The finest governance policy in the world is still just paper if it doesn't survive a busy Tuesday. Hemant's starting point is that the gap between governance on paper and governance in practice has barely changed in decades - it has only changed disguise, and now wears the language of AI and data transactions.
He gives a simple example. A policy says there must be human oversight. In reality, the person responsible is clicking "approve" on hundreds of system-recommended choices, one after another. That is automation fatigue, and no amount of well-drafted policy fixes it. For a policy to mean anything, it has to percolate into the organisation's DNA - into the culture and the practice at every step, and harden into an actual control: you can do this, you cannot do that.
"On paper, governance is a policy paper. In real life, it's a habit that has to survive busy times." - Hemant Patil
His test for whether an organisation is ready is deliberately blunt. Pick one system and answer three questions without reaching for the policy binder: Who owns it? Have you checked it? What happens when it goes wrong? If the answers come easily, you're in good shape. If they don't, the problem usually isn't knowledge. It's ownership.
Price is the number everyone sees. Risk is the part they don't.
Drawing on years of cross-border deals, Hemant points out that price is the easy part of any contract - both sides can see it, and it gets settled in about a week. What nobody sees, and what actually matters when things break, is how risk is allocated.
The questions that count aren't about cost. Who pays when data is leaked? Who can audit whom? Who is allowed to use my data, and for what? If we part ways, how do we unwind it? And AI adds a sharp new one: what happens when the vendor changes the model? A contract written against the old model may quietly stop making sense - new training data, possible IP or bias issues, and a liability cap that was agreed for something that no longer exists.
"Price is just a number both parties can see. What nobody sees is the risk allocation, and that's what matters when things break." - Hemant Patil
Seen that way, the contract is where governance is really decided. The price gets the attention; the risk allocation decides what happens on the worst day.
Do the work once, not twice.
Most organisations already carry a strong head start into the AI Act: the DPIA they built for the GDPR. Hemant's argument is that you don't start the AI Act's fundamental-rights assessment from zero - but you can't simply copy the old one across either, because the two look at the world differently.
He frames it in layers. Some of the DPIA - the description of the process, the purpose, the data risks - carries over almost as-is. Some of it carries only partly, because a DPIA looks at the data subject, while the AI Act looks wider: a housing-allocation system might hold no data on a person's child, yet a decision can still land on that child. And some of it has to be done fresh, because how oversight and redress actually work is genuinely different under each regime. The goal isn't two parallel exercises run by two teams. It's one team, one process, one owner - doing the effort once and reusing it well.
"A DPIA is a strong head start, but it's not a finished rights assessment. You reuse what you can, and you look at the same data from a very different angle." - Hemant Patil
The deeper shift underneath all of it: every obligation now has multiple owners. The engineer, the CFO and the customer each look at the same AI system and see a different thing, and all three are right. Governance that still assumes one person in IT owns the system is already behind.
