In my research with 18 UK SMEs, governance was often described as the moment when GenAI experimentation would either mature — or stop. Leaders were acutely aware of the tension.
Introduce governance too early, and you risk suffocating innovation under policy, compliance, and risk aversion. Introduce it too late, and experimentation becomes fragile — slowed by anxiety, ambiguity, and fear of misstep. Progress depended on how this balance was navigated.
Governance as legitimacy, not control
In the organisations that moved forward, governance was not treated as a control mechanism imposed after experimentation. Nor was it avoided in the name of agility. Instead, it emerged alongside experimentation as a set of provisional guardrails.
Leaders made expectations explicit around data use, ethical boundaries, and acceptable risk — but they framed these boundaries as adaptive rather than fixed. Governance was positioned not as a brake on activity, but as a legitimacy framework that made exploration feel safe enough to participate in.
Where governance went wrong
Where governance was absent, employees hesitated. They worried about unknowingly crossing lines that had not yet been defined. Experimentation slowed not because it was prohibited, but because it felt exposed.
Conversely, in organisations where governance arrived as heavy, fully formed policy — often driven by legal or compliance reflexes — experimentation stalled for a different reason. Boundaries felt punitive rather than enabling. Learning was constrained by fear of formal breach rather than guided by shared judgement.
The right amount
Effective governance sat between these extremes. It did not attempt to predict every risk or codify every behaviour. It acknowledged uncertainty and established working norms that could evolve as understanding deepened.
Importantly, trust did not emerge because risk was eliminated. It emerged because risk was made discussable. Employees understood where they could explore, where caution was required, and where escalation was expected. This clarity reduced both recklessness and paralysis.
GenAI readiness improved when governance was visible, adaptive, and proportionate to organisational understanding. Not too little. Not too much. Just enough to legitimise learning without freezing it.