Graeme Scott sits down with Enza Iannopollo, VP and Principal Analyst at Forrester, whose work runs from privacy and GDPR through trust into AI governance and responsible AI. If you want the argument for why governance is the thing that lets you move faster rather than the thing that slows you down, this is the episode.Enza came to this through privacy, during the period when GDPR was being written, and became interested in the idea that privacy in Europe is a fundamental right with specific claims attached to it. In 2021 she turned to trust, and Forrester's research started from an unusual place, with what makes one human being trust another, before working outward to why the drivers of trust in a bank differ from those in a social platform or the shop where you buy your milk. By 2023 she was looking at personal data inside generative AI, and from there into AI governance.Her account of how organisations got here is unsparing and familiar. With generative AI, governance was an afterthought, because the fear was that thinking about it early would slow the innovation cycle. She calls that a misled assumption, and the evidence is in how many pilots then could not scale, forcing teams back to step one to work out the risks and sometimes to redefine the use case entirely. All of it the cost of not doing it at the start.What changed the mood was agents. A text based assistant felt like a risk you could manage later. An agent that consumes and processes data, makes decisions, calls tools and alters third party systems in real time does not, particularly in a regulated sector. At minimum, she argues, you need to see what is happening and recognise when something is going somewhere you did not expect.The sharpest moment comes from a chief information security officer she spoke to the day before recording. Every piece of software brought into his organisation has to come with evidence of how it works and what the risks are. Now something arrives that behaves unlike any software anyone has seen, and the industry is asking for less scrutiny rather than more. Why should they be different? We need more evidence from them, not less.She is equally direct on where responsibility sits. Much of the debate is about what happens inside the labs, and she thinks they carry a great deal of it. But the choice of how to deploy the technology, what it touches and what you do to protect your systems, your data and your people, is a business decision, and the ethics of that belong to the business making it.