Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
June 3, 2026
Originally published in ACTIO E-Magazine Edition 29 (June 2026). Law as of June 2026.
Expert: Syahraki Syahrir, S.E., M.M., CISA, CISM, CDPSE, GRCP — CEO & Partner, Veda Praxis
Periodic compliance is not enough for AI, because AI learns, evolves, and interacts dynamically with data and users in real time. Governance must therefore shift from a checklist mentality into a living system, continuous, adaptive, and embedded in daily operations, led from the top. As Syahraki Syahrir puts it, the shift is not merely about technology, it is about culture and leadership.
The shift is not merely about technology, it is about culture and leadership. At this stage, AI is no longer a static system; it learns, evolves, and interacts dynamically with data and users. Periodic compliance, which was designed for stable environments, is simply not sufficient to govern something that changes in real time.
Periodic compliance reflects a mindset where governance is seen as an obligation, something to be fulfilled at certain points in time. But AI operates continuously, evolves dynamically, and influences decisions in ways that are not always visible. Governing it requires more than schedules and checklists.
The issue is not that existing frameworks are inadequate. In fact, many of today’s governance, risk, and compliance frameworks are already well-developed and robust. The real challenge lies in how organisations use them, and how they perceive them. Too often, frameworks are treated as documentation exercises, certification or licensing targets, or compliance checklists, rather than as tools to guide thinking, decision-making, and accountability. This creates a gap, not in the framework itself, but in its application.
AI introduces a different paradigm: it is dynamic, probabilistic, and highly dependent on data and context. If organisations continue to apply frameworks with a static and procedural mindset, then naturally gaps will persist. Governance becomes formal, but not effective. Compliance exists, but control is weak.
What needs to be enhanced is the way of thinking: from compliance to understanding, from documentation to ownership, and from control as a function to control as a shared responsibility.
In this context, adopting standards such as ISO/IEC 42001 (AI Management System) can be a strong enabler. Not merely as a certification, but as a structured approach to align AI initiatives with governance principles, establish accountability across the lifecycle of AI systems, and drive organisations to rethink how AI is managed, monitored, and controlled. When implemented properly, ISO 42001 helps organisations not only “be compliant”, but more importantly, become more disciplined, structured, and responsible in their approach to AI. Ultimately, frameworks are only as strong as the mindset behind them. Enhancing that mindset is what will close the governance gap.
Because AI does not remove responsibility, it redistributes it. This is not about being more compliant. It is about being more responsible and trustworthy. It requires a risk-aware culture, a culture where people do not only ask, “Are we compliant?”, but more importantly, “Do we understand the risks of what we are building and deploying?”
In many organisations, especially in fast-growing digital environments like Indonesia, the pressure to move quickly often overrides the discipline to think carefully. This is where leadership becomes critical. Leaders set the tone: whether risk is acknowledged or ignored, whether governance is lived or merely documented, and whether responsibility is owned or delegated. Continuous and adaptive governance emerges when leadership consistently demonstrates that speed must be balanced with responsibility, innovation must be aligned with accountability, and every technological decision carries consequences. Without this example from the top, governance will remain procedural. With it, governance becomes a culture.
When human judgment intersects with automated outputs, there is a risk of over-reliance. People may trust the system without fully understanding it. This is where governance must step in, not to slow down decisions, but to ensure that decisions remain accountable. Effective oversight ensures clarity on who is responsible, transparency on how decisions are made, and the ability to challenge outcomes when necessary.
AI adoption is often seen as a technology challenge. In reality, it is an institutional or business challenge, and this applies not only to AI, but to any form of technology investment. Every technology that is deployed, whether AI, digital platforms, or core systems, carries consequences. It affects decisions, processes, people, and ultimately trust. Therefore, every investment must be accountable and aligned with the organisation’s readiness.
Institutional readiness includes governance structures that define accountability, a risk culture that enables critical thinking and control, data maturity to ensure the reliability of outputs, and leadership alignment to guide direction and priorities.
In Indonesia, where organisations operate within diverse regulatory, cultural, and operational contexts, deploying technology without readiness can create more harm than value. It may increase efficiency in the short term, but it also amplifies risk, inefficiency, and even systemic failure in the long run. This is why governance must ensure that technology is not only adopted, but adopted responsibly. The question is not “Can we implement this technology?” The more fundamental question is: “Are we ready, organisationally, structurally, and culturally, to take responsibility for its impact?”
The difference is rarely technology; it is mindset, discipline, and culture. Organisations that succeed treat governance as a strategic enabler, not a constraint; integrate risk, compliance, and business from the beginning; build governance as a culture, not merely a function; and foster a risk-aware culture, where every decision involving technology is made with awareness, responsibility, and careful consideration of its impact. This last point is critical, especially in the Indonesian context.
One of the persistent challenges we see is that technology implementation is often driven by ambition, speed, or even trend adoption, without fully considering the risks involved. There is a tendency to focus on what technology can do, rather than what could go wrong and who will be accountable when it does.
Organisations that struggle typically approach AI and technology as quick wins, operate with fragmented governance, and lack a culture of prudence, where questioning, challenging, and anticipating risk are not yet embedded behaviours. Without a risk-aware culture, governance becomes procedural, risk management becomes reactive, and technology becomes a source of exposure rather than value.
AI readiness, and broader digital readiness, is not achieved through tools or frameworks alone. It is built through leadership that instils awareness, discipline, and a deep sense of responsibility toward risk.
Why is periodic compliance insufficient for AI?
Because AI learns, evolves, and interacts dynamically with data and users in real time, while periodic compliance was designed for stable environments and treats governance as an obligation fulfilled at certain points in time.
What is ISO/IEC 42001, and why does it matter here?
ISO/IEC 42001 is an AI Management System standard. The expert presents it not merely as a certification, but as a structured approach to aligning AI initiatives with governance principles and establishing accountability across the AI lifecycle.
Who is responsible when AI makes a decision?
A human. AI does not remove responsibility, it redistributes it, and accountability must remain human, with clarity on who is responsible and the ability to challenge outcomes.
What does institutional readiness include?
Governance structures that define accountability, a risk culture that enables critical thinking and control, data maturity to ensure the reliability of outputs, and leadership alignment to guide direction and priorities.
What separates organisations that succeed from those that struggle?
Mindset, discipline, and culture, not technology. Successful organisations treat governance as a strategic enabler, integrate risk, compliance, and business from the beginning, and build governance as a culture.
Continuous and adaptive AI governance is, in the end, a leadership question. Tools and frameworks alone do not make an organisation AI-ready. What makes the difference is leadership that instils awareness, discipline, and a deep sense of responsibility toward risk, so that governance is lived rather than documented, and technology is adopted responsibly, with accountability that remains human.
