Matilda Bailey has built her career at the intersection of high-stakes networking and next-generation technological solutions, witnessing firsthand how rapidly evolving tools can outpace the structures meant to control them. As a specialist in cellular and wireless trends, she has seen how connectivity fuels both innovation and vulnerability, making her an essential voice in the current debate over artificial intelligence governance. Today, she shifts her focus to the executive suite, arguing that AI oversight is no longer a task to be delegated to legal departments but a core responsibility for leadership. Our conversation explores the hidden costs of regulatory hesitation, the fragmented landscape of global AI policy, and the practical steps organizations must take to build resilience in an era defined by deepfakes and rapid data exposure.
The discussion centers on the alarming reality that nearly half of all AI initiatives are currently faltering due to a lack of governance, rather than technical failure. Bailey elaborates on the three converging forces—internal adoption speed, regulatory fragmentation, and geopolitical threats—that create a “perfect storm” for unprepared leaders. She provides a deep dive into how organizations can transition from a reactive posture to a proactive one by identifying specific risk exposures, utilizing AI-assisted monitoring tools, and treating crisis response as a muscle that must be regularly exercised through simulation.
In your experience, why are nearly 46% of organizations seeing their AI projects underperform specifically because of governance and compliance issues?
When leadership views governance as a bureaucratic hurdle rather than a strategic foundation, the entire AI project begins to crumble under its own weight. That 46% figure from the GrantThornton 2026 AI Impact Survey represents a massive disconnect between the excitement of implementation and the reality of operational safety. In many cases, teams are rushing to deploy models without a clear roadmap, only to hit a wall when they realize their data handling doesn’t meet emerging standards. This creates a friction that slows down innovation, meaning the “fast” shortcut actually becomes a long-term liability that drains resources. It is heartbreaking to see a project with high technical potential fail simply because the executive team waited for a perfect set of rules that haven’t been written yet.
How should leaders interpret the “three converging forces” of internal adoption, fragmented regulation, and geopolitical threats currently reshaping the industry?
These forces represent a shift from a controlled corporate environment to a landscape that feels increasingly like a digital frontier. First, we see internal AI-safe use policies falling behind adoption, where employees use tools for day-to-day decisions before the C-Suite even knows those tools are on the network. Second, the regulatory environment is completely fragmented, with European standards looking very different from the experimental frameworks popping up in individual U.S. states. Finally, the threat landscape has darkened with geopolitical tensions, where state-sponsored actors use deepfakes and AI-disinformation to strike at an organization’s reputation at scale. Leaders who fail to see these three factors as a single, unified challenge will find themselves constantly playing catch-up in a game where the rules change every week.
With over 1,100 AI bills introduced in state legislatures last year, how can a company build a stable strategy without getting lost in the regulatory maze?
The sheer volume of legislation is staggering, and with 130 of those 1,100 bills already enacted into law, the idea of waiting for a “stable” global standard is effectively a myth. Instead of chasing every individual legislative update, leaders must pivot their focus toward building structural resilience that can adapt to whatever comes next. It is much more effective to create a flexible internal framework than to try and guess which state-level rule will become the national norm. You have to accept that clarity isn’t coming anytime soon, and that your governance must be a living, breathing part of your operations. If you spend all your time looking at the maze of regulations, you’ll lose sight of the actual risks your specific data and systems are facing.
Could you elaborate on the hidden risks of using general-purpose AI for sensitive tasks, particularly regarding the loss of legal privilege?
This is one of those “small” mistakes that can lead to a catastrophic legal fallout for a firm that hasn’t set clear boundaries. If an employee uses a general-purpose AI tool to summarize a sensitive legal conversation or seek guidance on a dispute, that information is no longer protected by legal privilege. In the event of a lawsuit or a regulatory audit, every single word entered into that AI assistant becomes fully discoverable by the opposing party. It is a sensory shock to many executives when they realize that a tool meant to save twenty minutes of work just handed their most guarded secrets to their adversaries on a silver platter. We are seeing a rush to implement these “shortcuts” without a fundamental grasp of where the legal protection ends and the public record begins.
What does it mean for an executive to truly “own” AI governance through the lens of visibility and flexible frameworks?
Ownership at the executive level means moving beyond a “set and forget” mentality and realizing that compliance plans have a very short shelf life in the AI era. A healthcare company managing private patient data has a vastly different risk profile than a logistics firm, and leadership must have total visibility into which specific rules apply to their unique data silos. This visibility needs to be paired with AI-assisted monitoring tools that can flag new threats or regulatory shifts across different jurisdictions in real-time. By building this flexible framework, the organization doesn’t just survive a change in the law; it adapts its internal processes almost automatically. It turns governance from a static document in a drawer into a dynamic capability that protects the firm’s financial health and reputation.
Why is rehearsing an incident response through simulations so critical for protecting an organization’s operations and public trust?
The first few hours of a security incident, whether it’s a data exposure or an AI-generated disinformation campaign, are the most critical for maintaining the trust of your stakeholders. If you haven’t simulated a real-world crisis, your response will be chaotic, uncoordinated, and ultimately damaging to your brand’s integrity. Rehearsal allows a team to move through the panic in a planned, professional manner, ensuring that the technical, legal, and communication departments are all singing from the same sheet of music. I always tell leaders that a crisis is the worst time to try and figure out who is in charge of what. Practicing these scenarios builds the muscle memory needed to restore operations quickly and prove to the world that you are a responsible steward of the technology you use.
What is your forecast for AI Governance?
I believe we are heading toward a period where the “governance gap” will become the primary differentiator between market leaders and those who face total obsolescence. Within the next two to three years, the organizations that have proactively embedded risk visibility and crisis readiness into their DNA will thrive, while those waiting for regulatory perfection will be sidelined by lawsuits or reputational scandals. We will likely see a move toward “interaction-aware” security layers that monitor AI usage in real-time, much like we once saw with the rise of firewalls for the early internet. Ultimately, the advantage will belong to the proactive; the era of passive leadership in technology is officially over, and the cost of inaction will only continue to rise.
