AI security governance: AI security goes to the boardroom

The signal coming from Google Cloud

Francis de Souza, Chief Operating Officer of Google Cloud, has made clear statements: artificial intelligence security must be a boardroom priority, not a technical issue delegated to the server room. This is reported by The Decoder in an article published at the end of May 2026. The message is direct and difficult to ignore.

However, for many organizations — especially Italian SMEs — this represents a significant paradigm shift. Until now, cybersecurity was perceived as an exclusively technical domain. Therefore, moving it to the C-suite level requires a cultural recalibration before it is even technological.

Furthermore, the context in which this statement arrives is anything but neutral. Google Cloud competes directly with AWS and Azure for the governance of enterprise AI infrastructure. Therefore, de Souza also speaks from a position of commercial interest. Despite this, the content of the message remains valid and urgent.

What has changed in the AI security landscape in 2026

In 2025, there was an acceleration in the adoption of AI tools in production. Many companies integrated language models, predictive automations, and recommendation systems into their operational workflows. As a result, the attack surface has expanded significantly.

Indeed, the risks associated with AI are not just traditional cybersecurity risks. They include prompt injection, data poisoning, hallucinations with decision-making impact, and systemic biases. These phenomena cannot be managed with an antivirus. They require policies, human supervision, and clear organizational responsibility.

In particular, the’European AI Act it has introduced specific obligations for high-risk AI systems. The responsibilities fall directly on company leadership, not technology providers. Therefore, AI governance is no longer a choice: it is a regulatory requirement with concrete legal implications.

Direct impact on Italian SMEs adopting AI

Italian SMEs find themselves in a delicate position. Many have launched AI projects—chatbots, process automation, predictive analytics—without establishing parallel governance. Therefore, the risk is not just technical; it's strategic and reputational.

For example, a retail company using an AI system for inventory management or customer recommendations needs to know who is responsible if the model produces incorrect outputs. Similarly, a B2B SME automating lead qualification through AI must define who oversees algorithmic decisions.

We of SHM Studio We observe that this gap is transversal across sectors. It doesn't just affect large companies. In fact, SMEs are often more exposed because they lack dedicated structures for technological compliance. Therefore, the issue raised by de Souza is exactly the kind of conversation that should be happening in Italian boardrooms today.

According to McKinsey Global Institute, organizations that integrate AI governance at the executive level report higher adoption rates and significantly fewer incidents. Furthermore, they demonstrate a greater ability to scale pilot projects into stable productive deployments.

Three areas for immediate intervention for business leaders

Translating de Souza's message into concrete actions requires identifying priorities. Below are three areas that decision-makers should focus on immediately.

• AI governance ownership: Every AI project in production must have a designated senior management sponsor. The IT representative is not enough. Someone with decision-making authority and visibility into business impact is needed.
• Risk mapping by specific model: Not all AI systems present the same risks. A generative model has different vulnerabilities than a classification system. Therefore, risk assessment must be granular and up-to-date.
• Non-Technical Management Training Business leaders do not need to become AI engineers. However, they must understand the risk mechanisms to make informed decisions. Investing in AI literacy sessions for the C-suite is a strategic priority today.

These actions integrate naturally with the paths of AI consulting what we propose to SMEs, where technological adoption is always accompanied by a governance framework appropriate to the organizational context.

The Role of Digital Strategy in AI Security

A common mistake is treating AI security as a separate topic from the overall digital strategy. Instead, the two domains are deeply interconnected. In fact, architectural choices, selected vendors, and the data used to train models directly determine the organization's risk profile.

For this reason, AI governance should be an integral part of any plan digital marketing and digital transformation. For example, a company that uses AI for advertising campaign management — through Google Ads o LinkedIn Ads — must also consider the risks related to automated profiling and algorithmic transparency.

Similarly, those who integrate AI into their process of content creation oh yes SEO must define clear policies on data use and editorial supervision. Finally, even the web presence — from the structure of the Company website all integrations with AI systems fall within the scope of governance that needs to be overseen.

What vendors don't openly say

There is an aspect that deserves critical examination. The major cloud platforms—Google, Microsoft, Amazon—have a direct interest in promoting AI governance. The more companies formalize processes, the greater the demand for enterprise tools for managing, monitoring, and auditing AI models. These tools are precisely what the vendors sell.

However, this does not invalidate the message. In fact, the fact that the main market players are pushing for AI governance is an indicator of the sector's maturity. It means the issue is real, urgent, and destined to become an operational standard. Therefore, SMEs that act proactively today will have a competitive advantage over those who wait for regulatory pressure.

In summary, AI governance is not a cost to be borne: it's an investment in organizational resilience. Companies that integrate it now will be better positioned when regulatory requirements become more stringent—and they will, as confirmed by the evolution of’European approach to artificial intelligence.

Outlook: Whither AI Governance in 2027

Looking ahead to the next 12-18 months, increasing formalization of AI governance requirements is a reasonable expectation. Among other things, the first sanctions related to the European AI Act will begin to materialize, creating precedents that will influence business practices even outside of directly sanctioned cases.

Furthermore, AI governance frameworks will progressively become a standard in tenders and due diligence. SMEs that want to work with large clients or access international markets will need to demonstrate that they have documented processes. Therefore, structuring yourself today also means opening up business opportunities tomorrow.

To further explore how to structure a digital strategy that includes AI governance, it is possible Contact the SHM Studio team to explore the in-depth articles on our blog. Every AI adoption project we follow starts with a clear definition of responsibilities, risks, and business objectives — even before selecting the model or platform.