AI governance at scale: from pilot to production

In short: AI governance means deciding who approves each use of AI, with which data, which controls and which metrics. It does three jobs: it keeps you compliant with the EU AI Act, whose Annex III high-risk rules apply from 2 December 2027; it makes automated decisions explainable; and it gets projects past the pilot stage.

Key takeaways

• Trustworthy AI has three components: it is lawful, ethical and robust. Explainability is what makes it verifiable.
• Part of the AI Act already applies: banned practices and AI literacy since 2 February 2025, transparency for chatbots and deepfakes since 2 August 2026.
• The Digital Omnibus moved high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). They are postponed, not removed.
• Projects stall at the pilot mostly because nobody owns them, the data is not production-ready and there are no approval rules, not because the technology falls short.
• Since 2 February 2025 companies that use AI must support their staff's AI literacy. No certificate is needed, but you should keep an internal record of training.
• In Italy, Law 132/2025 adds national rules, such as informing workers when the employer uses automated decision-making or monitoring systems.
• What your website chatbot says, your company says: you cannot shift your responsibility towards customers onto the algorithm.

Why AI governance matters now for ecommerce and B2B companies

In many companies AI is still a set of experiments: a writing assistant for product pages, a website chatbot, a few CRM automations, each with its own API key and nobody sure which data leaves the business.

That no longer holds, for two reasons. The first is regulatory: the AI Act has been in force since 1 August 2024, applies in phases, and some rules already cover companies that use AI as well as those that build it. The second is organisational: large enterprises are formalising governance. In IBM's study of 2,000 CEOs and senior leaders published in May 2026, 76% of surveyed organisations have a Chief AI Officer, up from 26% the year before.

For an ecommerce business or an established B2B company the consequence is practical: larger customers and partners will ask how you use AI and who is accountable.

Without governance the risks are real: unfair or discriminatory uses, breaches that can carry heavy fines, wrong information given to customers that the company is still liable for, duplicated costs and confidential data leaving the business unchecked. The sections below take them one at a time.

What is trustworthy artificial intelligence?

Trustworthy AI is AI that is lawful (it complies with the law), ethical (it respects ethical principles and values) and robust, both technically and in its social context. The definition comes from the ethics guidelines published by the European Commission's High-Level Expert Group on AI on 8 April 2019. They are not binding, but alongside the AI Act they are still a useful benchmark for judging whether an AI system can be trusted.

They set out seven requirements: human agency and oversight, technical robustness and safety, privacy and data governance, transparency, diversity and non-discrimination, societal and environmental well-being, and accountability.

Explainability in practice

Explainability is the ability of an AI system to make clear why it produced a given result, in a way that suits the person who uses or is affected by that decision.

• Ecommerce: the fraud system blocks a €1,200 order. Customer service needs to see which signals counted (shipping address different from billing, card issued in another country, unusual purchase speed) and who can release the order.
• B2B: a lead scoring model gives one company 85 points and another 20. Sales reps need to see what drove the score (company size, industry, pages visited, previous enquiries). Otherwise they stop trusting it and go back to their spreadsheet.

Explainability is more than good practice. The GDPR (Art. 22) gives people the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them. The exceptions are few (contract, law, explicit consent), and even then the company must at least provide human intervention and let the person express their point of view and contest the decision. The AI Act adds, for decisions based on an Annex III high-risk system, the right to obtain from the deployer clear and meaningful explanations of the role the AI system played in the decision (Art. 86).

How to get explainability in practice:

• Choose tools that show the why: for predictive models (scoring, fraud detection, demand forecasting), ask the vendor which factors drove each individual result. Open-source libraries such as SHAP calculate exactly how much each factor contributed to a prediction.
• Make generative AI cite its sources: an assistant answering questions on price lists, stock or return terms should point to the document it took the information from, so the operator can check it.
• Log inputs, outputs and model version: without logs you cannot reconstruct a decision a customer disputes.
• Provide a human way out: the person affected by a decision must know whom to ask for a review.

An explainable system also makes fewer mistakes: when you can see which factors a result rests on, you notice sooner when the model leans on bad data. And it becomes a trust argument when a B2B customer asks how you use AI in processes that affect them.

What does the EU AI Act require from businesses, and when?

The AI Act sorts systems by risk level and assigns different obligations to those who build them (providers) and those who use them (deployers). A deployer is a company that uses an AI system under its own authority for professional purposes. That is almost always the role of an ecommerce or B2B company buying AI tools.

There are four categories: unacceptable risk (banned practices), high risk (allowed but regulated), transparency risk (chatbots, deepfakes) and minimal risk, which covers most uses with no extra obligations.

Date	What applies	What it means for a company
2 February 2025	Banned practices and AI literacy (Art. 4)	No prohibited uses; measures to build AI skills among the people who use it
2 August 2025	General-purpose AI models, governance, penalties	Mainly obligations for model providers
2 August 2026	General application, including transparency rules (Art. 50)	Your website chatbot must say it is AI; deepfakes must be labelled
2 December 2026	New ban added by the Omnibus; marking of synthetic content (Art. 50(2)) for certain systems already on the market	Check with your generative AI vendors
2 December 2027	Obligations for Annex III high-risk systems	Recruitment, worker evaluation, access to credit
2 August 2028	Obligations for high-risk AI built into products (Annex I)	Machinery, lifts, toys and similar regulated products

The high-risk delay comes from the Digital Omnibus on AI, in force since 27 July 2026. The same package softened the AI literacy duty: companies must support the development of AI skills among the people who operate and use their systems, and no longer have to guarantee a sufficient level for every individual. It also extended some SME simplifications to small mid-caps, companies with fewer than 750 employees and turnover up to €150 million. Many established B2B companies fall into that band.

As a deployer of a high-risk system you must follow the provider's instructions, monitor it, assign oversight to competent people, use relevant input data, and inform workers and their representatives beforehand if you introduce it at work. The high-risk list also covers targeted job advertising and filtering job applications, so anyone using AI in HR should look there first, as I explain in the article on AI in HR processes and compliance.

Fines go up to €35 million or 7% of worldwide annual turnover for banned practices, up to €15 million or 3% for breaching other obligations, and up to €7.5 million or 1% for supplying incorrect information to authorities. In Italy the AI Act sits alongside Law no. 132 of 23 September 2025, in force since 10 October 2025, which sets national provisions on artificial intelligence.

Typical use	Likely category	What to do
Customer service chatbot on the website	Transparency	Tell users clearly they are talking to AI
Realistic generated images (e.g. people wearing a product)	Transparency, if they qualify as deepfakes	Assess case by case and label them visibly
Product recommendations, demand forecasting, spam filters	Minimal risk	No specific AI Act duty; GDPR and consumer law still apply
Lead scoring on B2B accounts	Usually minimal risk	Explainability still helps sales adoption
CV filtering and targeted job ads	High risk (Annex III)	Prepare for deployer obligations by 2 December 2027
Emotion recognition of employees	Banned	Rule it out: the ban has applied since 2 February 2025

Treat the table as a guide: classification depends on actual use and should be checked against the Commission's guidelines on high-risk classification, published in draft in May 2026.

Why do AI projects get stuck at the pilot stage?

A project gets stuck at the pilot when it has proved the technology works but nobody has decided who runs it, with which data and under which rules. A pilot is a test in a protected setting. Scale means a daily process with real customers, real errors and real accountability.

Unlike an ERP, an AI system needs recalibration over time, because data, catalogue and vendor models change. The most common blockers:

• No owner: once the test ends, nobody is accountable.
• Data not ready: the pilot used a clean extract, while production brings duplicate records and empty fields. Scaling takes data engineering (cleaning, integrating and keeping sources up to date), not just a good model.
• Distrust of the algorithm: if users do not understand why the system suggests something, they ignore it. This is where explainability becomes a condition for adoption.
• Demo metrics: teams measure how impressive the answer looks, not how much time or how many errors it saves. Without a baseline there is no business case, as I cover in the guide to KPIs for measuring the value of AI.
• Late approvals: legal, privacy and IT only see the project at launch, and stop it.
• Adoption: the people meant to use it were never involved and work as before. Resistance to change drops when the team takes part from the early stages and sees concrete benefits in their own work, such as hours saved on a repetitive task.

A hypothetical case: a B2B components manufacturer with 80 employees tests an AI assistant that drafts replies to requests for quotation, and in the pilot it works on 50 hand-picked requests. Production needs three decisions: who approves the proposed prices, which price list the system reads, and which discount threshold forces a sales rep's review. Without those decisions it stays a demo.

How do you move an AI pilot into production?

You move when every part of the pilot has a production-grade equivalent. The table sums up what changes:

Aspect	In the pilot	In production
Data	Clean, hand-picked extract	Real data, connected to ecommerce, CRM or ERP and kept up to date
Users	A few motivated volunteers	The whole department, sceptics included
Metrics	Perceived answer quality	Business KPIs against a baseline: time, errors, conversions
Accountability	The project team	A named process owner
Controls	Occasional manual checks	Logs, thresholds above which a person decides, scheduled reviews
Maintenance	None	Recalibration when data, catalogue or the vendor's model change

Manage the switch with a roll-out roadmap, not a single go-live:

1. Extend one department at a time, starting with the one that ran the pilot.
2. Name a champion in each department, someone their colleagues respect, who uses the tool first, collects problems and takes them to the owner.
3. Prepare a communication plan: what changes, what stays in people's hands, whom to report errors to.
4. Set go/no-go criteria: which results justify wider use and when you roll back.

The same method works for any automation, as I explain in the guide to business process automation.

How do you run AI governance at scale?

AI governance at scale means applying the same rules to every use, without starting from scratch with each new tool. A useful reference is NIST's AI Risk Management Framework, released on 26 January 2023 for voluntary use, which organises the work into four functions: govern, map, measure and manage.

A picture helps: a fleet of self-driving cars. It is not enough for each car to run well; you need a control system that coordinates their movements and enforces the rules of the road. AI works the same way: each tool can perform well on its own, but without shared rules costs, risks and data get out of hand.

For a mid-sized company that comes down to three things:

• A register of AI uses: for each tool, its purpose, vendor, the data it uses, risk category, owner and date of the last review.
• A single integration point: when every department calls models with its own API key, you lose cost control, logs and data rules. Routing calls through one layer (an orchestrator such as n8n or Make, or an internal gateway) lets you trace every request, limit the data sent and switch models without rewriting integrations. It is also a first line of defence: fewer scattered keys means fewer entry points to protect, as I explain in the guide to ecommerce security against ransomware and fraud.
• Rules that fit the context: an assistant that summarises internal documents does not need the same controls as an agent that edits orders or prices. Review governance whenever the context changes: a new market, a new sales channel, a new model version.

The third point weighs more with AI agents, which take actions inside business systems, and it confirms that the value of AI depends on the operating context you put it in, as the guide to agentic AI in ERP systems shows.

Do you need a Chief AI Officer? Who should lead governance

A Chief AI Officer (CAIO) is the executive accountable for a company's AI strategy: setting priorities, tying projects to business goals and overseeing data, risk and compliance. The role is growing fast in large organisations. The same 2026 IBM study found that organisations with an AI-first approach to C-suite design have scaled 10% more AI initiatives enterprise-wide than their peers.

A 30-person ecommerce business or a 150-person B2B company rarely needs a full-time CAIO: it needs the function, not the title. In practice that means one member of management accountable for AI who approves new uses, a small monthly committee (management, IT, privacy or legal, a department head), an owner for every process where AI decides or suggests, and in-house or external technical support for integrations, logs and vendors.

Whether it is a CAIO or an internal lead, the role needs three skills: enough technical knowledge to assess vendors and risks, the ability to lead people from different departments, and a grasp of the business numbers. The hardest task is breaking down silos: AI delivers more when data, people and processes from different departments work together, for example when customer service uses the same product data as marketing and the same order history as sales. Data governance is part of the job too: which data may feed AI systems, on which privacy legal basis and with which safeguards. It is a compliance matter, but also one of trust with customers and partners.

One useful clarification: in its AI literacy Q&A the European Commission states that the AI Act does not require a GDPR-style AI officer or an AI governance board: no specific governance structure is mandated to comply with Article 4. The function exists to manage AI well, not to tick a box.

For the management side, see the article on artificial intelligence and leadership; if you run an SME at the start of the journey, begin with the guide to AI for SMEs.

Is AI training mandatory for employees?

Yes, on the terms of Article 4 of the AI Act. Since 2 February 2025 providers and deployers of AI systems must take measures to support the AI literacy of their staff and of other people who operate the systems on their behalf, such as contractors and service providers. After the Digital Omnibus no specific level is guaranteed for each person, but the duty remains. National market surveillance authorities supervise and enforce it from 2 August 2026, with a proportionate, case-by-case approach.

It covers everyday uses too. According to the Commission, a company whose employees use ChatGPT to write ad copy or translate text must inform them of the specific risks, such as hallucinations, meaning false answers presented as true. No certificate is needed: an internal record of training and guidance is enough. A minimum programme, again according to the Commission, covers four points:

• what AI is, how it works, which systems the company uses, and their opportunities and dangers;
• the company's role: does it develop AI systems or use systems built by others;
• the risks of the systems in use and what the people using them need to know;
• actions tailored to people's existing knowledge and to the context of use.

Deployers of high-risk systems must also train the staff who carry out human oversight.

What should a company AI policy include?

The policy tells employees what they may do with AI. Its main job is to curb shadow AI: unapproved tools used on personal accounts, with nobody knowing which data leaves the company. Banning everything rarely works: if approved tools are too limited, people find workarounds. A few clear rules work better:

• Approved tools and the company accounts to use, with the name of whoever authorises new ones.
• Data that must never leave: personal data of customers and staff, confidential price lists and terms, contracts, source code, information covered by NDAs with B2B customers.
• Human review of any generated content before it is published or sent to a customer.
• Banned uses (the practices prohibited by the AI Act) and uses that need approval: anything that decides about people, prices or contracts.
• Transparency towards customers and workers: chatbots disclosed, synthetic content labelled, staff informed where required.
• Reporting of errors and incidents: to whom and how fast.

Two pages are enough, as long as they are kept current and someone owns them. For use cases and tool selection, see the guide to generative AI for business.

What changes in Italy with Law 132/2025?

Law no. 132 of 23 September 2025, in force since 10 October 2025, adds national rules alongside the AI Act. If you operate in Italy, three articles matter most:

• Work (Art. 11): AI at work must be safe, reliable and transparent, must not conflict with human dignity and must not breach the confidentiality of personal data. Employers and clients must inform workers in the cases set out in Art. 1-bis of Legislative Decree 152/1997, that is when they use fully automated decision-making or monitoring systems for hiring, managing or ending the relationship, assigning tasks, supervision and performance evaluation. The same article bans discrimination based on sex, age, ethnic origin, religion, sexual orientation, political opinions and personal, social or economic conditions.
• Intellectual professions (Art. 13): professionals may use AI only for instrumental and support activities, with their own intellectual work prevailing, and must tell clients which AI systems they use, in clear, simple and complete language.
• Authorities (Art. 20): the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) are the national AI authorities. ACN handles supervision, including inspections and penalties; the Bank of Italy, CONSOB and IVASS remain market surveillance authorities for their sectors.

In practice: if you use AI to plan shifts, evaluate performance or screen candidates in Italy, update the information given to workers and your privacy documentation before you switch it on, not after.

Who is liable when AI gets it wrong?

Towards the customer, the company that uses it. The best-known case is Moffatt v. Air Canada (2024). The airline's chatbot told a customer he could apply for a bereavement fare within 90 days of the ticket being issued; the airline later refused because the fare did not apply to completed travel. Air Canada argued that the chatbot was a separate legal entity responsible for its own actions. The British Columbia Civil Resolution Tribunal rejected that: the company is responsible for all the information on its website, whether it comes from a static page or a chatbot. The award was C$650.88 plus interest and fees.

It is a Canadian decision, but the reasoning applies to any ecommerce business: a chatbot answering questions on returns, prices, delivery times or warranties should be treated like a page of your website. That means approved content, answers based on up-to-date documents, conversation logs and a handover to a person when in doubt.

If you make and sell products with built-in software or AI, such as connected machinery, there is also the new EU Product Liability Directive (2024/2853), which Member States must transpose by 9 December 2026. It makes clear that software, including AI systems, is a product: manufacturers can be held liable for defects that existed when the product was released, even when they surface later because of updates or machine-learning features.

Finally, watch your role. Under Article 25 of the AI Act, if you put your name or trademark on a high-risk system, make a substantial modification to it, or change its intended purpose so that it becomes high-risk, you are treated as the provider, with far heavier obligations than a deployer. That would apply, for example, to a company reselling under its own brand an AI recruitment tool developed by someone else.

How to choose a trustworthy AI vendor: questions to ask

Much of AI governance is decided at the point of purchase. Before you sign, ask the vendor about:

• Data: where it is processed and stored, for how long, and whether it is used to train models.
• AI Act role and documents: whether they consider themselves the provider, which risk classification they assign and which instructions for use they supply (deployers of high-risk systems are required to follow them).
• Explainability: how the tool shows why it produced a result (factors, cited sources, confidence level).
• Logs: which records they make available and for how long.
• Model changes: how and how far in advance they notify you when the underlying model changes.
• Human handover: whether a handover to a person is supported and how it is configured.
• Certifications: for example ISO/IEC 42001.

ISO/IEC 42001:2023 is the international standard for AI management systems: it sets requirements for establishing, implementing, maintaining and continually improving an AI management system and applies to any organisation, of any size, that provides or uses AI-based products or services. For a B2B company it is worth considering when larger customers ask for it in supplier qualification questionnaires; otherwise the register, policy and logs described in this article cover the substance.

How to apply it in your company: first steps

1. Map current AI use within 30 days. Ask every department which AI tools they use, free ones included, and fill in the register.
2. Classify each use by risk. Separate minimal risk, transparency and possible high risk (HR, credit); stop banned practices at once.
3. Appoint an owner and write a two-page policy. Approved tools, data that must never leave (personal data, confidential price lists, contracts), cases needing human review.
4. Fix transparency. Chatbot disclosed as AI, realistic generated images labelled where needed, basic training for daily AI users.
5. Take one pilot into production, with KPIs and logs. Pick the project with the most measurable return, connect it through the single integration point and schedule reviews at 30, 60 and 90 days.

If the hardest part is connecting AI, ecommerce, CRM and ERP, that is the work I do in custom systems and automations. You will find more articles in the AI for business section of the blog.

Mistakes to avoid

• Waiting until 2027: bans, AI literacy and transparency already apply. The delay mainly concerns high-risk systems.
• Treating governance as a document: a policy nobody reads protects nobody. You need an up-to-date register, accessible logs and an accountable person.
• Letting every department buy its own tools: it multiplies costs, API keys and data flows that nobody controls.
• Automating decisions about people without human review: this is where explainability matters most and where the rules are strictest.

Frequently asked questions (FAQ)

What is trustworthy AI?

Trustworthy AI is artificial intelligence that is lawful, ethical and robust. The concept comes from the 2019 ethics guidelines of the High-Level Expert Group on AI appointed by the European Commission, which set seven requirements including human oversight, transparency and accountability. They are not binding, but remain a useful benchmark alongside the AI Act.

When does the EU AI Act apply to companies that use AI?

In phases. Bans and the AI literacy duty have applied since 2 February 2025, and transparency rules for chatbots and deepfakes since 2 August 2026. Obligations for Annex III high-risk systems apply from 2 December 2027, and for Annex I systems from 2 August 2028.

Does my ecommerce chatbot have to say it is AI?

Yes. The AI Act's transparency rules require that people know when they are interacting with a machine. A clear notice when the chat opens is enough, for example "You are chatting with an AI assistant". As good practice, also offer a way to reach a person.

What does explainability mean for an AI system?

It means being able to say why the system produced a result, in terms the user or the affected person can understand. In practice you log inputs and outputs, show the operator the main factors behind the decision and always keep human review for sensitive cases.

Why do AI projects fail to move past the pilot?

Usually there is no owner, no production-ready data, no business metrics and no early sign-off from IT and privacy, rather than a technical limit. A pilot should be designed from day one with production rules.

Does a small or mid-sized company need a Chief AI Officer?

Rarely full time, and according to the European Commission the AI Act does not mandate an AI officer role. It does need someone in management who is accountable for AI, approves new uses and keeps the register of tools, backed by in-house or external technical support. The function matters more than the title.

Is AI training mandatory for employees?

Yes. Since 2 February 2025 the AI Act requires companies that use AI systems to take measures to build the AI skills of the staff who use them. After the Digital Omnibus no minimum level is set for each person and no certificate is needed: an internal record of training is enough. Even staff who use ChatGPT for copy or translations must be told about the risks, such as hallucinations.

Sources

• European Commission, AI Act: regulatory framework and application timeline
• European Commission, AI Omnibus enters into force (27 July 2026)
• European Commission, Navigating the AI Act (FAQ)
• Future of Privacy Forum, The AI Act implementation timeline: what changes under the AI Omnibus? (July 2026)
• High-Level Expert Group on AI, Ethics guidelines for trustworthy AI (8 April 2019)
• NIST, AI Risk Management Framework: Govern, Map, Measure, Manage
• IBM, IBM Study: CEOs are reshaping C-suite roles for the AI era (4 May 2026)
• Gazzetta Ufficiale, Law no. 132 of 23 September 2025 on artificial intelligence (Italian)
• European Commission, AI Literacy: Questions & Answers (Article 4 of the AI Act)
• Regulation (EU) 2016/679 (GDPR), Art. 22: automated individual decision-making, including profiling
• EU AI Act Explorer, Article 86: right to explanation of individual decision-making
• EU AI Act Explorer, Article 25: responsibilities along the AI value chain
• European Commission, Liability for defective products (Directive (EU) 2024/2853)
• The Guardian, Air Canada ordered to pay customer who was misled by airline's chatbot (16 February 2024)
• Civil Resolution Tribunal (British Columbia), Moffatt v. Air Canada, 2024 BCCRT 149 (14 February 2024)
• IEC Webstore, ISO/IEC 42001:2023 Information technology, Artificial intelligence, Management system
• SHAP, official documentation

If you want to see which AI uses are already running in your company and how to take one into production with clear rules, book a free assessment.