When technology evolves continuously but institutions govern periodically, the greatest risk may emerge between one approval and the next.
There is a fundamental contradiction emerging in the relationship between artificial intelligence and the organisations adopting it. We are introducing technologies whose capabilities, configurations and uses can evolve rapidly into institutions whose mechanisms of governance were largely designed around identifiable decisions, relatively stable systems and periodic reassessment.
The contradiction is not immediately visible. An organisation can develop an AI strategy, establish governance principles, create an oversight committee, assess risks and approve a system for deployment. It can document its choices, assign responsibilities and demonstrate compliance with relevant requirements. From a conventional management perspective, the organisation may appear to have acted responsibly.
Yet something important happens after the system enters operation.
The technology continues to evolve. Its surrounding information changes. People discover new ways of using it. The processes into which it is embedded gradually adapt to its presence. The relationship between the system and the organisation becomes different from the one originally assessed.
The institution, meanwhile, may continue operating according to the assumptions established at the moment of approval.
This is the central problem of what I would call the two clocks of artificial intelligence.
The first is the clock of technology: continuous, sometimes unpredictable, shaped by technical development, changing data, external suppliers and emerging patterns of use.
The second is the clock of institutions: structured around authorisations, budgets, procurement procedures, reporting periods, formal reviews and established responsibilities.
Neither clock is inherently wrong. Technological change requires experimentation and adaptation. Institutional governance requires deliberation, legitimacy, traceability and accountability.
The problem arises when their different rhythms become disconnected.
An organisation may continue to govern the system it believes it approved, while the system it actually operates has evolved into something meaningfully different.
And the consequences of that divergence extend far beyond technology management.
Figure 1 — The governance gap. Artificial intelligence evolves continuously, while institutions typically govern through periodic approvals and reviews. The difference between these rhythms can allow significant changes to escape timely reassessment.
The Illusion of the Approved System
Most organisations approach the introduction of a new technology through a recognisable sequence. A need is identified, alternatives are evaluated, a business case is prepared, resources are allocated and the solution is assessed against technical, financial, legal and operational requirements.
Artificial intelligence has added new dimensions to this process: model evaluation, data protection, bias, explainability, human oversight and the potential consequences of automated recommendations.
These are necessary developments. The problem is not that organisations are paying too much attention to approval. It is that approval can create a misleading impression of permanence.
A system is assessed at a particular moment, under a particular configuration, for a particular purpose and within a particular organisational context.
But that assessment is not automatically valid for every future version of the system or every future use.
Consider an AI assistant introduced to help employees locate information in internal documentation. Its original purpose is relatively limited. It retrieves relevant passages, summarises procedures and provides references to source documents. Employees remain responsible for interpreting the results.
Over time, however, the assistant becomes increasingly useful. More departments begin using it. Additional repositories are connected. Its responses become integrated into operational workflows. Employees start relying on it not only to find information but also to interpret rules, suggest actions and prepare decisions.
Eventually, what began as an information-retrieval tool may become an influential component of the organisation’s decision-making process.
No single change necessarily appears revolutionary. Each extension may seem reasonable, incremental and consistent with the original investment.
Yet the cumulative transformation can be substantial.
The organisation has not merely improved a tool. It has changed the role that tool plays in the distribution of knowledge, judgement and responsibility.
The original approval may no longer describe the system’s actual institutional significance.
This is particularly important because technological identity and institutional identity are not the same thing.
A product may retain its commercial name while its capabilities change. A model may remain technically unchanged while its underlying knowledge base is transformed. A system may preserve its architecture while employees begin using it for decisions that were never anticipated.
In each case, the technical continuity of the system can conceal a discontinuity in its organisational role.
The system may still be called the same thing, while no longer being the same thing that matters to governance.
Technology Does Not Change in Only One Way
Discussions about AI governance often concentrate on model updates. A new version is released, its capabilities improve, its behaviour changes and the organisation must decide whether to adopt it.
This is an important concern, but it represents only one dimension of a more complex problem.
Artificial intelligence systems evolve through several interacting forms of change, and understanding their differences is essential for designing appropriate governance.
The first is technical change.
This includes modifications to the model, its parameters, system instructions, retrieval architecture, integrations, security controls or operating environment. Some changes are visible and formally documented. Others may be introduced by external suppliers or through routine maintenance.
A technical change can affect accuracy, reliability, response patterns, data handling or the boundaries within which the system operates.
But technical change is not the only source of evolving risk.
The second is informational change.
An AI system may use the same model and software architecture while operating on a continuously changing body of information.
In a retrieval-augmented generation environment, for example, new documents may be added, existing documents modified and obsolete information removed. The retrieval mechanism may begin selecting different evidence for questions that previously produced stable answers.
The model has not necessarily changed, yet the answers may change because the information environment has changed.
This distinction matters in organisations where information is not simply descriptive but authoritative. Policies, contractual conditions, eligibility criteria, operational procedures and regulatory interpretations can all influence consequential decisions.
The third is behavioural change.
People rarely use technology exactly as its designers originally imagined.
They discover shortcuts, develop routines, share practices and adapt tools to situations that emerge through everyday work.
An AI assistant introduced for drafting may gradually become a source of recommendations. A summarisation tool may begin influencing which information senior managers consider important. A system designed to support professional judgement may become a substitute for that judgement when employees grow accustomed to accepting its suggestions.
These changes may occur without any alteration to the underlying software.
The technology is the same, but the human relationship with it is different.
Finally, there is institutional change.
This occurs when the system’s role within the organisation evolves: its outputs acquire greater authority, its recommendations influence more consequential decisions, or responsibility shifts between individuals, departments and automated processes.
Institutional change is perhaps the most difficult to identify because it often takes place gradually and informally.
No one necessarily announces that an AI system has become an authority.
People simply begin treating it as one.
The four dimensions are interconnected. A technical modification may encourage new behaviours. New behaviours may produce institutional dependence. Changes in the information environment may alter the reliability of decisions. Organisational restructuring may introduce the same system into entirely different contexts.
Governance must therefore examine not only whether the technology has changed, but whether the relationship between technology, people, information and institutional responsibility has changed.
Figure 2 — Four dimensions of AI change. An AI system can evolve technically, informationally, behaviourally and institutionally without changing its name or original purpose. These changes can accumulate and eventually invalidate the assumptions on which its original approval was based.
The Organisational Problem of Different Speeds
The tension between technological and institutional rhythms is not unique to artificial intelligence.
I have encountered different versions of it throughout successive waves of technological transformation, from early expert systems and enterprise computing to the Internet, mobile technologies, digital services and cloud platforms.
In each period, organisations faced the challenge of integrating technologies that developed according to rhythms different from those of established management processes.
What makes contemporary AI particularly interesting is the breadth of organisational activities it can influence and the apparent ease with which its outputs can be incorporated into everyday work.
An infrastructure upgrade may require a technical migration. A new enterprise application may demand process redesign and user training.
An AI capability, by contrast, can sometimes enter an organisation through an apparently modest interface and gradually influence activities far beyond its initial purpose.
Its adoption may precede a full understanding of its institutional consequences.
This creates an asymmetry.
Technology can become operationally significant before governance mechanisms recognise that its significance has changed.
The organisation’s formal structures continue to operate, but their understanding of the system may lag behind reality.
This is not simply a matter of bureaucratic slowness. Institutions have good reasons for operating through deliberate processes.
Public administrations, universities, financial institutions and other complex organisations cannot govern exclusively through continuous improvisation. Their decisions must be explainable, consistent with established responsibilities and capable of being reviewed.
Formal procedures provide continuity and protect against arbitrary decisions.
The objective should therefore not be to make institutions imitate the speed of technology.
The objective is to make institutional governance sensitive to change without sacrificing the qualities that make governance legitimate.
This distinction is crucial.
Speed alone is not a measure of intelligence.
An organisation that responds immediately to every technological development may be as poorly governed as one that responds too slowly. It may replace deliberation with reaction and mistake constant activity for meaningful adaptation.
The challenge is to identify which changes matter, why they matter and what form of institutional response they require.
That is a problem of organisational judgement.
From Calendar-Based Governance to Change-Triggered Governance
Traditional governance often relies on predetermined moments of examination.
A system is approved before deployment. Its performance is reviewed periodically. Compliance assessments are scheduled. Audits examine whether established requirements have been respected.
This approach provides structure and accountability, but it assumes that the interval between reviews can be managed through ordinary operational controls.
For evolving AI systems, that assumption deserves closer examination.
A significant change may occur immediately after an annual review. A new use case may emerge months before the next scheduled assessment. A supplier may modify a model or service in ways that affect the assumptions underlying its original evaluation.
Waiting for the next formal governance cycle may allow the consequences of those changes to accumulate.
A more appropriate approach would combine scheduled oversight with change-triggered governance.
Under this model, the organisation does not attempt to reassess every technical adjustment through the same formal procedure. Instead, it identifies the categories of change that could invalidate earlier assumptions and establishes proportionate responses.
A minor interface improvement may require little more than ordinary change management.
A modification to the model’s capabilities may justify targeted technical evaluation.
The introduction of a new category of personal information may require renewed privacy and security assessment.
The expansion of an advisory system into a consequential decision-making process may demand a broader institutional review involving legal, operational, ethical and governance responsibilities.
The key principle is proportionality.
Not every change is equally significant, and not every significant change is significant for the same reason.
A system used to help employees draft internal communications does not necessarily require the same governance intensity as one supporting decisions about access to public services.
Likewise, a technical change that improves performance without altering the system’s intended purpose may require a different response from a change that expands its authority.
The organisation therefore needs to understand the assumptions on which its original approval depended.
What was the system authorised to do? Which data could it use? Which users could access it? What decisions could its outputs influence? What level of human oversight was required? Which limitations were accepted, and under what conditions?
These assumptions form the basis against which subsequent changes can be evaluated.
Without them, the organisation may know that something has changed without being able to determine whether the change matters.
And without a clear mechanism for recognising meaningful changes, governance risks becoming a historical record of decisions rather than an active capacity to oversee the present.
Figure 3 — From approval to continuing governance. Effective AI governance combines formal assessment and authorisation with operational monitoring, recognition of significant changes and proportionate reassessment. Technical, informational, behavioural and institutional changes may require different governance responses.
The Difference Between Monitoring and Understanding
One possible response to this problem is to increase monitoring.
Organisations can collect performance metrics, record incidents, examine model outputs, monitor usage and establish alerts when technical parameters move outside expected ranges.
These capabilities are important, but they do not fully resolve the governance challenge.
Monitoring tells us that something is happening.
Understanding requires us to interpret its significance.
A system may continue meeting its technical performance targets while its institutional role changes substantially.
Response times may remain stable. Availability may be excellent. Accuracy on established evaluation datasets may show no deterioration.
Yet employees may have begun using the system for more consequential decisions. A previously optional recommendation may have become a routine step in an operational process. Human oversight may still exist formally but may be exercised less critically in practice.
From a technical dashboard, the system may appear healthy.
From an institutional perspective, the distribution of judgement and responsibility may have changed.
This is why governance cannot be reduced to telemetry.
It requires attention to the social and organisational environment in which the technology operates.
Who relies on the system? How do they interpret its outputs? What happens when they disagree with it? Are exceptions still recognised? Do employees understand the system’s limitations? Has the system become an informal authority beyond its original mandate?
These questions are difficult to answer through automated metrics alone.
They require observation, dialogue, professional expertise and institutional reflection.
The challenge resembles a familiar problem in organisational management: measuring an activity is not the same as understanding its consequences.
An organisation can measure productivity without understanding the quality of the work produced. It can measure service delivery times without understanding the experience of the people receiving the service. It can measure compliance with procedures without recognising that the procedures themselves have become inappropriate.
Similarly, an organisation can monitor an AI system continuously while failing to recognise that the system has acquired a new institutional meaning.
Effective governance requires not only detecting change but understanding what the change means.
Artificial Intelligence and the Redistribution of Authority
The most profound consequence of AI adoption may not be the automation of individual tasks.
It may be the gradual redistribution of authority within organisations.
Authority does not always move through formal delegation.
Sometimes it shifts because certain sources of information become easier to access, certain recommendations become more convenient to follow or certain forms of judgement appear more consistent than others.
Imagine an organisation in which experienced professionals have traditionally interpreted complex procedures.
An AI assistant is introduced to help employees locate relevant information. Initially, the professionals remain the recognised source of interpretation.
As the assistant improves, employees begin consulting it before approaching their colleagues. Over time, its answers become the default starting point for operational decisions.
The professionals are still present. Their formal responsibilities have not necessarily changed.
But their practical role in the circulation of knowledge has been altered.
The organisation may now depend on the assistant to frame questions, select relevant information and establish the initial interpretation of a situation.
This does not automatically represent a negative development. Better access to knowledge can reduce unnecessary dependence on individual gatekeepers and make organisations more capable.
But it changes where influence is exercised.
The architecture of the system begins to shape which knowledge is visible, which interpretations are considered plausible and which questions are asked.
A governance model focused exclusively on technical compliance may fail to recognise this redistribution.
The system has not necessarily been granted formal decision-making authority.
Nevertheless, it may have acquired substantial influence over the decisions people make.
This is especially relevant in environments where employees operate under time pressure, where procedures are complex or where the AI system communicates with a degree of confidence that exceeds the strength of its evidence.
Over time, the boundary between decision support and decision substitution can become blurred.
Governance must therefore examine not only what an AI system is technically authorised to do but also the authority people actually assign to it.
That authority is a social and institutional phenomenon, not merely a software configuration.
Why Public Institutions Face a Particular Challenge
The tension between the two clocks becomes especially consequential in public administration.
Public institutions do not operate solely according to the objectives of efficiency, competitiveness or operational performance.
They are also responsible for legality, fairness, transparency, continuity, accountability and the protection of individual rights.
Their legitimacy depends not only on the outcomes they produce but also on the procedures and responsibilities through which those outcomes are reached.
An AI system introduced into a public institution therefore becomes part of a wider institutional environment.
Even when it does not make final decisions, it may influence how information is interpreted, how cases are prioritised, how responses are prepared or which alternatives are presented to public officials.
The consequences of change cannot be assessed exclusively through technical performance.
Consider an AI assistant that helps employees interpret administrative procedures.
At deployment, the system is restricted to retrieving approved guidance and producing draft responses for professional review.
Over time, new data sources are connected, more departments begin using it and employees become increasingly comfortable relying on its suggestions.
The system may continue operating within its technical specifications while its influence over administrative practice expands.
At what point should the institution reassess its role?
The answer cannot depend exclusively on whether a software update has occurred.
It must also consider whether the system’s use has altered the practical exercise of administrative responsibility.
This is where the distinction between technological and institutional change becomes essential.
Public institutions need to preserve the ability to explain why a decision was made, which information was considered, who exercised judgement and how an affected person can challenge an outcome.
An AI system that evolves beyond the assumptions of its original assessment may complicate those responsibilities, even if it continues to function as designed.
European AI regulation provides important obligations for relevant systems, including requirements concerning risk management, human oversight, post-market monitoring and substantial modifications in applicable circumstances. These obligations, however, should not be mistaken for a complete theory of organisational governance.
Legal compliance establishes necessary boundaries.
Institutional intelligence requires understanding how the technology is actually transforming administrative practice within those boundaries.
The distinction matters because an institution can be formally compliant while still struggling to understand the cumulative organisational consequences of AI adoption.
The objective is not to create a permanent state of regulatory anxiety.
It is to ensure that technological evolution does not silently outpace institutional responsibility.
The Governance of Assumptions
Perhaps the most useful way to approach the two-clock problem is to recognise that every approval is based on assumptions.
When an organisation authorises an AI system, it implicitly or explicitly accepts a particular description of how the system will operate.
The assessment assumes a certain purpose, a defined group of users, a particular information environment, known technical characteristics and an expected relationship between human and machine responsibilities.
Those assumptions justify the decision to proceed.
But assumptions are not permanent truths.
They can become invalid as circumstances change.
A model may begin producing different kinds of outputs. The information environment may become more complex. Employees may use the system for tasks beyond its original purpose. Organisational restructuring may change the responsibilities of those expected to oversee it.
The governance challenge is therefore not simply to track changes in the system.
It is to identify when changes invalidate the reasoning behind the original approval.
This suggests a more precise principle:
Governance should preserve not only the record of a decision but also the conditions under which that decision remains valid.
That principle has implications beyond artificial intelligence.
Organisations frequently preserve the outcome of a decision while losing the reasoning that produced it.
A procurement choice is documented, but the alternatives considered may be forgotten. A policy remains in force, but the circumstances that justified it may have changed. A technical architecture persists, although the constraints that shaped it no longer exist.
When those assumptions disappear from institutional memory, organisations struggle to recognise when reconsideration is necessary.
AI makes this weakness more consequential because the systems involved may evolve faster than the organisation’s capacity to reconstruct the reasoning behind earlier choices.
A mature governance process should therefore make the conditions of approval explicit.
It should identify which changes require reassessment, who is responsible for recognising them and how the organisation determines whether the original authorisation remains appropriate.
This is not merely a documentation exercise.
It is a way of preserving institutional reasoning over time.
And preserving that reasoning is one of the foundations of organisational intelligence.
Governing AI as a Living Institutional Capability
The two clocks of AI governance reveal a broader challenge in digital transformation.
For many years, organisations have treated technology adoption primarily as a sequence of projects.
A project begins, resources are allocated, a solution is implemented and the project eventually closes. Operational responsibility is transferred, performance is monitored and the organisation moves towards the next initiative.
This model remains useful for managing investment and delivery.
But it is less adequate as a complete description of technologies whose organisational significance continues to evolve after deployment.
Artificial intelligence should be understood not merely as an implemented system but as an ongoing institutional capability.
Its governance must therefore remain connected to its use, its changing information environment and its influence on organisational decisions.
This requires a relationship between technology teams, operational management, legal and compliance functions, knowledge owners and institutional leadership.
No single function can fully understand the consequences of change in isolation.
Technology specialists may recognise modifications to models and infrastructure. Operational teams may observe changing patterns of use. Legal professionals may identify implications for rights and obligations. Senior management may recognise shifts in organisational responsibility.
The organisation becomes more capable when these perspectives are connected.
In this sense, the governance of AI is itself an exercise in organisational intelligence.
It requires the institution to observe its own behaviour, interpret change, preserve relevant knowledge and adapt its decisions without losing continuity.
This is not a call for endless committees or bureaucratic expansion.
Indeed, excessive governance complexity can create its own risks by obscuring responsibility and slowing necessary action.
The objective is a governance architecture that is selective, proportionate and capable of learning.
It should distinguish between routine technical maintenance and changes that alter institutional risk. It should preserve clear accountability while allowing operational flexibility. It should recognise that the significance of a system depends not only on its technical properties but also on the decisions and relationships it influences.
Most importantly, it should remain capable of asking whether the assumptions underlying an earlier approval still hold.
That question should not be reserved for an annual audit.
It should become part of the organisation’s ongoing relationship with the technology.
The Third Clock: The Time It Takes Institutions to Learn
There is, however, another dimension that complicates the relationship between technological evolution and institutional governance.
Beyond the clock of technology and the clock of formal governance lies a third rhythm: the time required for an organisation to learn.
Technology can be updated quickly. A governance procedure can be revised through a formal decision.
But organisational understanding develops differently.
People need time to recognise patterns, accumulate experience, discover unintended consequences and reconsider established assumptions.
An employee may initially use an AI assistant cautiously, checking every response. After months of apparently reliable performance, that employee may begin trusting it more readily.
A department may gradually reorganise its workflow around the system. New employees may learn the AI-supported process without ever experiencing the earlier way of working.
Eventually, the organisation’s practical knowledge of how to operate without the system may diminish.
None of these developments necessarily appears in a technical change log.
They belong to the slower and less visible process through which organisations adapt their behaviour.
This creates a paradox.
While technology changes rapidly, some of its most consequential effects emerge slowly.
The system may be updated in a day, but its influence on professional judgement may take months or years to become apparent.
Governance must therefore operate across different temporal horizons.
It must respond promptly to material technical changes while also observing the gradual transformation of organisational practices.
It must recognise immediate incidents without overlooking the accumulation of smaller changes.
And it must preserve institutional learning so that experience from one stage of adoption informs the next.
This is particularly important when evaluating AI success.
A system may deliver measurable efficiency improvements shortly after deployment, while its longer-term effects on expertise, accountability or organisational dependence remain uncertain.
The absence of immediate problems does not establish that the institutional consequences are fully understood.
Conversely, the emergence of new risks does not necessarily mean that adoption was a mistake. It may indicate that the organisation has reached a new stage of understanding and must adapt its governance accordingly.
The capacity to learn from these developments is what distinguishes governance as a living capability from governance as a static set of controls.
An intelligent institution does not assume that its first assessment will remain correct indefinitely.
It develops the ability to revise its understanding as evidence accumulates.
Figure 4 — Three clocks, three rhythms. AI technology evolves continuously, institutional governance operates through periodic decisions and reviews, while organisational learning develops through accumulated experience. Effective governance must reconcile all three rhythms rather than assume they move together.
From Approval to Continuing Responsibility
The governance of artificial intelligence is often presented as a question of establishing the correct rules before technology is introduced.
That is necessary, but it is only the beginning.
The deeper challenge is maintaining a meaningful relationship between institutional responsibility and technological evolution.
An organisation must know what it has authorised, why it authorised it and under which conditions that authorisation remains appropriate.
It must be capable of recognising when those conditions change.
It must understand not only the technical behaviour of its systems but also how people rely on them, how knowledge circulates through them and how their outputs influence decisions.
And it must preserve the ability to reconsider earlier choices without treating every reassessment as evidence of failure.
This is a demanding task because it requires institutions to combine qualities that are often considered contradictory: stability and adaptation, consistency and judgement, formal accountability and organisational learning.
Yet these qualities are not necessarily in conflict.
Stability does not require immobility. Accountability does not require that every decision remain unchanged. Institutional continuity can depend precisely on the capacity to recognise when established assumptions no longer reflect reality.
Artificial intelligence makes this challenge more visible, but it did not create it.
Every organisation operates within changing technological, economic and social environments. Every institution must reconcile the need for dependable procedures with the need to respond to new circumstances.
AI intensifies that tension because it can alter not only how work is performed but also how information is interpreted, how expertise is exercised and how decisions are shaped.
The question is therefore larger than whether an organisation has adopted the appropriate AI governance framework.
It concerns whether the organisation has developed the intelligence necessary to govern a technology whose significance may continue changing after its introduction.
The two clocks will never move at precisely the same speed.
Nor should they.
Institutions should not abandon deliberation in an attempt to imitate technological acceleration. And technology cannot reasonably be expected to stop evolving while organisational processes catch up.
What matters is the relationship between the clocks.
The institution must be capable of detecting meaningful divergence, understanding its consequences and responding before its formal understanding of the system becomes detached from operational reality.
Ultimately, the maturity of AI governance will not be measured only by the quality of the rules established at the beginning.
It will also be measured by the organisation’s capacity to recognise when those rules, assumptions and responsibilities need to be reconsidered.
The most important question is no longer simply whether an AI system was approved.
It is whether the institution still understands, governs and accepts responsibility for the system that exists today.
And perhaps that is the real test of organisational intelligence in the age of artificial intelligence: not merely adopting technologies that can learn and change, but building institutions capable of learning and changing responsibly alongside them.
