5 Ways to Take the Practice Leap into AI Governance

I believe every AI governance career is defined by three leaps. The first, and the one that stops the most people, is the practice leap. That's the move from knowing to doing.

The data from our Practitioner Assessment is very clear about where people get stuck. In a current snapshot of close to 450 practitioner assessments, we consistently see Knowledge as the strongest dimension by a clear margin (6.9), while Application is one of the weakest (4.5). On Application, close to half of everyone assessed still sits at the lowest level of capability. They've read the frameworks, some have achieved certifications like the AIGP or ISACA AAIA/AAIR, but they haven't had the opportunity to build much yet. They're on one side of the first chasm and can feel the gap, even if they're not sure what to do about it.

There are NGOs, community associations, professional bodies and interest groups everywhere right now who know AI matters to their work and have no idea where to start. They need help. Often they can't pay for it, but that isn't the point at this stage, because what they can offer is a real problem, real users, and the freedom to build something that matters.

Dr. Dzaharudin Mansor is a great example of a practitioner who did this. He's a veteran technology leader, a former Microsoft National Technology Officer and AWS security assurance lead with a PhD and decades of work across the region, and he came through our program to bring that depth and turn it into hands-on AI governance. Rather than treat it as theory, he took the streamlined governance approach we teach and applied it where it was needed most: inside micro and small organisations that are AI users rather than developers, and that have no capacity for heavy compliance machinery. As a Board Advisor to PIKOM, The National Tech Association of Malaysia, he became a key contributor to the Minimum Viable AI Governance (MV-AIG) report, launched at the PIKOM CIO Conference 2026. The report reframes AI governance from a compliance burden into a lightweight, implementable discipline, built on clear accountability, simple policies, risk tiering, an AI inventory and a practical three-question decision gate.

The result was published governance output on a national stage, grounded in real implementation. Dzahar is also a wonderful demonstration that deep expertise from an adjacent career translates directly into this field, if you channel it into work that a community actually needs.

That's the model. Pick something you care about at any scale from a national body to your local community club, offer what you know, and let doing the work teach you the rest.

Startups are the best-kept secret for newcomers to AI governance.

You can participate or volunteer in an incubator, join a local AI meetup, get alongside the founders in your area. They're building fast, they know governance and audit matter, and most have no clue where to begin. That gap is your opening. You bring the structure of what responsible looks like here, which controls matter, how to manage risk without smothering the build. And in return they teach you the technology from the inside, and you learn how AI systems are really built, deployed and broken far faster than any amount of reading would manage.

Sarah Clarke is a great example. A very accomplished AI Governance practitioner based in the UK, she spent fifteen years in IT, cybersecurity and data protection before AI governance was its own discipline, and startup work was part of how she moved into it. In one early engagement she helped an AI startup's CEO stand up a data protection and risk baseline built to grow as the business aimed to sell into regulated industries. That hands-on work with founders, translating governance into something a young company can use under real constraints, became her bridge from a GRC background into dedicated AI governance and assurance. If you read the kinds of work Sarah publishes, like this article on AI Use Case triage, you'll see years of practical experience with organisations that need to innovate fast. But it starts with getting engaged with that community, understanding their needs and adding value. 

This is the one most people already have access to and yet rarely use as much as they could.

In almost every organisation right now, someone is quietly asking: who's writing our AI policy? What AI systems do we even have? What should our guidance be? Usually nobody owns it. The problem is sitting there, unclaimed.

So put your hand up. Say you'll take it on.

When you do, do it properly. Get executive sponsorship so the work is legitimate and visible. Be open that you're building the expertise as you go, which is expected and fine. Use the resources sitting right there. Most of the experienced practitioners I know - including me - started right here, by extending their current role into a new space and championing something the organisation needed anyway.

Katalina Hernandez is an inspiring example. Her background was in law, privacy and compliance, not AI. Rather than wait for an AI governance role to be created, she stood up the Responsible AI function from inside Vodafone Intelligent Solutions, extending her existing remit into new territory. She built it out across multiple jurisdictions, took a seat on the Group AI Board, and ran EU AI Act implementation from the inside, translating regulatory requirements into vendor contracts, risk processes and operational safeguards. From there she kept going deeper, and deeper again, until she had carved out a specialism few others hold: the intersection of the safety science of frontier AI with the law. She now leads the legal function at an independent AI evaluation company, Equistamp, and teaches technical AI safety to other lawyers. Her work includes contributing to the first European Seminar for Frontier AI and Law, a five-day residential program near London run with the non-profit ML4Good. The whole trajectory started by extending the role she already had.

The bonus when you do this is that you're not only gaining governance experience. You're learning to build a business case, to influence, to bring people with you. Those skills are half of what makes an exceptional governance practitioner, and you can't get them from a textbook.

At some point you go for the job, or the consulting gig, and you back yourself to do it.

Accept that the first role probably won't be perfect. It might be the work nobody else wants. You might have to convince people you can handle it before anyone's willing to bet on you. But you do it anyway. Build the knowledge and the practical experience together, and let one reinforce the other.

John Macleod is the person I think of here, one of the earliest participants in our program. He spent years in digital marketing and as a startup founder before pivoting into governance and standards consultancy, and he got started by taking on a project that was, by his own account, something of a mess. The previous consultant had left at the last minute, the client was combining their management systems into a single integrated one, audits were bearing down, and the documentation was in disarray. He describes openly how it was extremely difficult, with long hours and real moments of doubt about whether he could help at all.

But he swam. He got the integrated management system through to certification, his first, covering ISO 14001 and ISO 45001, and came out with exactly the experience he needed. As he puts it, an ideal client won't fall in your lap when you're new to an industry. You earn your stripes, and early on that means staying open and taking whatever comes your way.

That's how credibility and confidence compounds. Deliver on the work in front of you, however hard, and better work follows. John now runs his own AI governance consultancy, helping tech SMEs build management systems towards ISO 42001. He's made the pivot into AI Governance and it's his core professional work now.

And if none of these quite fit, or you have a clear sense of what governance practice should look like and can't find it anywhere, then build it yourself.

This is where the spark matters most. I've written elsewhere about finding your spark, the aspect of this field that you care about enough to stick with when it gets messy and hard. Not "I'm interested in responsible AI", not "I want this or that certification on my resume", but "I see this problem and I can't stop thinking about it." The fifth path is what happens when you take that spark seriously enough to go all in and build around it.

Find the niche that's uniquely yours and go deep. Research it. Write on it. Build systems and tools around it. Create the space that's missing. That might become a consultancy, a startup, a product, a new role or simply a body of work that becomes your unique niche. It's possibly the hardest path and maybe the freest, but it starts the same way as the others: by backing yourself and starting before you feel ready.

Gorkem Cetin and Ulaş Özgüven are a good example of the startup version. Rather than wait for the right tools to exist, they built them. Their company, VerifyWise, is an open-source AI governance platform that pulls frameworks like the EU AI Act, ISO 42001 and the NIST AI RMF into one place, so teams can map risks, manage model inventories, automate evidence and catch shadow AI without duplicating effort. Gorkem brought two decades in open-source and enterprise software; Ulaş brought a background in venture and go-to-market. Between them they saw a gap in the field and filled it, turning their own conviction into software and infrastructure that other practitioners now rely on.

This is the path I took myself. After a long career in Microsoft and Amazon, AI Career Pro grew out of a spark I couldn't put down, my conviction that AI governance fails not on technology or regulation but on translation between the disciplines it depends upon: science, engineering, law and assurance. And on the capability of practitioners within those disciplines to design and apply adaptive governance practices that are fit for the task of keeping complex AI systems safe, secure and lawful. I felt too many capable people are being handed abstract theory when what they need is guidance, support and tools to do the work well. So we're building that with programs designed to help practitioners make every one of these leaps - to learn, to apply, to influence and to lead - learning to master their craft across multiple disciplines. We teach what we build and build what we teach. And that's what makes building your own thing so rewarding: not a job you found, but something you created. And a contribution to a profession that is still being written. I believe there's never been a better moment to do that.

Look across all five and the pattern is pretty clear. Not one of these people waited for permission or for the perfect role to exist first. Not a single one expected a certification or accumulation of knowledge to be enough. They're learning by doing. And building meaningful, rewarding careers and businesses in the process.

Dr. Dzaharudin Mansor, Sarah Clarke, Katalina Hernandez, John Macleod, Ulaş Özgüven, and Gorkem Cetin are just a few of the practitioners I draw real inspiration from. They and more than a thousand practitioners who learn, and practice within our programs are who we keep building AI Career Pro for: professionals who back themselves and do the work, whatever leap they happen to be standing in front of.

The learning gets you ready. The practice leap is yours to make. And by the way, it's only the first of three. If you're already a practitioner, the urge to take the adaptive leap or the leadership leap may just be what you're feeling. 

Figure out where you are. Find the real problem in front of you - the one you can't let go off. Hold on to your spark.

And jump.