Three Questions That Decide Whether Your Privacy Programme Is Ready to Spend

Pressure to invest in privacy and AI governance has never been greater. Boards understand that regulatory expectations are increasing, AI initiatives are expanding, and the cost of getting governance wrong continues to rise. In many organisations, the conversation has shifted from whether investment is needed to how quickly it can be approved.

That sense of urgency is understandable. What it should not replace is programme readiness.

The history of privacy programmes is full of well-intentioned investments that failed to deliver the expected outcomes. New platforms were deployed before ownership was established. Advisory engagements began before the organisation had agreed what problem it was trying to solve. Additional headcount was approved without clear executive backing or a defined operating model. The investment itself was not the mistake. Spending before the conditions for success existed was.

This is where the Two-of-Three Rule remains valuable. Rather than treating investment as the starting point, it encourages privacy leaders to ask three straightforward questions before committing budget. If at least two can be answered with confidence, the programme is generally ready to move forward. If not, governance maturity should take precedence over procurement activity.

For organisations expanding their AI capabilities, this distinction has become particularly important. The pressure to demonstrate progress is real, but urgency and readiness are not the same thing.

Is there executive sponsorship with genuine authority?

Many privacy programmes can identify an executive sponsor. Far fewer can identify someone with the authority to resolve competing priorities, allocate resources and make decisions when governance conflicts arise.

Visible sponsorship is valuable, but governance depends on decision-making authority rather than organisational visibility. When responsibility is shared across legal, technology, risk and compliance functions, programmes frequently lose momentum because no individual has the mandate to make difficult decisions or resolve disagreements.

This becomes even more significant in AI governance. Decisions about acceptable risk, model deployment, accountability and oversight often extend beyond the privacy function. Without executive authority that is recognised across the organisation, investment risks creating additional activity rather than measurable progress.

Privacy leaders should therefore ask whether their sponsor can do more than advocate for the programme. Can they approve priorities, resolve disputes and be held accountable for outcomes? If the answer is unclear, the programme may have enthusiasm but not yet the governance maturity required to support further investment.

Is the operational pain specific and measurable?

Privacy teams are rarely short of reasons to justify investment.

Growing regulatory complexity, increasing volumes of data, expanding AI initiatives and rising stakeholder expectations all contribute to pressure on existing operating models. While these challenges are genuine, they are often described in broad terms that make effective investment difficult.

Successful programmes move beyond general concerns and identify measurable operational problems.

Perhaps Data Protection Impact Assessments are consistently delayed, slowing product launches. Vendor assessments may be creating procurement bottlenecks. Subject Access Requests could be exceeding internal service targets. AI governance reviews may be introducing avoidable delays because responsibilities remain unclear.

Each of these represents a specific operational issue that can be measured, prioritised and improved.

This distinction matters because investment should solve identifiable problems rather than respond to general discomfort. Organisations that cannot clearly describe the operational issue they are addressing often struggle to demonstrate value once spending has taken place.

Urgency encourages organisations to act quickly. Readiness requires them to understand precisely what success should look like before resources are committed.

Is funding approved, or is it still contingent?

The third question appears straightforward, but it often reveals the difference between genuine programme readiness and organisational ambition.

Many privacy initiatives are described as “funded” when, in reality, they remain dependent on future business cases, competing priorities or executive approval that has yet to be secured. Procurement discussions begin, vendors are evaluated and implementation plans are drafted, but the programme is still waiting for someone else to make the final decision.

There is an important distinction between expecting investment and having authority to commit it.

Confirmed funding provides more than financial certainty. It demonstrates that senior leaders have accepted the business case, understood the intended outcomes and agreed that the programme deserves organisational priority. Without that commitment, even well-designed initiatives can stall, consuming time and effort without delivering meaningful progress.

For privacy leaders, this question is also an opportunity to assess organisational alignment. If funding remains uncertain, it is worth asking whether the issue lies with budget availability or whether the programme has yet to demonstrate sufficient readiness under the first two questions. In many cases, delayed funding is a symptom rather than the underlying problem.

Applying the Two-of-Three Rule

Taken together, these three questions provide a practical diagnostic before significant investment decisions are made.

Does the programme have executive sponsorship backed by genuine decision-making authority?

Is the operational challenge clearly defined and measurable?

Has funding been approved rather than simply anticipated?

Where all three conditions exist, organisations can move forward with confidence, knowing that governance, ownership and investment are aligned.

Where two of the three are in place, there is usually sufficient maturity to proceed, provided the remaining gap is recognised and actively managed.

Where only one condition is satisfied, or none at all, the priority should not be selecting technology, appointing advisers or expanding the team. The priority should be strengthening the governance foundations that will allow future investment to succeed.

The value of the framework lies in its simplicity. It shifts the discussion away from what organisations want to buy and towards whether they are genuinely prepared to benefit from that investment.

Why the framework matters even more in the AI era

AI has intensified the pressure to spend.

Boards want assurance that governance is keeping pace with innovation. Regulators expect organisations to demonstrate oversight rather than intention. Business leaders want to move quickly while managing legal, ethical and operational risk. In that environment, there is a natural temptation to assume that new technology, additional expertise or external support will solve the problem.

Sometimes those investments are exactly what the organisation needs.

Just as often, however, they are introduced before governance has matured sufficiently to support them.

A platform cannot compensate for unclear accountability. External advisers cannot replace executive ownership. Additional headcount cannot resolve uncertainty about priorities or decision-making authority.

The organisations that achieve the strongest outcomes are rarely those that spend first. They are those that establish the conditions for successful investment before committing significant resources. Readiness does not slow progress. It reduces the risk of investing in solutions before the organisation is prepared to use them effectively.

As AI governance becomes a permanent executive responsibility rather than a temporary project, that distinction will become increasingly important.

Privacy leaders will continue to face pressure to move quickly. The challenge is ensuring that urgency does not replace disciplined decision-making.

The Two-of-Three Rule provides a simple way to make that judgement.

Before approving a platform, commissioning an advisory engagement or expanding the privacy function, it encourages leaders to pause and ask three questions that reveal whether the programme is genuinely ready to move forward.

The DPG applies this approach before recommending any significant investment. By helping organisations assess executive authority, operational readiness and funding maturity at the outset, the team enables senior leaders to invest with greater confidence, ensuring that governance is established before additional spending begins and that investment delivers measurable, sustainable outcomes rather than simply increased activity.

 

---

Sources

1. NIST AI Risk Management Framework (AI RMF 1.0)

National Institute of Standards and Technology (NIST)

The leading practical framework for establishing AI governance, organisational accountability and risk management before AI deployment.

https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10

 

2. NIST AI Risk Management Framework Resource Centre

National Institute of Standards and Technology (NIST)

Supporting implementation guidance, governance practices and operational resources for organisations adopting the AI RMF.

https://www.nist.gov/itl/ai-risk-management-framework

 

3. OECD AI Principles

Organisation for Economic Co-operation and Development (OECD)

International principles promoting trustworthy AI, organisational accountability, governance and responsible decision-making.

https://www.oecd.org/en/topics/ai-principles.html

 

4. ISO/IEC 42001:2023 – Artificial Intelligence Management Systems

The first international management system standard specifically designed for AI governance, oversight and continual improvement.

https://www.iso.org/standard/42001

 

5. NIST AI RMF Playbook & Supporting Resources

Practical implementation guidance showing how governance maturity should precede AI deployment and operational investment.

https://www.nist.gov/itl/ai-risk-management-framework/ai-risk-management-framework-resources

 

6. McKinsey & Company – The State of AI

Annual research examining organisational AI adoption, governance maturity and executive leadership practices.

https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai

(Widely referenced industry research. The annual report URL changes each year.)

 

7. AI Governance | International Association of Privacy Professionals (IAPP)

The IAPP’s dedicated AI Governance Centre provides current guidance, research, governance frameworks and practical resources to help organisations establish and mature AI governance programmes.

https://iapp.org/ai-governance/

 

8. AI Governance Profession Report 2025

International Association of Privacy Professionals (IAPP) & Credo AI

Research examining the current state of AI governance programmes, organisational maturity, governance structures, accountability and emerging best practices across industries.

https://iapp.org/resources/article/ai-governance-profession-report/