{"id":14027,"date":"2026-09-07T15:33:14","date_gmt":"2026-09-07T10:03:14","guid":{"rendered":"https:\/\/gapstars.net\/tech\/?post_type=resource&p=14027"},"modified":"2026-09-07T15:36:01","modified_gmt":"2026-09-07T10:06:01","slug":"ai-governance-the-cto-conversation","status":"publish","type":"resource","link":"https:\/\/gapstars.net\/tech\/resource\/ai-governance-the-cto-conversation\/","title":{"rendered":"AI Is Moving Faster Than Governance. Here’s How 50+ Tech Leaders Are Responding."},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Last week in Amsterdam, 52 CTOs, engineering leaders and AI leads came together to discuss a challenge that is becoming increasingly urgent: how to stay in control of AI without slowing innovation. <\/span>AI adoption is moving quickly. In many organisations, it is moving faster than anyone has a complete view of what is being built, bought or used.<\/span><\/p>

That tension set the agenda for the latest Gapstars CTO Club session in Amsterdam. Fifty-two CTOs, engineering leaders and AI leads joined Gapstars and Deeploy to explore a question that is becoming difficult to postpone:<\/span><\/p>

How do you stay in control of AI without slowing down the teams building with it?<\/span><\/p>

Deeploy CEO Maarten Stolk and Lead Engineer Robbert van der Gugten led the session. But much of its value came from the questions, challenges and experiences shared by the technology leaders in the room.<\/span><\/p>

The discussion pointed to a practical conclusion: AI governance is no longer only a compliance topic. It is becoming part of how modern engineering organisations operate.

<\/span><\/p>

You can only govern what you can see<\/span><\/h3>

AI is appearing across organisations in ways that are easy to miss. A sales team may use an agent for company research. HR may experiment with AI-supported screening. Developers introduce coding assistants. Product teams connect models to internal data and build their own agents.<\/span><\/p>

The issue is not necessarily that these experiments are happening. The issue is not knowing they are happening.<\/span><\/i><\/p>

That is why visibility comes first in Deeploy’s framework. Before designing a complex governance programme, create a shared view of the AI systems and agents already in use: what each one does, who owns it, where it sits in the lifecycle and what risk it may introduce.<\/span><\/p>

A central AI registry turns an abstract governance discussion into something teams can act on. It also exposes the gaps that matter most: systems without owners, unclear data use, undocumented vendor tools and experiments that are already closer to production than anyone realised.

<\/span><\/p>

Not every AI system needs the same controls<\/span><\/h3>

Once you know what is running, the next question is risk. A tool that helps a salesperson research prospective customers is fundamentally different from a system that influences credit decisions or processes sensitive personal information.<\/span><\/p>

Treating both in exactly the same way creates one of two problems: unnecessary bureaucracy for low-risk use cases, or insufficient control for high-impact ones.<\/span><\/p>

A risk-based approach starts with a small set of practical questions:<\/span><\/p>