Girish Redekar is Co-founder and CEO of Sprinto, building the future of trust for high-growth companies.
Inside a lot of organizations, AI is starting to look like an old codebase nobody has touched in years.
I’m an engineer first, so that is the comparison I keep coming back to. Nobody did anything obviously wrong. Every commit made sense at the time. But five years later, nobody remembers why half of it is there, and the person who would have to explain it to an auditor has probably left the company.
That’s what’s happening with AI right now, except it’s happening in months, not years.
Adoption usually happens through small, sensible decisions. A business unit picks up a tool, a developer wires an API into a product, and marketing tries a new platform. None of those choices looks especially risky on its own. The problem appears when you add them up over a year and realize nobody has a clear picture of what the organization is actually exposed to.
The Debt Nobody’s Watching Accrue
“Compliance debt” is a good term for this. Compliance debt builds when the business moves faster than compliance can keep up. This can happen with cloud adoption, vendor sprawl or any other change that moves faster than the systems meant to govern it.
Usually, nobody is doing anything wrong. The business is responding to the market, while compliance is often manual, point-in-time and several steps behind what is changing week to week.
AI makes this worse and faster than anything else has.
There’s also a related idea called “trust debt,” the gap between what you tell customers and regulators you do and what you can actually prove. It shows up anywhere claims outrun evidence, and AI is currently one of the fastest places it’s building up. Every system adopted without an owner, documented approval or evidence trail adds to it.
There is no obvious moment when debt becomes visible. It accumulates in the background until a regulator, a customer or the board asks a question the organization cannot answer from the records it already has.
We’ve Run This Experiment Before
Early cloud adoption looked a lot like this. Business units moved to cloud services faster than security policy could follow. Shadow IT created exposure security teams couldn’t see. By the time governance caught up, some companies had already spent years figuring out what was running and retrofitting controls around systems deeply embedded in the business.
Cloud gave us a preview of what happens when governance arrives after adoption. Companies putting AI governance in place now will know what they’re running before someone forces them to find out. The rest will be reconstructing the past.
And doing that later is expensive. It leads to delayed reviews, repeated evidence requests, and legal questions that take weeks to answer instead of hours. The business eventually pays back the speed it gained earlier, usually when scrutiny is highest.
However, starting earlier solves only part of the problem. An AI system can be reviewed and approved today, then look very different six months from now.
The Risk Does Not Stop At Approval
The mistake is treating approval as the end of the process. Approval tells you what was reviewed at one point in time and nothing about what happened after, when a model gets updated, a system picks up access to more data, or a team starts using it for something outside the original review and nobody circles back to check.
You need continuous compliance; the record has to change when the system does. A new data source, expanded permissions, a different model behind the same interface—each of these needs to reach the person who owns that system, so they can decide whether it’s still within the risk they originally accepted.
Now here, not every change needs a full review. A system gaining access to sensitive customer data is a different category of decision, and it needs someone with the authority to make that call.
Detecting a change is not the same as governing it. A dashboard full of alerts nobody acts on is just a more sophisticated way of not knowing what’s happening. The compliance debt keeps building either way.
This Belongs To The CISO
Another policy document will not solve this if decisions about AI remain split across the company. Legal may define what is allowed, while IT controls access and product decides how the tool is used. Without someone coordinating those decisions, gaps are easy to miss.
That job usually lands with the CISO. They already spend their time looking at how technology, data, vendors and regulation come together across the business.
The challenge is getting the rest of the company to treat AI governance as part of how things get shipped, rather than something security is asked to sort out after deployment.
The Cost Of Waiting
Waiting doesn’t leave the risk where it is. Every quarter, another system gets added, another vendor gets plugged in, another decision goes undocumented and nobody goes back to check what’s changed. Even with zero incidents, the trust debt keeps growing. Eventually, someone asks for an answer, whether it’s a regulator, a customer or the board, and the question is always some version of the same thing: Where is the exposure, and can you prove it?
Companies that build governance now can answer from what they already know. The ones that wait will be doing the same work later, under worse conditions, with someone else setting the deadline. That’s the real cost of delay.
This isn’t really about satisfying a board. It’s about whether the organization itself knows where the risk sits, who owns it and what happens when something changes. The companies that can answer that today are the ones who’ll still be moving when everyone else is stuck explaining what they don’t know.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?