Brian Stimpfl, CEO at S-Docs, a leading 100% native document generation and e-signature solution.
Healthcare, financial services and the public sector are often portrayed as disciplined technology adopters. New systems can require extensive review, testing, security assessments and compliance approvals before they reach production.
When it comes to AI, speed to adoption alone is a poor measure of readiness.
When technology can influence decisions involving someone’s health, finances, employment or access to essential services, the more important question evolves from simply “How quickly can we deploy it?” to “What happens if we get it wrong?”
Regulated industries have been asking that question in regard to technology for decades. They understand that it must be evaluated in the context of its consequences, that accountability cannot be delegated to a system and that human judgment still matters when the stakes are high.
That experience gives these organizations an important foundation as AI moves from experimentation into operational workflows.
AI’s Hardest Questions Are Institutional, Not Technical
Much of the AI conversation focuses on what a model can do, how accurate it is, how quickly it can process information and how sophisticated its reasoning appears.
Those capabilities matter, but responsible implementation depends on questions the technology itself cannot answer.
Which decisions should AI be permitted to influence? What level of error is acceptable for a particular use case? When should a person review or override an output? Who is accountable when something goes wrong?
These are organizational questions, not model specifications. They require leaders from operations, compliance, legal, security and the business to establish boundaries and responsibilities together.
That is familiar territory for regulated organizations, where technology decisions have long been evaluated against legal, financial, operational and human consequences.
Not Every AI Use Case Deserves The Same Scrutiny
One of the mistakes I see organizations making is treating AI as a single category of risk.
A model that summarizes internal meeting notes is not the same as a system that helps determine a patient’s treatment path or evaluates someone’s loan application. Yet, some organizations try to address all of these applications with one broad AI policy.
Regulated industries already have a better instinct: Risk-tier the use case. The same basic questions can apply to AI. How sensitive is the data involved? How significant is the impact if the output is wrong? Can the decision be reversed? How much human judgment is required?
Getting that classification right creates room for both innovation and control. Lower-risk applications can move quickly without forcing every experiment through the same approval process reserved for high-impact decisions.
The objective is to understand the risks well enough to apply controls proportionate to the consequences.
Human Oversight Must Be Designed Into the Process
Simply saying that a person remains part of the AI output process does not guarantee meaningful oversight.
If an employee does not have the time, context or authority to challenge an AI-generated recommendation, human review can become little more than a checkbox.
This is another area where regulated organizations have existing practices to build on. Separation of duties, approval thresholds, escalation procedures and documented accountability are already part of many critical workflows.
AI should be incorporated into those structures rather than operating outside them. It’s important to define and assign roles and responsibilities to specific people in AI-centric processes, such as who oversees the system and who interacts with its outputs.
The goal is not to put a person between AI and every decision. It is to make sure the human role is appropriate to the risk and that the person responsible has the ability, context and empowerment to exercise judgment.
The Instinct Is There—The Infrastructure Often Isn’t
Experience managing risk does not automatically translate into AI readiness.
Our 2026 research report found that 72% of regulated organizations are deploying AI, but only 30% believe their document and data environments are governed and structured enough to support it responsibly. That gap matters.
An organization can have thoughtful AI policies and still struggle with fragmented data, disconnected applications, manual handoffs and unclear ownership. Those weaknesses make it harder to determine what information an AI system accessed, how an output was generated, what happened to that output or who ultimately approved a decision.
In other words, responsible AI requires more than responsible AI policies. It requires operational infrastructure capable of enforcing them and audit trails to back it up.
Before expanding high-impact AI applications, organizations need to ask whether their existing systems can provide the visibility, controls and accountability their risk frameworks require.
The Next Advantage Is Responsible Scale
Regulated industries may not win a race measured solely by how quickly AI can be deployed. But their experience managing consequential technology decisions provides a useful foundation for scaling AI responsibly.
The lesson is straightforward: Understand the consequences of each use case, apply controls according to the risk and make accountability explicit.
For leaders evaluating their next AI initiative, I would start with three questions: How risky is this use case? What does meaningful human oversight look like? And can our existing systems provide the visibility and control required to support it?
Those questions may slow down some AI projects; however, they can also help organizations move faster on the ones that are ready and build AI into the business in the most secure way.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?