AI governance: why Colas and Arkéa didn’t wait for the AI Act

A conversation between Thomas Rollin (Head of AI and Data Science, Colas Group), Frédéric Brenner (Group Data Office, Crédit Mutuel Arkéa), Gwendal Bihan (Co-founder and President, Axionable) and Nicolas Averseng (Chief Product Officer, DataGalaxy), moderated by Laurent Dresse (DataGalaxy).

Many companies are still building their AI governance step by step. Colas and Crédit Mutuel Arkéa chose to get ahead of regulation instead. Today, they ship faster and keep risk under control.

When we asked the session attendees, most companies were either structuring their approach or still thinking it through. Not one said they’d industrialized it. Here’s what four experts shared to help you get moving now, without waiting.

Why AI governance is now a must for leadership

For a long time, AI was an innovation topic. You explored, you tested, you saw what the technology could do. Ethics, financial impact, and compliance came second.

Those days are over. According to Nicolas Averseng, leadership teams now expect AI that’s operational, industrialized, and built into the core of production. 

Gwendal Bihan sees the same shift with his clients. AI governance used to be driven by a few volunteers. It’s now a requirement, pushed by executive committees and boards that want a grip on both ROI and risk.

The challenge is finding the right balance between anticipating regulation and actually getting things done. Should you wait for the rules? How far should you go? Many organizations are still working out the right level of governance, while use cases keep piling up.

Colas and Crédit Mutuel Arkéa: what got their AI governance started

At Colas, it all started in the field. The group kicked off its data journey in 2018 and quickly built AI models, well before generative AI arrived. One of them was a computer vision model that spots surface defects on roads.

The data science team was young back then. It soon realized an AI project doesn’t run like a typical digital project. So it set up its development method from day one, just as the AI Act was starting to be discussed. Thomas Rollin puts it simply: better to start on the right foot than to play catch-up later.

At Crédit Mutuel Arkéa, the group has run traditional AI models for years. It wanted to make those practices solid and governable through a trustworthy AI approach, supported by Axionable all the way to a trustworthy AI certification from the LNE (France’s national metrology and testing lab).

The real turning point came in early 2025 with the Faire 2030 strategic plan. The executive committee and the board formally named AI as an accelerator of the group’s transformation. The Group Data Office used that mandate to build its strategy around two pillars: the what (the use cases to deliver) and the how, which breaks down into four dimensions:

• trustworthy AI, for responsible and controlled delivery;
• the tech foundation AI systems need;
• the operating model, organization and governance;
• the people side: change management and skills.

Shadow AI: why banning it isn’t enough

The fast spread of consumer generative AI tools raises new security issues, especially around data confidentiality and how usage is supervised.

Colas and Arkéa landed on the same answer: offer a secure alternative before you restrict anything. Colas rolls out internal GPTs and instances under contracts that protect its data, with an offer that’s updated every three months. Arkéa deployed a secure generative AI solution for all its employees, while restricting access to consumer tools from its network.

The technical fix comes with a catch, though. Frédéric Brenner, Group Data Office, Crédit Mutuel Arkéa, admits it: the internal tool has to keep up with market standards. Employees use ChatGPT or Gemini in their personal lives. So the job is to offer professional tools that meet their expectations, which is what drives adoption in a secure environment.

Colas adds a useful distinction to its governance:

• Individual productivity AI. An employee uses AI to work better. The answer is a set of secure tools.
• Process transformation AI. The company wants to improve a business process. The answer starts with the why and the expected value, then the right technology.

This split stops you from applying the same level of control to an office task and to a project that reshapes a whole job.

AI Champions: governing AI in a decentralized organization

In a decentralized organization, AI governance works better with local relays. Arkéa has around 40 subsidiaries. Colas is a highly decentralized group. In both cases, reaching everyone and explaining the rules of the game is a real challenge.

Arkéa’s answer is a network of AI Champions in every subsidiary. They play two roles. They spot local use cases and needs. And they spread the principles of control and accountability around AI.

The group splits this into two profiles, which the same person can hold:

• AI leads, focused on the roadmap and use cases;
• trustworthy AI leads, focused on security, risk management and compliance.

The network also keeps track of experiments. At Arkéa, nobody says POC anymore. They say experiment, and every experiment goes through the same risk controls as any other project. Champions report them to the Data Office, which can then reuse them and roll them out to other entities.

Gwendal Bihan points to what’s at stake behind this model. Classic AI projects took six months or more. Today, a use case can go live in a few days. Governance has to keep pace with AI projects. The goal is a simple, accessible front door that makes it easy to declare and track initiatives.

Data governance vs. AI governance: what actually changes

AI governance is built on data governance. On this point, all the speakers agree. An AI model always consumes data, in training, in inference or in its context. So confidentiality and sensitive data remain shared concerns.

But four differences change the game:

Nicolas Averseng stresses that last point. The AI Act starts with the use case: is it worth it, and how do you match the safeguards to the purpose? Data governance rarely came at the problem from that end.

Gwendal Bihan adds a human difference. Agentic AI hits business teams harder and faster. It can deeply reshape how teams are organized, who does what and which skills they need. You have to plan for these changes from the very start of the deployment cycle.

Which KPIs should you track to steer AI governance?

Measuring how well your AI governance works is hard, and it’s something you build over time. The discussion surfaced three levels of indicators.

The first level is usage. Colas measures adoption of its secure tools: it’s the sign that people are going to the right place. For transformed processes, the KPI has to come from the business itself. You don’t measure an app development process the way you measure an accounting process.

The second level is strategic steering and risk control. At group level, Arkéa tracks how its AI roadmap is being delivered and how priority use cases are rolling out. Every project also has to go through the risk controls: cybersecurity, model risk, bias, hallucinations, performance, GDPR. The delay of AI Act obligations for high-risk systems hasn’t changed that requirement.

The third level is value. This is where Nicolas Averseng warns against vanity metrics. Training 80% of your employees is a good first step. But value also shows up in the results it delivers.

The first gain from AI is efficiency. It’s also the hardest to measure and to actually capture. Nicolas Averseng gives the example of a business leader announcing a 20% efficiency gain. Finance’s next question comes right away: can we cut the matching budget next year?

The pressure will only grow. AI tool costs are rising fast, to the point of nearing the cost of a full-time employee for some developers. You’ll need to weigh those costs against real gains. And that conversation can only happen with the business: what does success look like tomorrow, and how will you measure it?

AI governance frameworks

Frameworks already exist. Gwendal Bihan mentions the LNE trustworthy AI certification, the Labelia label and the ISO/IEC 42001 standard. They do a good job on compliance. What they rarely tell you is how to make it work in practice.

These frameworks usually cover six or seven dimensions, such as human in the loop, bias, social and environmental impact, and data control. Some overlap with data governance. Others are specific to AI, like bias or human oversight.

Human oversight is taking up more and more room. With agents, there are a thousand shades of human in the loop. The trend is to work with guardrails: you define what the agent must not do, and give it autonomy inside that frame.

A new KPI is gaining ground: governance efficiency. How much time do you spend documenting and checking a use case, compared with the time spent building it? If the ratio is off, governance slows AI down instead of guiding it.

Hence the idea of governance that flexes with the stakes. A low-risk use case goes through a lighter path, a fast track. A complex or sensitive one triggers tighter control. Nicolas Averseng puts it plainly: make the constraints too heavy, and people will work around them.

How to kick off your AI governance tomorrow

To close the conversation, each speaker shared one piece of advice for getting started. Their answers add up to a simple checklist.

1. Give everyone secure AI. It’s your first answer to shadow AI, and the prerequisite for keeping use cases under control. You need a secure playground for everyone, not a tool reserved for IT.
2. Build a network of relays. AI Champions in each entity, able to champion what AI can do and the rules for managing its risks. This network becomes essential once business teams start deploying their own agents.
3. Match governance to risk. Simple paths for simple uses, a clear escalation for complex ones. Don’t lock everything down centrally, and don’t open everything up locally either.
4. Work on trust. People need to understand what data an AI runs on, with transparency and a way to give feedback. Governance is about bringing people along. A questionnaire alone won’t do it.
5. Train, train, train. That’s Gwendal Bihan’s advice. Train every employee, then business teams on their own use cases, then executive leadership on the transformation. Training is still underinvested across the board.

Thomas Rollin sums up the mindset: you have to take it on, because it won’t sort itself out. The challenge is to set energy free, safely.

Watch the full conversation in the webinar replay here, and see how DataGalaxy helps you govern your data and your AI use cases on a single platform.

FAQ

Should you wait for the AI Act before setting up AI governance?

No. Colas and Crédit Mutuel Arkéa built their governance before any regulatory pressure. Colas set its development method from its very first computer vision models, to start on the right foot rather than catch up later. Arkéa went through an LNE-certified trustworthy AI program, then wrote AI into its Faire 2030 strategic plan. Waiting for regulation exposes you to two risks: uncontrolled uses that keep multiplying, and a costlier catch-up once the obligations kick in.

What’s the difference between data governance and AI governance?

AI governance builds on data governance, because every model consumes data. But it adds four challenges. Models are non-deterministic, so their quality is harder to measure. They open new attack vectors. AI is everywhere, including inside vendor tools. And AI governance starts from the purpose: does the use case justify the risk? Data governance tends to start from protecting the data itself.

How do you tackle shadow AI in your company?

Offer a secure alternative before you ban anything. Arkéa rolled out generative AI for all its employees and blocked consumer AI tools on its network. Colas provides internal GPTs and instances under secure contracts.

About the author: Laura Corbet

Tech Team