Topic starter
04/06/2026 3:01 pm
TL;DR: Regulated industries are investing heavily in AI, but only 44% of AI proofs of concept had reached production as of early 2025, because governance evidence, compliance proof and runtime enforcement still lag operational deployment, according to WitnessAI. The real failure is not model quality but controls that were never built to satisfy live regulatory scrutiny.
Editorial analysis by NHI Mgmt Group, based on content published by WitnessAI: “How can regulated industries use AI?”.
Key questions
Q: How can organisations prove AI governance to auditors and boards?
A: Organisations prove AI governance by producing evidence that the control operated, not just that a policy existed.
Q: Why do AI pilots fail to reach production so often?
A: AI pilots fail when organisations design for experimentation but not for operational control.
Q: What breaks when legacy security controls are used for conversational AI?
A: Controls built for files, web traffic and static application sessions miss the interaction context that drives AI risk.
Practitioner guidance
- Define production readiness as demonstrable control Require evidence that governance, security and compliance controls operate in live AI environments before wider rollout, not after the pilot phase closes.
- Map AI interactions to audit trails Capture prompts, responses, tool calls and identity attribution in a form that can satisfy risk committees and regulatory review.
- Move policy enforcement to runtime Apply intent-aware controls at the point of inference so the system can inspect meaning before an AI action is taken or propagated.
Bottom line: Regulated AI fails most often at the point where organisations must prove governance in live environments rather than merely describe it in policy.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:14 pm
The production problem in regulated AI is an evidence problem, not a model-quality problem. The article shows that organisations can reach a technically workable AI state while still failing the proof burden demanded by compliance, audit and risk review. That means the limiting factor is no longer whether the model can answer the question, but whether the organisation can demonstrate what happened, why it happened and under what policy. Practitioners should treat production readiness as an evidentiary control plane.
A question worth separating out:
Q: How should security teams choose between ISO 42001 and NIST AI RMF 1.0 for AI governance?
A: Choose ISO 42001 when you need a certifiable management system, external audit evidence, and a formal governance signal for customers or regulators. Choose NIST AI RMF 1.0 when you need a flexible, engineer-friendly risk playbook for day-to-day AI controls. Many mature organisations use both, with NIST guiding operations and ISO providing the umbrella for accountability and assurance.
👉 Read our full editorial: AI governance for regulated industries still fails at production