AI Governance Isn't Paperwork, It's Survival

There's a tempting shortcut in AI deployment: ship fast, fix later, let governance catch up when someone complains.

That shortcut, and why it doesn't work for regulated industries, was the subject of a conversation at TechEX with Maarten Stolk, founder of Deeploy, an AI governance software company, alongside two other ventures — Enjins, which builds AI applications for the energy sector, and The Stack, a physical ecosystem space for AI startups.

The interview covered what happens when banks, insurers and governments deploy AI systems without knowing what they've actually built, and why Stolk thinks the current incentive structure in AI rewards speed over safety.

"If you take a risk, at least know what kind of risk you're taking."

That line captures Stolk's central argument: most organizations deploying AI today aren't making an informed choice to accept risk — they simply don't have visibility into what they've deployed at all.

The incentive problem, not a knowledge problem

Stolk doesn't think companies lack the ability to govern AI responsibly. He thinks they lack the incentive to.

"There's not a lot of incentive to do it right to mitigate risks," he said. "You don't get a fine from the regulator anyway. You're not excluded from a market anyway. Even customers accept that things go wrong."

He compares it to a hypothetical car industry with no seatbelts, no brakes, no safety testing — one where buyers simply accept that vehicles break. "We just accept that. We don't have rules for that. We don't fine them. We just buy their cars."

The result, in his view, is a system where large AI providers capture the upside of the technology while the risk lands on society. "It feels a bit like the financial crisis in 2008," he said. "All the benefits were for the people working at a bank and the shareholders. But the risks were for society."

Most companies don't know what they're deploying

The sharpest point in the conversation wasn't about bad actors — it was about blind spots.

Stolk described seeing insurers deploy "hundreds or even thousands of agents without any governance," and said he's encountered organizations tracking their AI systems in an email inbox or a Word document. One was a public institution responsible for "a crucial element of our society."

"That's what is keeping me up at night," he said. "That's also what is motivating me."

His point isn't that every company must eliminate all risk. It's that most haven't even measured what risk they're carrying.

• No registry of AI use cases
• No monitoring of system behavior
• No understanding of each use case's purpose
• No way to show regulators what's actually running

"If you deliberately decide to take risks, that's up to you," Stolk said. "If you don't even know what kind of risk you're taking, I don't understand that. And that will go wrong."

Start with observability

For Stolk, governance isn't an abstract compliance exercise — it starts with a concrete first step: knowing what's out there.

"It starts with observability," he said. "It starts with having a complete registry in that sense, monitoring what you're doing, understanding which use case you have, understanding what the purpose of each use case is, what kind of behavior you see."

Deeploy's software is built around that premise — giving organizations a runtime registry, monitoring, and observability combined with actual controls at the use-case level, which Stolk describes as "quite unique in the market." The company works with partners such as Deloitte and Accenture to help organizations translate a risk appetite they often haven't even articulated into enforceable policy.

The more autonomy an organization hands to AI — agentic workflows acting on their own — the more this matters. "The more you delegate tasks to automated workflows by acting themselves," Stolk said, "the more you need to be on top of the governance and who does what."

The regulation is already clear enough

Asked whether the industry needs more rules or stronger enforcement bodies, Stolk pushed back on the premise.

"I think the AI Act is super clear," he said. "If organizations just follow the AI Act, I think a lot of those risks are gone." He noted it's already being adopted beyond the EU — Norway, for instance, is broadly following it — and covers roughly 20% of the global economy.

What's missing, in his view, isn't the rulebook. It's follow-through. "It's not yet enforced in full — that will happen over the upcoming years. And I would strongly advise companies to start investing in it as well, to take it seriously."

He pointed to banks as a model worth studying, not necessarily admiring unconditionally, but recognizing their head start: "They were investing in guardrails and controls years ago. They had a policy in place years ago. You can say whatever you want about them, but they've at least been taking it seriously for four or five years."

The underlying logic, for regulated institutions, doesn't even require the regulator. "If you talk about a bank or an insurer, if they lose trust, they're done. In a few weeks, they're done. You can't restore trust often as a bank."

Building things that last

Underneath the governance argument sits a broader philosophy Stolk says has shaped his companies since 2017 and 2018 — long before "AI governance" became a crowded category at industry events.

"I think a lot of them were just jumping on it because it's rather easy to vibe code something which does something with some controls," he said of newer entrants to the space. "But I think it's so deeply rooted in our DNA and in our vision that we need to have control of AI systems."

His framing of the stakes is blunt: "Don't build things that we throw away in a week from now. That's a hobby."

Asked what he'd tell his 18-year-old self, Stolk said he'd push harder, not slower — toward more ambition, not less caution. "I would probably take even more risk. And part of that risk is also just taking more time to build something that lasts." His closing advice to younger founders: "Don't jump too quickly on something. Don't fall in love with your own product instead."

The takeaway

The debate over AI safety is often framed as a tension between innovation and regulation. Stolk's experience building governance software for banks, insurers and public institutions suggests a narrower, more practical problem: most organizations deploying AI at scale simply don't know what they've built. Fixing that doesn't require new laws so much as the discipline to look.

"If you take a risk, at least know what kind of risk you're taking."

Observability isn't the end of AI governance. For most organizations today, it's the step before anything else can happen.

Interview

• Maarten Stolk — Founder, Deeploy (also Enjins, The Stack)

Event

• TechEX — October 2026