Most of the leaders we talk with in highly regulated environments are stuck somewhere between two bad options. Either they watch their frontline teams build workarounds because the approved tools can’t keep pace with the mission, or they stall indefinitely waiting for a policy green light that never quite arrives.
Neither path works. And neither is the real problem.
The real problem is how governance gets designed in the first place. When compliance frameworks are built to prevent movement rather than direct it, they don’t stop risk – they just push it somewhere harder to see. Your teams find workarounds. Your IT department eventually discovers them. And now you have an undocumented capability operating outside any guardrail at all.
That’s not a compliance win. That’s exactly what compliance was supposed to prevent.
Guardrails Are for Going Fast, Not for Stopping
Think about how guardrails actually work on a road. They don’t slow you down. They define the lane so you can move with confidence, even when the terrain gets difficult.
A compliance framework should do the same thing. Its job is not to block new capabilities. Its job is to create a defined path through which your organization can move at speed – with documentation, with oversight, and with outcomes that hold up to scrutiny.
When a compliance team’s first instinct is to say no until further notice, that’s not caution. That’s a design failure. And it often creates more organizational risk than a well-documented pilot would have.
The Two Traps
Regulated organizations tend to fall into one of two patterns when a new capability enters the picture.
The first is rushing in. The tool looks useful, the team is excited, and deployment happens before security or legal has a clear picture of what’s being adopted. This is shadow IT in motion. It often produces good short-term outcomes and serious long-term exposure.
The second is waiting. Someone decides the organization isn’t ready, or that the policy needs to be complete before any testing can begin. Months pass. The policy gets revised. More months pass. Meanwhile, peer organizations have completed pilots, documented results, and started scaling.
Both traps share the same root cause: compliance and operations are treated as separate processes instead of a single one.
What the Leaders Who Get This Right Actually Do
They don’t wait for a perfect policy. They build a controlled pilot.
That means scoping a small deployment, identifying what success looks like before launch, documenting what happens during the pilot, and bringing compliance in at the start – not at the end when they’re reviewing a fait accompli.
The pilot becomes the evidence. The outcomes make the case for broader rollout far more effectively than any policy argument would. And because compliance was in the room from day one, the path to broader adoption is already mapped.
This approach isn’t unique to one sector. We’ve seen it work in federal government, in defense contracting, and in commercial enterprise. The context changes. The method holds.
Where to Start
If your organization is stuck in either trap, the first move is simple: get compliance and operations leadership in the same room around a specific, bounded question.
Not “should we adopt AI?” or “how do we govern emerging technology?” Those conversations drift.
Try something more concrete: “What would a 90-day pilot of this capability look like, and what would we need to document to make the case for expansion?”
That question has an answer. It has owners. It has an end date. And it keeps both sides of the table focused on outcomes instead of position.
Compliance and innovation aren’t natural enemies. They just tend to get managed that way.
Dr. Jose Lugo Santiago is the chief leadership and foresight strategist for LS|EG, a consulting firm dedicated to facilitating change through leadership, strategy, and foresight. He holds over 28 years of experience leading organizations in the military and civilian sectors, and crafting strategy to meet successful business process re-engineering and innovation. He is also the author of several titles to include peer-reviewed academic works. His doctoral areas of research are Leadership and Foresight, Culture, Strategic Change, and Organizational Development.