Governance often becomes the thing teams try to circumvent. Reframing to be an enabler, it becomes the structure that lets skills and data work.
Governance carries a reputation problem. Across destination teams, it is heard as compliance, the part of AI work that slows people down and tells them what they cannot do. At X. Design Week 2026, the conversation was reframed to show governance as the foundation that lets everything else function. Three connected sessions built a working picture of what governance looks like when a DMO takes it seriously.
Grant Thornton's 2026 AI Impact Survey found that 46% of organisations name governance and compliance as the leading barrier to getting value from AI, ahead of skills and training at 27% and data quality at 18%. Treated as a restriction, governance becomes the thing teams try to circumvent. Treated as an enabler, it becomes the structure that lets skills and data work.
Governance carries a reputation problem. Across destination teams, it is heard as compliance, the part of AI work that slows people down and tells them what they cannot do. At X. Design Week 2026, the conversation was reframed to show governance as the foundation that lets everything else function. Three connected sessions built a working picture of what governance looks like when a DMO takes it seriously.
Grant Thornton's 2026 AI Impact Survey found that 46% of organisations name governance and compliance as the leading barrier to getting value from AI, ahead of skills and training at 27% and data quality at 18%. Treated as a restriction, governance becomes the thing teams try to circumvent. Treated as an enabler, it becomes the structure that lets skills and data work.
Governance carries a reputation problem. Across destination teams, it is heard as compliance, the part of AI work that slows people down and tells them what they cannot do. At X. Design Week 2026, the conversation was reframed to show governance as the foundation that lets everything else function. Three connected sessions built a working picture of what governance looks like when a DMO takes it seriously.
Grant Thornton's 2026 AI Impact Survey found that 46% of organisations name governance and compliance as the leading barrier to getting value from AI, ahead of skills and training at 27% and data quality at 18%. Treated as a restriction, governance becomes the thing teams try to circumvent. Treated as an enabler, it becomes the structure that lets skills and data work.
AI is built on training, and that training rests on systems. When a team asks for a campaign, a capable model reaches for the patterns it has learned; the content hierarchies, the audience frameworks and the editorial conventions that have always sat underneath creative work. Those are the same systems a DMO already documents in its brand guidelines and tone of voice. As AI takes on the patterned production, the human role moves up the funnel toward direction, curation and judgement. Governance is the system that keeps that directed work consistent, useful and trusted as it scales.
Trust is what governance is built to protect, with accountability and disclosure at the top, resting on honesty. Remove the foundation of trust and the whole working environment encounters friction. While worth is measured by output people can no longer claim alone, they will not be honest about how they used AI. A small reframe changes this. Asking whether someone used AI sets a yes or no binary response that closes the conversation and pushes its use into hiding. Asking how AI was used opens the learning, the sharing and the accountability that build a culture where AI is treated as normal and embedded across work.
The cost of getting this wrong is already visible. When organisations ask for adoption without giving clear support, shadow AI use becomes commonplace. Roughly 90% of staff are using AI privately, sometimes paying for their own accounts. A newsletter list cleaned in an unapproved tool or a draft strategy pasted into a free model that trains on the input are small acts that carry consequences out of proportion to how routine they feel. This is important to reflect upon because 35% of people have put proprietary data into public AI tools and 67% of leaders believe a leak has already happened.
The anxiety underneath this points back to leadership. Deutsche Bank research in 2025, drawn from a survey of 10,000 people, found that 24% of Gen Z workers hold a high fear that AI will replace them, while around 10% of over-55s feel AI is undermining human value. The fear is a rational response to being asked to adopt AI without first showing recognition for the value of people's work. Governance answers that by setting out where AI fits, what stays human and how contribution is recognised.
Once governance is treated as an enabler, three layers build on each other. Guardrails form the operational base, the boundaries for where and how AI may be used and the shared tools, environments and data people work within. Process sits above, driving consistency, quality and efficiency to augment output. Disclosure sits at the top and carries the most human weight, the culture of transparency that tells a colleague or a visitor what role AI played in the work.
Strategy and governance work in unison. Strategy decides what AI is for, with governance maintaining standards. This becomes increasingly crucial as systems gain autonomy. However, Gartner expects more than 40% of agentic AI projects to be cancelled by 2027 due to escalating costs, unclear business value or inadequate risk controls. With this in mind, it is important to remember that judgement-heavy tasks still need human direction. With the EU AI Act's high-risk obligations arriving in August 2026, the line is also a legal one.
Turning these concepts into a measurable opportunity, the DTTT has built a suite of frameworks for the sector, including models for transparency, productivity, environmental intensity and content integrity, alongside organisational intelligence instruments for maturity, capability and wellbeing. These act to help embed a more considered AI culture into organisations to assess the true impact on organisational performance and employee acceptance. As explored in the discussion that followed, tailoring these tools to a specific organisational context is a strong starting point for the open conversations that frame the initial AI governance process.
Maas van Drie and Sherry Bidgood from the Aruba Tourism Authority shared how requests for paid AI tools were arriving from across the organisation. Despite this, the DMO's digital department had no way to assess the risk, approve a tool or define what good use looked like. Recognising the potential data or legal exposure, the Aruba Tourism Authority commissioned the Digital Tourism Think Tank to support them with developing an AI strategy. This process began with an extensive audit process, before a detailed strategy and roadmap were shaped.
The audit surfaced how high adoption sat alongside low confidence and a clear request for guidance. 91% of staff were already using AI in daily work, while only 8% felt confident in how they used it. Crucially, 82% expressed concern about data privacy and sharing. Staff across the organisation had been using private ChatGPT accounts, which meant sensitive information was already outside the system the DMO controlled. Having moved to Microsoft 365, the team chose Copilot as the approved route, being an environment that the IT department could govern.
Aruba's first structural move was establishing a committee comprised of the heads of every department. It began before anyone knew the roles, formed simply to handle the tool requests and decide what would be approved. As the governance work matured, the committee took on the larger responsibility of owning AI across the organisation, and its shape changed to fit. The expanded workload meant that the committee could no longer function as one body, so it split into two:
Below the committee sit champions and ambassadors, the structure that carries governance into daily work. Champions execute and experiment within their teams, working through use cases inside the boundaries the framework sets. Ambassadors form a feedback loop, taking best practices back to the committees and helping leadership understand both the direction and the opportunity. Together, they are the eyes and ears across the organisation.
Filling those roles took persistence. Volunteers were plentiful at the start when the idea sounded light, but enthusiasm dwindled once the real work started. Maas and Sherry went person to person to explain the role, the reason for it and to take the fear out of it. The aim was to spread responsibility for AI across every team so that no single person or department carries the change alone. Leadership buy-in helped, as did bringing in an outside voice, since the message often lands more easily when an expert from outside delivers it.
The governance work uncovered more than an AI problem. As the Aruba Tourism Authority structured its approach, it found operational gaps the organisation had lived with for years, gaps that were no longer ignorable once AI made them urgent. Governance pulled these into view because it cannot sit on top of a disorganised foundation. One governance project became three running in parallel:
To make the strategy implementable, the Aruba Tourism Authority turned its approach into a roadmap of eight workstreams across three phases, broken down into hundreds of second-level tasks. Each person on the committee owns a workstream, which spreads assignment and delegation across the group. The structure looks top-down, and the delegation makes it bottom-up, leaving each person with a small number of changes to make. Five Guiding principles create a coherent foundation for how AI develops:
The framing throughout is that AI changes what work entails, instead of adding to it. To monitor progress, every department will track themself against a maturity scale, setting a target for the year ahead and outlining how they intend to get there. The C-level team is expected to reach the top of that scale.
An in-house assessment also checks whether confidence is improving. Yet, it is important to recognise that staff questionnaires do not always result in honest responses because employees are uncertain about how their responses will be assessed. This opens questions about whether to outsource such assessments and the guardrails to responsibly guide this process. The Aruba Tourism Authority also adapted a transparency scale for its own use, acting as a mechanism to label every piece of work from human-led through to fully AI-driven. Holding that record is what lets evidence-based decisions get made going forward.
Ethically working with AI is a multi-stakeholder responsibility. Alfred Wagenius from Visit Skåne complemented the discussion with an overview of why the same transparency discipline should reach outward to partners. Visit Skåne now writes into every public procurement document that suppliers must be transparent about how they have used AI. The value of that became clear when two suppliers responded to the same brief. One had pasted the procurement into an AI tool and returned the output. The other set out which parts of its work would use AI, how it would handle the information and how it would transform it. This detailed and structured response gave confidence and established trust, setting a strong basis for a working relationship.
Before this transparency can be set in motion, the first task is to set clear guidelines for acceptable AI usage. At Visit Skåne, Alfred and a colleague established themselves as a 2-person AI team, before approaching the DMO's IT team for additional support. Since Visit Skåne sits inside the same strict security system as the rest of the region, including the healthcare system, special permission was received for using AI tools after completing a full security assessment. This process mandated guidelines that would keep everyone on the right side of the law, with the chief executive ultimately responsible for ensuring this was followed correctly.
The guidelines started liberal. Where no sensitive information was involved and every output was checked, people were free to experiment. As adoption grew, the rules were tightened for images and videos. The accompanying work in communicating these guidelines was ultimately what made this a successful process. Alfred's team ran AI schools, reiterated the guidelines during meetings and built a custom assistant where staff could discuss them.
Currently, workshops are being run team by team and use case by use case, because the colleagues who are slower to adopt AI learn by solving one of their own challenges. For external content, the team holds the final say, treating AI as an assistant and keeping human editing on everything that is published. If AI saves 80% of the time on a task, the guidance is to spend at least 10% of it controlling the output.
Visit Skåne is also beginning to build for its industry, with personalised applications made for specific projects and a programme of webinars and workshops to help tourism businesses prepare for AI.
Chief Financial Officer
Aruba Tourism Authority
Global Digital Manager
Aruba Tourism Authority
PR-manager
Visit Skåne AB
Created for destinations around the world, this programme will provide the insight to help you become a sustainability leader within your organisation.
Designed to teach you how to master must-have tools and acquire essential skills to succeed in managing your destination or organisation, be ready to challenge all of your assumptions.
Designed to teach you how to master must-have tools and acquire essential skills to succeed in managing your destination or organisation, be ready to challenge all of your assumptions.
