Speed To Innovate Requires Minimum Viable Governance

In my previous piece, I wrote about what the Confidence Gap panel at Fintech Meetup 2026 revealed about open banking’s unresolved liability problem—the regulatory fog, the reputational exposure, and why credit unions end up holding the bag for failures they may not have caused. If you haven’t read it, you can find it here. This piece picks up where that one left off—something else from that panel conversation stuck with me—and it connected to research I’d just finished reading from MIT’s Center for Information Systems Research.

Toward the end of the session, Hauptman made a point that went beyond liability and into economic competitiveness. He drew a parallel to the internet era: the US absorbed the same disruptions as every other country—lost the same jobs, endured the same economic dislocation—but unlike Canada or Mexico, America also captured the upside. The Netflix employees with life-changing stock options. The exporters, not just the consumers. His concern is that without regulatory clarity on open finance, the US will eventually get the consumer benefits—but the jobs, the investment, and the companies that create them will go elsewhere. “Normally, as Americans, we want to think people want to come here,” he said. The implication was clear: right now, on open finance, they don’t.

He also issued a direct challenge to the fintechs and credit unions in the room. “If you’re a regulator,” he said, “our only product is words on the page—rulemakings, guidance, the examiner manual. What words on what page need to be added, subtracted, or altered to make the thing you want to do happen?” He noted that when NCUA put out guidance on digital assets—not even a formal rulemaking, just guidance—the complaints turned out to be legitimate. As soon as clarity arrived, phones started ringing. Partnerships that had stalled for years moved forward in weeks. He noted, “…we all know sometimes people blame the government, the regulator, 'cause it's a way to get the salesperson out of your face.” His message: stop blaming and start telling us (regulators) exactly what’s in the way.

That challenge—be specific about the barriers, take responsibility for the path forward—is exactly what for me connected the panel to the MIT CISR research I’d been reading. The briefing, published in March 2026 by Nick van der Meulen, Jennifer Jewer, and Nadège Levallet, is titled Minimum Viable Governance for Generative AI. If you haven’t read MIT CISR’s work, I’d strongly recommend it—it’s some of the most pragmatic, research-grounded writing you’ll find at the crossroads of governance and innovation.

The researchers document what happens when organizations apply traditional governance frameworks—built for technologies with fifty-year life cycles—to generative AI, which reinvents itself every eighteen months. The result is a pendulum where organizations swing from uncontrolled risk without governance to outright paralysis with governance. Their case study of a global financial services firm, pseudonymized as “FinCo,” is a cautionary tale. FinCo did everything right by the conventional playbook. They established AI principles. Built cross-functional review committees. Spent close to a year producing a comprehensive enterprise AI policy involving hundreds of stakeholders. Even deployed a secure internal platform for experimentation. By any conventional measure, their governance was thorough. A year later, innovation had ground to a halt. Low-risk proposals—including an agent prototype involving no sensitive data—stalled for six months in review queues. Frustrated teams reverted to unsanctioned AI tools. Shadow AI spread more widely than before the governance existed. The board had to issue an urgent mandate to redesign the entire approach.

The researchers’ alternative is what they call minimum viable governance: what is the least amount of governance required to manage risk effectively while enabling the organization to sense and seize opportunities? They identify four characteristics that distinguish it from traditional governance—structurally agile, trustworthy by design, integrated end-to-end, and opportunity-sensitive—applied across five governance domains: principles, policies, people, processes, and platforms. These aren’t parallel tracks; they’re an interweaving system. I won’t attempt to replicate the full framework here—there’s a link above to the research. The implications of this research for credit union leaders are immediate and worth drawing out.

The regulatory paralysis Hauptman described in open banking—sixteen years and counting without resolution on who is liable—produces the same organizational outcome as FinCo’s governance paralysis: people stop waiting and start building around you. In open banking, that means fintechs capturing the value while credit unions absorb the risk. In generative AI, it means shadow AI spreading through your organization while your review committees debate low-risk proposals. The researchers found that organizations with well-developed minimum viable governance practices cut the average time to make complex decisions in half, and their teams identified new opportunities at three times the rate of peers. That is not an abstract metric; it’s the difference between serving your members and watching someone else do it.

This is why we should be partnering with fintechs—not treating them as threats but as an extension of research and development. They have the talent, the speed, the imagination. And I’ll say something that some in the credit union space may not want to hear: too many of our leaders lack imagination. Cross-pollination matters—sitting across the table from people building at a different pace, absorbing that energy, and channeling it through our cooperative mission—that’s how we close the gap.

And I will stress, partnering is not abdicating. It remains my responsibility as a technology leader to find the path that balances security, governance, and regulation alongside innovation. It is no longer optional to hunker behind a defensive moat, governing ourselves in isolation and waiting for the regulators to hand us the playbook. That approach is ineffective, lazy, and counterproductive to the interests of our members. As one governance leader told the MIT researchers, “The biggest risk is that we move too slowly, because a slow and cumbersome oversight process creates a vacuum filled by other actors who may not have our clients’ best interests at heart.” That sentence could have been written about any credit union still waiting for someone else to define what innovation looks like.

I wanted to innovate in a space with real consequences for real people, and there is no more fertile ground than credit unions. You do it by building internal capabilities that sharpen your differentiators, partnering with fintechs who bring speed and imagination, collaborating with credit unions who share the cooperative mission, and drawing on hard-won lessons from outside all three.

Minimum viable governance lives between two failure modes—a ceiling where governance kills innovation faster than it reduces risk, and a floor where it exposes the organization to unacceptable harm. Every mechanism outside that range should be questioned. We owe our members nothing less.