chapter two

2 Adoption Models for GenAI

 

This chapter covers

  • How SaaS, API, and self-hosted GenAI models shift control and risk
  • What Agentic AI offers and which risks it introduces
  • Key risk dimensions across deployment choices
  • A primer on emerging Agentic AI
  • MediAssist, a fictional use case moving through all three adoption models

Before setting up governance controls or assessing compliance needs, even before you decide which compliance requirements apply, you need to answer a simple question: How is your organization actually adopting GenAI?

It’s tempting to think the answer is obvious. After all, using these tools seems straightforward: type a prompt, get a response. But what happens behind the scenes can vary dramatically depending on the adoption path you choose. That choice determines how accountability may be assigned and how much oversight you must perform or demand.

We call this your GenAI posture; your operational stance toward generative AI. In practice, many organizations operate in more than one posture at the same time. Your marketing team might rely on ChatGPT (SaaS), engineering could integrate Claude via API, while data science fine-tunes a model in house. Each posture brings a different mix of control, complexity, and risk and none remove the need for governance.

2.1 Three postures on the adoption spectrum

2.2 SaaS or Application Consumers

2.3 API Integrators

2.3.1 Organization-Controlled Zone: Enhanced Customization and Governance

2.3.2 Vendor-Controlled Zone: Stability and Reliability

2.3.3 Governance and Risk Management Opportunities

2.3.4 Achieving Effective Governance for an API Integrator

2.4 Model Hosters

2.4.1 Architecture Overview: What’s Inside the Controlled Zone

2.4.2 Governance and Risk Management Opportunities

2.4.3 Achieving Effective Governance for a Model Hoster

2.5 Risk dimensions across deployment postures

2.6 Agentic AI

2.6.1 What Does “Agentic” Mean?

2.6.2 Common properties of Agentic AI

2.6.3 Why Agentic AI is still experimental

2.6.4 Governance Challenges

2.7 MediAssist: A case study in AI governance

2.8 Summary