Most companies have a data platform, a model platform and a pile of AI pilots. Fewer have the thing that decides which of those pilots should be allowed near a customer.

The chatbot that worked a little too well

Picture a mid-sized insurer that ships an internal claims assistant in six weeks. Adjusters love it. Then someone pastes a policyholder's medical notes into the prompt box to get a quick summary, and a month later a compliance analyst asks a perfectly reasonable question: where did that text go, who could see it, and which model version produced the answer we sent to the customer?

Nobody can say. The logs exist, technically, but they live in three systems and none of them record the model version. The "approval" for the project was a slide deck and a nod in a meeting.

I have seen versions of this story enough times that I no longer think of it as a failure of any particular team.…