip the jargon and you hear the same gaps:
- Compliance — Which data may leave the building? Which prompts are personal data? Who decides?
- Governance — Who may buy a tool? Who owns an agent that emails customers? What is an acceptable error?
- IT / tooling — Cloud model, private VPC, on-prem, or something hybrid? One platform or a toolbox?
- Skills — A few enthusiasts, everyone else watching. No shared practice for evals, prompts or review.
- Incentives — “Innovate” in the OKRs, “don’t create risk” in the audit trail. Same people, opposite pulls.
If IT has not chosen a stack yet, that is not a blocker for learning — it is a reason to keep experiments portable.
None of these gaps mean “do nothing.” They mean you cannot pretend a ChatGPT license is a transformation programme.
Treat the next ninety days as a bounded operating system, not a science fair.
1. Name the non-negotiables early — in one page.
Not a 40-page policy. A short list leadership can defend: which data classes never go to a public model; which actions an agent may never take; who can approve an exception. Incomplete is fine. Silent is not.
2. Pick one valuable, boring use case.
Not “AI everywhere.” One domain where wrong answers hurt but are recoverable: internal search, drafting against known sources, triage that a human still owns. Success is measurable in weeks, not decks.
3. Keep the blast radius small on purpose.
Limited users. Logged prompts. No silent connectors into the crown jewels. If the experiment dies, it should leave a lesson — not a breach.
4. Separate learning from lock-in.
While IT debates platforms, build so you can move: portable documents, clear ownership of prompts and evals, no “the only way this works is Vendor X’s magic folder.” Capability should survive a tooling decision.
5. Put compliance in the room as a builder, not a brake.
Invite them to design the guardrails of the pilot. People who only see AI after it ships will only learn to say no.
6. Make shadow AI expensive — and the official path easy.
If the sanctioned route is slow and opaque, people will keep pasting into the public web. Give them a path that is almost as fast and clearly safer.
You do not need the final architecture. You need a minimum viable frame:
| Decision | Good enough for a pilot | Not good enough |
|---|---|---|
| Data | Named classes: public / internal / restricted | “We’ll feel it out” |
| Tools | One sanctioned channel for the pilot group | Every team picks a SaaS |
| Ownership | Named product + risk owner | “The AI working group” |
| Eval | Ten real tasks, pass/fail with a human | Demo wow-factor |
| Exit | You can stop or move vendors in weeks | Data glued inside a black box |
A pilot without ownership is a hobby. A policy without a pilot is literature.
If you cannot fill that table, you are not ready to scale — but you are ready to run a disciplined pilot that teaches you how to fill it.
At WeAreReasonablePeople we sit in that uncomfortable middle on purpose — between “we should do something with AI” and “we know what to build.”
Practically that means:
- Discovery that names the real constraint — often it is not the model; it is data rights, process ownership or the fear of being first to fail in public.
- Proof of value with teeth — a thin slice in the real environment, with the boring states included: empty, wrong, no permission, low confidence.
- Architecture that keeps options open — especially when IT has not finished the tooling debate. Local-first and portable designs exist for this reason: speed without surrendering the material.
- Governance as design input — constraints written early so engineering does not invent policy by accident.
We are not interested in helping you shout louder about AI. We are interested in the next step that still makes sense on a Monday morning in a regulated, operational organisation.
You do not need the finished compliance programme to begin. You need a decision: what are we allowed to learn this quarter, with which data, under whose name?
Write that down. Pick the boring use case. Invite the people who will say no later to help design the yes now. Keep the exit door visible.
Speed without a frame is theatre. A frame without motion is delay dressed as prudence.
Reasonable organisations do both at once — carefully, visibly, and soon enough that the market does not decide for them.