Don't Fight the River: Why AI Governance Must Enable, Not Restrict

"The river always finds a way around." — Luiza Nutt, Group GM — Networks, Cybersecurity and Infrastructure, JB Hi-Fi. Factor Insights CIO event, June 2026.

It's a simple metaphor, but one that captures one of the greatest challenges facing organisations adopting artificial intelligence.

People are remarkably good at solving problems. When they encounter friction, they'll look for another path. If approved systems are too slow, too limited or simply don't meet their needs, they'll find alternatives. In today's workplace, that often means employees turning to publicly available, often unsanctioned AI tools without organisational oversight—a phenomenon now widely referred to as Shadow AI.

This presents a difficult balancing act for technology leaders. On one hand, AI offers unprecedented opportunities to improve productivity, accelerate decision-making and unlock new ways of working. On the other, unmanaged use of AI introduces genuine risks around privacy, intellectual property, regulatory compliance and data security.

The instinctive response can be to restrict access. In practice, however, prohibition rarely succeeds.

As Luiza Nutt astutely observed at a conference I attended in July 2026, "the river always finds a way around." Human behaviour doesn't stop simply because a policy says it should. Employees are rarely trying to circumvent governance for malicious reasons. More often, they're trying to do their jobs more effectively. If the approved path doesn't help them achieve that outcome, they'll naturally seek another.

This is why effective AI governance cannot be built on control alone. The organisations making the greatest progress are recognising that governance should enable innovation rather than suppress it. They are providing staff with capable, enterprise-grade AI tools that meet real business needs while operating within clearly defined security, privacy and compliance guardrails. Rather than forcing employees to choose between productivity and policy, they make the governed option the easiest and most effective option.

Technology, however, is only part of the solution. Education is equally important. Every employee now needs a baseline understanding of how AI works, where its limitations lie and what information should never be shared with public models. They need to understand that AI-generated content requires human judgement, that outputs should be verified, and that responsible use is everyone's responsibility—not just the IT department's.

Governance documents sitting in SharePoint will not change organisational behaviour. Capability building will. This represents a significant shift in how we should think about digital governance. Traditional governance has often focused on restricting risk. AI governance demands something broader. It requires organisations to understand human behaviour, anticipate how people naturally work, and design systems that channel innovation safely instead of attempting to block it altogether.

At Xperiens Digital, this philosophy aligns closely with our approach to AI transformation. Successful governance isn't measured by the number of policies written or systems locked down. It's measured by an organisation's ability to empower its people to use AI confidently, responsibly, ethically and productively.

Perhaps the river is the perfect analogy.

The objective isn't to build a dam and hope the water stops flowing. Rivers don't work that way.

Instead, the role of governance is to build strong banks and well-designed channels that allow the water to reach its destination safely. AI adoption will continue to accelerate. The organisations that thrive won't be those that resist the current—they'll be those that learn how to guide it.