By Richard Farrell, CIO at Netcall
For the past few years, organisations have been racing to experiment with AI. Pilots have been launched; new tools introduced and use cases tested across different parts of the business. But as AI moves from experimentation into everyday operations, the measure of success is changing. Organisations are no longer simply asking where they can use AI, but whether they can deploy it repeatedly, responsibly and with enough control to deliver meaningful business outcomes.
At the same time, AI itself is moving from assistance towards action. There is a significant difference between AI drafting a response for an employee to review and an AI agent progressing a case across several systems. In the second scenario, AI could be updating records, triggering communications or moving work to its next stage before a person sees it.
That changes the governance challenge. Once AI can act, organisations need to think not only about what it can do, but what it should be allowed to do. Where does its authority stop? When should a person step in? What happens when it encounters something unexpected?
As autonomy increases, governance has to keep pace.
This is why governance is becoming key to operational maturity. The mistake is to think about governing AI as a technology in isolation. Once AI becomes part of everyday operations, what really needs governing is the role it plays in getting work done.
And that starts with understanding the work itself.
You can’t govern what you don’t understand
There is a temptation with any exciting technology to find places to use it. That is particularly true with AI because its potential applications appear almost limitless.
But putting AI everywhere is not a sign of maturity.
Before introducing AI into a process, organisations need to understand how that process actually works. Where does information come from? Who makes decisions? Where do exceptions occur? Which systems are involved and where does human judgement matter?
That sounds obvious, but process knowledge is often scattered across documents, spreadsheets and isolated within individual teams. In some cases, the way work happens in practice may look very different from the process that was originally documented.
That creates a problem for AI governance. Without a clear view of the process, it becomes much harder to define what role AI should play, what information it should access or where controls and human intervention need to sit.
AI can help organisations capture process knowledge more quickly, but people still need to review and validate that picture before it becomes the basis for automation or AI. The aim should be an agreed source of truth for how the process works.
But that source of truth cannot be static. Processes change as policies develop, teams find better ways of working or new systems are introduced. If AI is embedded within a process, those changes may affect the role it should play.
Organisations therefore need clear ownership of their processes and visibility of what has changed. When the process changes, they can assess the impact on the AI operating within it. Does it still have the right permissions? Are its escalation points still appropriate? Is human judgement still happening where expected?
This turns process understanding into an ongoing part of AI governance, rather than a one-off exercise before deployment.
Once the work is understood, then you can determine the role AI should play.
Move governance from policy into the workflow
Most organisations recognise that they need policies covering the use of AI. Policies matter, but they are not the same as operational governance.
A policy might say that sensitive information must be protected or that significant decisions require human oversight. The harder question is how those principles work when AI is helping an employee progress a live customer case. The controls need to exist where the work happens.
AI can also help teams design and refine processes before application development begins, bringing the people involved in the work together to test how a process should operate. Once that design moves into a live application, changes need to happen within a more controlled development and governance environment.
A platform approach can help by embedding AI into existing workflows, with permissions, decision points and escalation routes designed around it. Low-code application development can then make it easier to adapt without every improvement becoming a lengthy development project.
Importantly, this allows the people closest to the process to play a greater role. They can provide insight into where AI is working well, where exceptions occur or where the workflow needs improving, while IT retains oversight of the wider environment.
That creates a balance between flexibility and control. Organisations can respond to what they are learning in practice, while keeping AI within a governed environment.
Some decisions must remain human
This matters particularly in sectors where organisations handle sensitive information or decisions have a direct impact on people’s lives.
In healthcare, AI could remove repetitive administration and give NHS teams more time to focus on patients. But there is an obvious difference between AI helping organise information and allowing it to influence a decision affecting somebody’s care without appropriate oversight.
The same principle applies in insurance. AI may help process information around a claim, but when somebody is dealing with the consequences of a flood, accident or bereavement, efficiency is not the only outcome that matters. There are points where judgement and human interaction remain essential.
Local government faces similar questions. Councils can use AI to relieve pressure on overstretched services, but residents need confidence in how decisions affecting housing, benefits or support are reached.
Operational maturity means knowing where that line sits and designing the process so a human can be brought into the loop where needed.
Measure the outcome, not the amount of AI
The final test of operational maturity is not how much AI an organisation has deployed. It is what has changed as a result.
Counting pilots, licences or AI features can tell a board how much activity is taking place. It cannot tell them whether the organisation is getting better at using AI.
If AI was introduced to reduce administrative work, did employees genuinely get time back? Or was it just a self-reported survey? If it supports customer service, are people getting issues resolved more effectively? And were those improvements achieved while maintaining the controls and human oversight the organisation expected?
The human outcome can make that value much clearer. Saving time for an NHS employee matters because of what they can do with that time. Improving a council process matters when somebody gets the support they need sooner.
This is why governance, process understanding and outcomes are so closely connected.
The organisations demonstrating the greatest AI maturity won’t necessarily be those trying to put AI into every available process. They will understand how work happens, know where AI genuinely has a role and maintain control as both the technology and the process change.
That gives boards a much more meaningful measure of AI maturity.
Not simply whether the organisation is using AI, but whether it knows what that AI is doing, why it is doing it and whether it is making things better.
