AI Governance Is Not a Policy. It’s the New Operating Model: A Practical Guide

A Q&A with Suky, Former HSBC and Deloitte FinOps Leader, on What It Takes to Scale AI Responsibly

We recently sat down with Suky — a global FinOps and cloud governance leader with more than 33 years of experience across HSBC, Deloitte, and other large enterprises — to discuss what AI governance really requires inside complex organizations.

Suky’s led global FinOps optimization across a large multi-cloud estate, delivering more than $315M in cloud savings and helping establish governance frameworks across major cloud environments. His work now extends into the next frontier of FinOps: AI workloads, GPU infrastructure, model usage, data movement, automation, and proving whether AI is creating real business value.

His perspective is practical, direct, and grounded in what it takes to govern cloud and AI inside regulated enterprises.

Here’s what he shared.

Q: You said AI governance is the hook, but there is a much broader docket behind it. What did you mean?

Suky Singh: AI governance gets people’s attention because every enterprise is trying to scale AI responsibly.

But underneath that, the conversation is much broader. It is not just about model risk or policy. It is about how the organization operates.

Can you see where AI is being used? Do you know who owns it? Can you forecast the impact? Can you tell whether the work is creating real value? Can you act when something goes wrong?

That is why AI governance is such an important theme. It forces companies to connect strategy, technology, finance, risk, and operations in a way most organizations have not had to do before.

AI governance is not a separate program. It becomes the operating model for how AI gets funded, built, monitored, optimized, and trusted.

Q: You’ve seen enterprise cloud governance across some of the largest financial institutions in the world. What feels different now with AI?

Suky Singh: Cloud was already difficult to govern at scale.

In a large enterprise, you have workloads across multiple hyperscalers, business units, approval processes, and ownership models. Even before AI, getting a full picture was hard.

AI adds another layer of complexity.

Now you have model usage, token costs, GPU infrastructure, caching, routing, data movement, repeated calls, and teams experimenting at the same time.

The challenge is not only, “What are we spending?”

The challenge is, “Do we understand how AI is being used, who is accountable for it, whether it is creating value, and whether we can govern it responsibly as it scales?”

Q: What happens when governance does not move fast enough?

Suky Singh: Governance gaps become business problems quickly.

In one environment I know of, a workload slipped into roughly $700,000 of unbudgeted spend over a weekend. It sat for four days before it was acted upon.

That is not just a reporting issue.

In enterprise environments, delayed action has real consequences. Budgets get questioned. Controls get tightened. Trust breaks down. People are held accountable.

That experience reinforced a simple lesson: it is not enough to explain the bill after the fact.

You need to catch issues earlier, understand who owns them, and have a process for acting before the problem compounds.

That is even more important with AI because the cost signals move quickly. A small experiment can turn into expensive infrastructure, repeated model calls, idle endpoints, or downstream data movement that nobody forecasted.

Q: What does AI governance mean specifically?

Suky Singh:AI governance has to include the technical, financial, and operational picture.

It is not enough to know that a team is using AI. You need to understand how they are using it.

Are they using the most expensive model when a cheaper one would work? Are they routing requests intelligently? Are they using caching properly? Are token costs understood? Are model calls being repeated? Is usage tied to a business unit? Is anyone measuring the value coming out of it?

That last point is important.

A lot of organizations are saying, “We are all doing AI. Great. Fantastic.”

But the next question is, “Is there any actual value coming out of it?”

AI governance should help answer that.

Q: What gets missed when leaders only look at the AI bill?

Suky Singh:The AI bill is only part of the story.

Many costs sit underneath the AI application layer: idle endpoints running through the weekend, development environments created for proofs of concept and never shut down, GPU infrastructure provisioned for peak demand that never came, or duplicate deployments across teams.

Then there is data movement.

Large datasets move into training pipelines. Inference outputs move back to consuming applications. Data gets replicated across regions for resilience or compliance. Data moves between clouds, regions, AI services, and the applications consuming them.

Those charges rarely appear neatly as “AI cost.”

They show up in networking, storage, compute, or other categories. By the time someone finds them, the spend has already happened.

That is why AI governance cannot stop at model usage. You have to understand the ecosystem around it.

Q: Where do traditional cloud cost and governance tools start to fall short?

Suky Singh:A lot of traditional tooling can show spend, but it does not always show the full picture.

In one enterprise environment, we were disappointed with the incumbent cloud cost management platform. It showed pieces of the bill, but it could not support the complexity of the environment. We had workloads across all four major hyperscalers, but still could not clearly understand how teams were tracking against budgets and forecasts.

Alibaba Cloud was one of the gaps. It was part of the environment, but the platform did not account for it the way we needed.

So we had to build around it.

We added other tools, custom PowerBI reporting, and extra workflows just to make the data usable for the business.

That can work for a while, but eventually the patchwork becomes part of the problem. When the core platform does not cover the full estate, teams compensate with BI layers, side tools, ticketing workflows, spreadsheets, and manual checks.

The optimization side was also limited. In another environment where Google spend was significant, the platform surfaced only a couple of useful recommendations. At enterprise scale, that is not enough.

That is where many organizations get stuck. They have reporting, but not governance.

Reporting helps people understand what happened. Governance answers the harder questions: Who owns this spend? Was it forecasted? Is it tied to a business unit? Is the recommendation actionable? Did anyone remediate it? Did the savings and value actually show up?

A dashboard can tell you what happened. Governance gives you enough context to decide what should happen next.

Q: Enterprises want automation, not just reporting. Why is that so hard in regulated environments?

Suky Singh:FinOps automation can be strong in principle. The hard part is the enterprise environment around it.

We looked at automation-first approaches that could identify an issue, raise a ticket, route it to engineering in Jira, and push teams toward remediation. On paper, that made sense. In practice, the issue was not identifying the problem. It was getting teams to physically take action.

That is when you start looking at end-to-end automation. But inside a large, regulated organization, automation runs straight into the operating model.

You have service ownership models, change management processes, internal permissions, audit requirements, regulatory constraints, service management dependencies, integration limits, and teams protecting their own systems and workflows.

In one case, to automate properly across the organization, you would have needed thousands of service owners to grant permission. That is not sustainable.

So even when an automation platform looks strong in a demo, deployment can break down if the enterprise is not standardized enough to support it.

You need flexibility, guardrails, permissioning, auditability, and tiers of automation so different actions can be handled differently. Some actions may only create a ticket. Some may require approval. Some may be automated within defined guardrails.

That is why automation in the enterprise is not just a technical challenge.

It is a governance challenge.

Q: What does good automation look like in that environment?

Suky Singh: It has to work with the governance model, not around it.

In a regulated enterprise, you cannot have automation making uncontrolled changes inside critical systems. You need ownership, permissioning, auditability, exception handling, and human oversight where it matters.

The better model is governed action.

For some issues, automation may only notify the owner or create a ticket. For others, it may recommend a change and require approval. In lower-risk cases, it may take action automatically within defined guardrails.

You want automation to reduce delays and prevent waste from compounding. But you also need the business to trust it.

Without trust, automation will not scale.

Q: How should leaders think about business value in AI governance?

Suky Singh:Cost matters, but cost alone is not the point.

The real question is whether AI is creating value.

Can leaders see the spend, models, usage, business unit, and value being generated? Can they compare one use case to another? Can they understand whether a more expensive model is producing a better outcome or just a higher bill?

That is where AI governance becomes strategic.

It is not about stopping teams from using AI. It is about helping the enterprise scale AI with confidence.

You want teams to experiment, but you also need to know what is working, what is wasteful, what is risky, and what should be funded further.

Q: What separates mature organizations from everyone else?

Suky Singh: Mature organizations do not treat governance as a blocker.

They make it part of how work gets done.

They understand where AI is being used. They connect usage to ownership. They know how spend maps to business units. They can see whether forecasts are accurate. They can identify waste before it compounds. They can act without creating unnecessary risk.

They also make governance practical.

It cannot only be sticks. There have to be carrots. Make it easier for teams to do the right thing. Give them better visibility, better processes, better guardrails, and better ways to show the value of what they are building.

One example of a big success for us was a cloud hackathon where teams competed to clean up zombie resources, act on recommendations, and turn governance into real savings through a VR game at a happy hour where they could win prizes.

That is how governance becomes useful instead of bureaucratic.

Q: If you were advising an enterprise just starting to formalize AI governance, where would you begin?

Suky Singh: Start by understanding what is already happening.

Most organizations have more AI activity than they realize. Some of it is approved. Some of it is experimental. Some of it is buried in cloud, data, or application spend.

Before you can govern it, you need to see it.

Then you need to connect that usage to ownership, budget, risk, and value.

Who owns the workload? Who is accountable for the spend? What business outcome does it support? What happens if usage spikes? What controls are in place?

Once you understand that, you can start putting the right governance model around it.

Not everything needs heavy control. But everything needs clarity.

Final Takeaway

Our conversation with Suky reinforced a clear shift:

AI governance is not a policy exercise.

It is an operating model.

The organizations that get it right will not treat AI governance as a standalone risk function or a narrow cost program. They will connect AI usage, cloud infrastructure, data movement, ownership, automation, financial discipline, ethics, and business value into one practical governance motion.

About Suky Singh

Suky Singh is a global FinOps and AI cost governance leader with 33+ years of experience across finance, cloud, and enterprise transformation, including leadership roles at HSBC, Deloitte, and BP. He has led global multi-cloud optimization initiatives that delivered $315M+ in savings while building governance frameworks for cloud, AI workloads, GPU infrastructure, and financial control.