Council Post: The Governance Gap In Smart Manufacturing: What GRC Leaders Need To Address

Posted on October 26, 2026 in business-finance

Ramachander Rao Thallada is a Governance, Risk, and Compliance (GRC) Executive for Manulife, a modern North American financial institution.

In smart manufacturing, AI is informing production decisions, sensor technology is creating constant visibility and automation is having an increasing influence on maintenance and quality. But in my experience in governance, risk and compliance (GRC), I’ve seen a persistent trend. Organizations are getting smarter with technology faster than they’re getting smarter about governing it.

The problem isn’t necessarily a lack of controls. Many organizations already have policies for cybersecurity, access control, privacy and compliance. The issue is that most of these controls were developed for environments with defined boundaries.

When One Technology Decision Becomes Everyone’s Risk

Consider an AI-assisted system that evaluates the information gathered from interconnected manufacturing equipment and decides on maintenance needs. Such a decision can affect production scheduling, inventory needs, employee activities and customers’ obligations.

Who bears responsibility for such decision-making? Is it the engineering department owning the equipment, the IT team managing the infrastructure, the cybersecurity department securing the environment or the business owner depending on the decision?

That’s where I believe the traditional models of governance become harder to implement. Although organizations might have owners for individual systems, the ownership of decisions derived from them is more difficult to determine.

Human Oversight Should Be Designed, Not Assumed

Another area of concern for me is the presumption that the mere presence of a human being within the chain guarantees some kind of human control. In cases where an AI-driven system proposes an operational move, companies have to clarify whether an employee’s role would be merely to accept that suggestion or to assess it on their own. What data does the employee get? Under what conditions can they dispute it? What would happen if the employee disagrees with the system? And who has the power to make the final call?

This doesn’t imply putting a human stamp of approval after every automated operation—that would defeat the objective of increased efficiency. But companies have to draw lines between machines and humans. The greater the potential impact of a decision, the clearer those boundaries should be.

Smart Manufacturing Is Expanding The GRC Perimeter

The conversation around risk must also widen. Smart manufacturing is characterized by the combination of AI, IIoT, cloud computing, digital twins, analytics and operational technology. When all these components work together, the risks that businesses typically assess independently start to overlap.

The connection of a machine is a security risk. The data it generates leads to privacy issues. The use of such data to train an AI algorithm creates problems related to transparency and accountability. My experience suggests that this is the point at which the GRC blind spots arise. Each team operates with its own set of controls, but no single function pays sufficient attention to what happens across them.

For GRC professionals, it isn’t enough anymore to govern individual technologies. We must govern their interactions and, even more, the decisions derived from those interactions.

Recent studies done on Industry 5.0 have touched on some of these issues. For instance, in his study titled “Industry 5.0: Human-Centric Manufacturing for Sustainable and Intelligent Production Systems,” Vamsi Krishna Avineni evaluated manufacturing systems characterized by the increasing presence of AI, collaborative robots, digital twins, IIoT and other systems. He found that human-centricity, sustainability and resilience are some of the major principles to be considered and argues that intelligent systems should enhance human capability and judgment instead of making it obsolete. The findings are consistent with my belief that GRC needs to take these points into account.

The study also highlights the overall risk landscape. Avineni mentions cybersecurity and data privacy issues, interoperability problems, skill sets and trust in smart systems as barriers to adopting Industry 5.0. In addition, he mentions transparency, accountability, workforce monitoring and data ownership as challenges in AI-driven manufacturing that remain to be resolved. This finding corroborates the governance issue I’m running into more frequently: Technical ability and readiness for governance don’t always develop simultaneously.

What Leaders Should Be Asking

While organizations move ahead with smart manufacturing, leadership can ground governance in four questions:

1. Who owns the decision? Every major decision that relies on some form of AI-enabled or automated technology needs to be anchored in accountability.

2. Where do humans need to be involved? Organizations need to decide which decisions can be automated, which need to have human intervention and which ones need to be made only by humans.

3. Can we rebuild the decision-making process? If a decision gets challenged months down the line, the organization should be able to trace the decision-making process from the data to the system recommendations, human intervention and decision.

4. Are we looking at cumulative risk? The cybersecurity, privacy, operations, AI governance and compliance teams have different roles within an organization, but the technologies they govern are part of one risk landscape.

Governance Should Move With Innovation

Manufacturing operations are increasingly autonomous, connected and information-intensive. Attempts to regulate them with traditional control approaches will become more difficult over time.

As far as GRC leaders are concerned, the key point shouldn’t be to wrap all new technologies into another level of approvals. Instead, it should be making governance an integral part of the design, implementation and application of the technologies.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?