At a Glance
- An AI governance policy written primarily to satisfy an examiner or a board risk committee frequently never reaches the desk of the person making a daily AI-assisted decision in originations or servicing.
- Research from Secured Research finds that among equipment finance companies with a documented AI governance policy, 46% could not confirm that frontline staff using AI tools had reviewed or been trained on the policy’s contents; among firms where frontline staff had been trained on the policy directly rather than through a cascading manager briefing, reported policy violations or undocumented workarounds ran at less than half the rate.
- Kristin Esche, General Counsel at Agiloft, built her October 8 Converge AI session, “AI with Guardrails: Moving Faster Without Flying Blind,” around governance frameworks designed to be usable by the people actually working with AI day to day, not just defensible to whoever audits them later.
- A governance policy that exists to survive an audit and a governance policy that exists to guide a daily decision are not the same document, and most firms have only written the first one.
The Policy That Passed Review and Changed Nothing
A governance document drafted primarily by legal and compliance, reviewed by a board risk committee, and filed as an approved policy can be genuinely well-constructed from a legal-risk standpoint and still have zero operational effect, because nobody built a mechanism for it to reach or be understood by the person using an AI tool to draft a customer communication or flag a portfolio exception on a Tuesday afternoon. The policy exists. The gap between its existence and its actual use is where the governance failure lives, and that gap is invisible to the same board risk committee that approved the document, because their review process only checks whether the policy exists and reads well — not whether anyone downstream has internalized it.
Why “Guardrails” Beats “Policy” as a Design Frame
Esche’s framing of governance as guardrails rather than policy is a meaningful distinction, not a rebranding exercise. A policy document is written to be referenced when something goes wrong — read reactively, after the fact, usually by legal. A guardrail is written to be present in the moment of the decision itself — a defined boundary the frontline user encounters at the point of use, not a document they were supposed to have read six months earlier during onboarding. The equipment finance companies getting real governance value are building the second kind and treating the first kind as necessary but insufficient.
Finding the High-Impact Use Cases Instead of Regulating Everything Equally
A governance framework that treats every AI use case with identical scrutiny — an internal drafting assistant and an automated credit decisioning tool under the same review cadence — spends its limited compliance attention inefficiently and trains staff to see governance as generic friction rather than a meaningful signal. Esche’s session addresses identifying the specific high-impact use cases where AI creates measurable business value and where governance attention should concentrate, which requires the legal and compliance function to actually understand what the AI tools are doing operationally, not just what the vendor contract says they do.
What Changed When the Guardrail Moved to the Point of Use
A funder rebuilt its AI governance approach after discovering that frontline underwriters were using a generative AI tool to draft adverse action language without anyone confirming the output matched required regulatory phrasing — a use the original policy technically covered but that nobody using the tool had connected to the policy document sitting in a compliance shared drive. The fix embedded a required compliance-language check directly into the tool’s workflow rather than relying on staff to recall a policy from onboarding. A compliance officer at the funder described the shift: “The policy was always technically correct. It just lived somewhere nobody was looking at the moment they needed it. Moving the actual guardrail into the tool itself, instead of trusting people to remember a document, is what changed our exception rate.”
Why Legal Alone Can’t Write a Usable Guardrail
A governance document written entirely inside the legal and compliance function, without operational input from the people who will actually encounter its constraints daily, tends to optimize for comprehensive risk coverage over usability — which is the correct instinct for a document meant to survive an examiner’s review and the wrong instinct for a document meant to be followed by someone mid-task. Esche’s position as General Counsel at a company built around contract and compliance automation gives her session a specific vantage point: she is arguing the case for guardrails from inside a legal function, not against one, which is a meaningfully different message than an operations team telling legal to loosen its standards. The credibility of that framing matters for firms whose legal departments have historically treated any AI governance conversation as a request to say no.
The firms translating this well are running joint drafting sessions — legal, compliance, and the operations leads who will use the tools — rather than legal drafting in isolation and circulating the finished document for operational sign-off after the substantive decisions are already made. The difference shows up immediately in whether the resulting guardrail reads as a rule handed down or a boundary the operational team helped define and therefore understands the reasoning behind.
The Cost of Getting the Balance Wrong in Either Direction
The risk here runs in both directions, and Esche’s session title — moving faster without flying blind — names both failure modes deliberately. A governance framework calibrated too conservatively slows every AI initiative to the pace of the most risk-averse reviewer, and staff route around a bottleneck that feels arbitrary rather than adopt it, which produces exactly the undocumented workaround behavior the policy was meant to prevent. A framework calibrated too loosely, or one that exists only on paper without a point-of-use mechanism, produces the adverse-action gap described above. Getting the calibration right requires legal to understand the operational stakes of over-restricting a high-value use case as clearly as it understands the compliance stakes of under-restricting a risky one, which is a balance most governance documents are not currently written to strike.
Firms that revisit this calibration on a defined cadence — not just at initial policy drafting, but as new AI use cases get proposed — tend to avoid both failure modes better than firms that treat the governance document as a one-time deliverable. A guardrail written for the AI use cases a firm had eighteen months ago is frequently miscalibrated for the ones it’s proposing today, in either direction, and the firms getting this right treat the governance framework itself as something with its own maintenance cycle rather than a document filed once and referenced indefinitely.
What To Do About It
- Distinguish explicitly between governance documentation built for audit defense and governance guardrails built to be encountered at the point of an AI-assisted decision — build both, and don’t mistake one for the other.
- Confirm directly with frontline staff, not through a cascading manager briefing, that they have reviewed and understood the governance policy for the specific AI tools they use.
- Concentrate governance review intensity on the specific high-impact use cases where AI materially affects a customer or credit outcome, rather than applying identical scrutiny to every AI use case in the organization.
- Send legal, compliance, and a frontline operations lead together to Esche’s October 8 Converge AI session — the guardrail-versus-policy distinction requires all three perspectives in the room.
A governance policy that only legal has read is a policy that only protects the company after something has already gone wrong. Esche’s October 8 Converge AI session is built to move the guardrail to where the decision actually happens. Bring your legal, compliance, and operations leads and register at Converge AI.
Secured Research is a commercial capital research practice formed as a joint venture between Monitor/ABF Journal and Sawbux. Since 2010 its panels have surveyed more than 900 secured finance companies, 28,000 middle-market decision makers, 11,000 equipment and technology sellers, and 506,000 small businesses. Findings cited in Monitor Suite are drawn from the following always-on 2026 research programs:
- 2026 Annual Survey of Commercial Finance Decision Making — more than 6,200 equipment buyers, from small business through the upper middle market, across 38 SIC industry groups.
- 2026 Commercial Study of Indirect Asset Finance — 10,609 equipment vendors across 27 SIC industry groups, from local dealers to the largest global OEMs.
- 2026 Back Bench Operations Research — more than 600 finance companies across the capital stack, examining operations, leadership, customer experience, and go-to-market strategy.
