The rapid growth and evolution of AI technology has led to major shifts in how businesses of all sizes work - but it is also impacting their next big corportate move.

AI has fundamentally changed the risk profile of innovation, as it can expose companies and users to risk earlier, faster and at far greater scale.

Organizations used to be able to afford to delay digital transformation decisions and remain competitive - but now, competitors can use AI to exponentially accelerate while the companies which wait for exact certainty can be left behind before they even begin.

This all means trust is now a crucial business imperative, and organizations must tighten up governance, privacy and security to prevent regulatory and reputational risk - we spoke to Joe Depa, EY Global CIO, to find out more.

• Many organizations have spent the past two years experimenting with AI, but relatively few have achieved measurable business impact. From EY's perspective, what separates the companies that are delivering tangible ROI from those that remain stuck in what you've described as “pilot purgatory”?

Everyone wants to move faster with AI. The first question is whether they can move fast with trust. The second is how deeply they understand and can optimize the AI value equation.

Trust is what separates the companies getting real ROI from the ones stuck in pilot purgatory. The winners that scale AI successfully across the business tend to share a few characteristics.

They have trusted data as the foundation. Proprietary, secure and well-governed data is becoming one of the biggest competitive moats a company has, because it reflects its unique knowledge, judgment and expertise.

On top of that foundation, they have trusted processes and technology. Data has to be connected to real workflows, real decisions and real business outcomes. The companies pulling ahead don’t use AI to make old processes a little faster. Instead, they rethink how work gets done, where AI can create new value, and how to build governance into the way AI is deployed and scaled.

Then, most importantly, winning organizations invest heavily in helping their workforce expand their skillsets so they can use AI confidently. People won’t use AI if they don’t trust it, and if they don’t use it, they won’t develop the expertise to know where to apply it. That is why upskilling is so important; it’s how you turn employees from passive users into change agents.

Put simply, pilots are great for learning, but being able to progress to scaled adoption is what creates business outcomes. And scaled adoption can only happen when people trust the data, the process, the technology and their own ability to use it well.

That brings us to how to understand and optimize AI value. There’s a lot of focus lately on token costs, but token costs are just one element of the AI value equation. This is a major disconnect that we spotted early in our own business. We saw rising token costs and high-end models being used for low-value work.

In retrospect, it was an important lesson about how measurement priorities change as technologies mature. In the early days of generative AI, the focus was on getting people to use it, so organizations tended to view usage as an indicator of momentum. But now that generative AI models and use cases have become more sophisticated, our focus has shifted to measuring business outcomes.

So we developed a set of best practices to address that. We optimized model selection against the highest value use cases, trained our teams, and put governance around usage. Those strategies enabled us to bring overall token consumption down 60%, while bringing value up. We’ve formalized this in an AI Value Realization Office focused on governance, training and value measurement. The goal is to ensure AI is being applied to the highest-value opportunities and delivering measurable impact.

• There's often a tension between moving quickly with AI and putting the right controls in place. How can organizations build governance, privacy and security into AI programmes from day one without slowing innovation to the point where they lose competitive advantage?

People often think of governance as the brake, but the opposite is true: having good governance is what gives you the confidence to press the accelerator.

The companies getting it right are building trust into AI from day one, so their teams can move faster without creating risks they have to unwind later.

EY’s Responsible AI Pulse survey found that companies further along in responsible AI are reducing risk and seeing better business outcomes. Nearly four in five reported gains in innovation, and more than half reported revenue growth. Companies with real-time monitoring were also more likely to see improvements in revenue growth and cost savings.

People move faster when they know the guardrails. If employees have a safe, well-governed environment to experiment in, they are much more likely to try new ideas. But if they are worried that every idea could create a compliance issue, they slow down or avoid experimenting altogether.

Governance also matters technically. When controls are added too late, teams often end up with rework, technical debt or pilots that looked promising but cannot scale. Building the right controls early helps avoid that.

Furthermore, once AI agents start to take action, governance can no longer live in a document. It has to be built into the system itself: how access is controlled, how behavior is monitored, how bias is checked and how safeguards kick in when an agent acts.

That is the balance leaders need to strike. Move fast, but do it with trust built in.

• As AI becomes embedded in core business processes, trust is increasingly seen as a commercial issue rather than simply a compliance one. How are you seeing boards and executive teams rethink governance in light of growing regulatory scrutiny and the potential reputational consequences of AI failures?

Trust is absolutely a commercial issue. If customers, employees or regulators do not trust the products, systems or decisions powered by AI, they will find reasons not to use them. That can affect brand, reputation, operations and growth.

Boards cannot govern what they do not understand. That does not mean every director needs to be a technologist. But boards do need enough AI and technology fluency in the room to ask the right questions, challenge management and understand where the real exposure sits.

We are seeing boards move from asking, “Are we compliant?” to “Where are we exposed?” That is an important shift. Boards are starting to see AI risk more broadly in terms of enterprise risk, in addition to legal and regulatory risk. Agentic AI raises the stakes even more.

For boards, there are three practical next steps.

1. Build AI fluency into the boardroom. Boards need people who understand enough about technology and AI to pressure-test the strategy, the risks and the controls. This doesn’t mean that everyone needs to code, but they do need enough fluency and visibility into leading value indicators to know whether management is asking the right questions.

2. Require visibility across the AI portfolio. Boards should understand where AI is being used, what data it relies on, how material the use case is, who owns it, what resources are being consumed, and what controls are in place. The goal of all this knowledge is to help boards ensure AI is creating business value and that it is being governed at the solution level, the portfolio level and the enterprise level.

3. Make the technical controls real. That means AI-ready data, clear access controls, audit trails, model and agent monitoring, defined escalation paths and the ability to intervene when something behaves outside expectations. Of course, training is absolutely critical to drive adoption of these tools.

• Many businesses are keen to demonstrate they're embracing AI, but there's a risk of what you've called “innovation theatre.” What are the warning signs that an organisation is investing in AI for appearances rather than driving genuine business transformation, and how can leaders avoid falling into that trap?

The warning sign is when activity gets confused with impact.

A company can have a long list of pilots, demos and proofs-of-concept and still not be creating meaningful value. That is innovation theatre. It looks busy. It may even look impressive. But it does not change the business.

The companies getting this right are much more disciplined. They’ve moved beyond measuring activity to measuring impact on business value. They’re focused on which pilots created value, which scaled successfully, and which improved workflows, customer experiences, risk outcomes or financial performance.

The most successful organizations also establish accountability from the start. Every AI initiative should have a business owner, an investment hypothesis, clear success metrics and AI enabled training that focuses on deploying effectively. Without this, it becomes difficult to separate experimentation from impact.

If pilots are not scaling, leaders need to understand why. Is it a data issue? A trust issue? A weak business case? No clear owner? Not enough transparency or control? Not enough training? Those failure modes tell you where the organization needs to get better.

Disciplined companies avoid the innovation theater trap. Every pilot has an owner, a set of priority metrics and a decision point: scale it, rethink it or kill it.

Otherwise, you end up with a lot of interesting demos and not enough business impact.

• With AI regulation evolving across different markets and customer expectations around responsible AI continuing to rise, what governance practices do you think will become non-negotiable over the next 12 to 24 months for organisations that want to scale AI responsibly?

AI is moving faster than any one organization, board or regulator can fully keep up with.

That is why leaders don’t have the luxury to wait and see. They need governance models that are resilient enough to adapt across markets, because the regulatory environment will continue to evolve, and it will not evolve the same way everywhere.

Sovereign AI will become a much bigger part of that conversation. Organizations will need to understand where their data lives, how it is protected, who can access it, which models are being used and how those systems align with local laws and market expectations. That goes beyond a technical issue; it’s becoming a board, regulatory and trust issue.

The companies that get this right will focus on a few practical areas.

One is data governance and sovereignty. You need to know what data your AI is using, where it came from, where it is stored and whether it is appropriate for the use case.

Another area of focus is resilience in the operating model. Regulation will keep changing, so governance must be dynamic. Organizations need controls, monitoring, audit trails and escalation paths that can adapt as new rules, risks and expectations emerge. For example, when AI agents are deployed that can make decisions, take action and interact with other systems, regulators will expect organizations to understand how it behaves in the real world.

Lastly, they have an open ecosystem. No company can navigate this complexity alone. Leaders will need to work across regulators, technology providers, advisors, industry groups and academic institutions to separate signal from noise and understand where the market is heading.

Focusing on these areas is how responsible AI evolves from a static set of policies to an enabler. It needs to be designed at the outset into the ways companies manage data, deploy technology, work with regulators and scale innovation across markets. That is how you build trust and resilience at the same time.

• Looking ahead, do you think trust will become a competitive differentiator in AI adoption? In other words, will organisations that can clearly demonstrate robust governance, transparency and security gain a commercial advantage over those that treat these issues as a compliance exercise?

Yes. Trust is a business necessity, not a checkbox.

The irony is that trust can help companies move faster. When the guardrails and success indicators are clear, teams are freed to innovate with more confidence and less rework.

That is why responsible AI is a growth and innovation driver. If you can show that your AI is governed, explainable, secure and monitored, people are more likely to adopt it, they’ll be far more comfortable scaling it and, most importantly, they’ll be better positioned to scale, differentiate and create value.

That’s the real opportunity: the confidence to move fast in a way everyone, from boards to employees to customers, can trust.

Mike Moore is Deputy Editor at TechRadar Pro. He has worked as a B2B and B2C tech journalist for over a decade, including at one of the UK's leading national newspapers and fellow Future title ITProPortal. When he's not keeping track of all the latest enterprise and workplace trends, he can most likely be found watching, following or taking part in some kind of sport.