In my years of working with executives, I’ve seen a pattern in the reactions to the word ‘governance.’ Among leaders whose focus is on the food-water-shelter of rapid growth, implementing governance often feels like a burdensome risk exercise, one to worry about if you’re a larger company. Perhaps something to consider after the next fundraise.

I see governance differently, as do members of the Georgian Growth Network, a private executive peer community. In my view, operationalizing governance sooner rather than later can help today’s cohort of AI-native companies seize a narrowing window of opportunity to dig the kind of moat that Georgian believes is more important than it ever was: trust.

Many emerging AI companies struggle to meet enterprise procurement prerequisites

I have been monitoring the unlock potential of an operational AI governance model for about a year, since the Growth Network’s member companies began reporting increased scrutiny during enterprise procurement cycles on matters like, whether their AI uses customer data to train models, and who remains accountable when an AI-assisted decision goes wrong. Members were also reporting that deal cycles were lengthening, and that they were being asked questions about foundation model risk and data-governance inherent to agentic systems.

Enterprise buyers are considering younger, AI-native and AI-fortified vendors with an openness I have not seen in past cycles, where established incumbents were seen as the de facto, safe choice. The same is true in industries with historically strict compliance requirements, like defense and healthcare.

But enterprise buyers still hold newer, agentic companies to one foundational criterion: understanding how that organization manages risk, manages data, and governs the solutions it's building into its product. Enterprises are accountable to millions of customers, subject to complex regulation around the world, often beholden to shareholders, and they need assurances. They are unable to compromise on confidence in a solution. It is a prerequisite for purchase.

Meanwhile, the operating reality among SMBs typically lags behind the opportunity to maintain enterprise interest through procurement. Earlier this year, Georgian surveyed 252 R&D decision makers to understand what their AI practices, including governance posture, looked like. Most of our general governance-related findings are in our chapter on The Governance Gap. In addition to the findings in this chapter we observed a gap, based on size segmentation, between buyers searching for answers and sellers positioned to provide them: among enterprises decision makers, 87% reported some form of governance program, whether that be fully centralized or hybrid. Among SMBs however, only about half (53%) of respondents reported an entirely ad hoc AI operating model with no formal governance structures at all (n = 51).

Two ways AI governance may resolve next year

By spring of next year, I believe that AI governance will become a requirement in one of two ways: either governance requirements become formalized more broadly, or the companies that built governance models early will set a de facto standard for the rest, and will have captured more enterprise market share earlier.

The regulatory picture already supports either path as the EU AI Act's high-risk system obligations became enforceable this past August (implementation timeline), and several U.S. states are moving on their own AI-specific rules. As of this writing, Colorado's AI Act is set to take effect in January. GDPR offers us a preview of what could come next: the EU regulation set off a global ripple as other jurisdictions adopted similar standards of their own.

Introducing The Growth Network’s AI Governance Kit

Last year, the Growth Network community formed a working group focused on the challenge of operationalizing AI governance for growth-stage organizations. From then, we’ve been working on co-creating resources with the goal of empowering small-to-mid-sized organizations to create an approachable formal posture on AI governance.

We now have an AI Governance Kit that anyone in our community can use, and are sharing more broadly, with you, in the spirit of making trust building and governance more accessible. In my view, this kit sits in the sweet spot, helping mid-sized to smaller companies advance through procurement so enterprise buyers can make informed decisions about a purchase, partnership or even acquisition. It contains:

• The AI Governance Workbook: Structured around the NIST AI Risk Management Framework, which gives teams a credible, portable way to think through AI risk. The workbook’s value isn't really the spreadsheet, but the sequence it prompts: logging use cases, assigning ownership, and scoring risk. These steps build the kind of discipline that turns governance from something you say into something you can show a customer, a board, or a security reviewer. Completing it leaves you with a living document, not a one-time compliance artifact.
• The AI Governance Charter Template: A customizable policy document, written in plain language, that a company can adapt and drop into an employee handbook, a security review response, or its own website for prospective customers to read. Think of it like a statement of intent: specific enough to guide real decisions about data use, vendor evaluation, and who owns what.
• The AI Use Case Library: 71 real, anonymized AI use cases from Growth Network member companies, each one noting what could go wrong and what gaps remain in the controls around it. It gives a company building its first use case inventory a peer-tested starting point for investigation.

While implementing an AI governance program as ‘simple’ as the one in the Growth Network’s AI Governance Kit may still feel like a lot of work, I see it as a drop in the bucket compared to the effort wasted on an inexplicably stalled enterprise sales cycle, or spent on catch-up a year from now.

For younger companies focused on keeping pace with their own growth velocity, AI governance can seem like a luxury. But I think it's an opportunity to align your ability to build trust with your growth potential.