Imagine a telecoms operator rolling out a new 5G service in one country and at the same time introducing AI-driven customer engagement tools in another, each adapting to a very different set of regulatory rules. For a lot of telcos, this isn’t science fiction; it’s business as usual, life in the fast lane. But moving ahead without proper guardrails can be dangerous. Agile governance provides a mechanism to move at speed while ensuring accountability, compliance and risk are tightly monitored.
As carriers venture into new digital realms, regulatory and risk regimes can feel like bottlenecks. Innovation can be stifled, or, worse, provoke regulatory backlash, if governance does not evolve. Agile governance meets this challenge, providing controls strong enough to satisfy compliance and audits, yet nimble enough to support network upgrades, 5G slices and cross-border deployments at pace.
Risk landscape in evolving telco world
At present, telcos are encountering existential risks that endanger innovation and trust. The biggest risk for telecoms operators, EY has said, continues to be ‘misjudging evolving needs in privacy, security and trust,’ in part due to the growing usage of AI. The firm also identified ‘poor transformation’ as a newly critical risk, pointing out that many telcos have difficulty running AI projects that strike the right balance between speed and control.
At the same time, McKinsey research into agile telcos reveals that those telcos that engage in agile transformations are three times more likely to be top-quartile performers, but only where they also commit to structural, cultural and governance change.
This pressure leads to a paradox: telcos need to transform fast, but if they do so with an undisciplined hand, they expose themselves to non-compliance, reputational damage, or regulatory backlash.
What agile governance looks like in telecoms
Agile governance is about creating governance models that are as flexible and iterative as agile development teams are themselves. Telco operators maximise the use of their existing infrastructure and processes by applying a few methods:
- Integrate compliance into CI/CD pipelines: Rather than retrofitting audits and controls after deployment, teams can turn regulatory policy into code. Tools such as Open Policy Agent or HashiCorp Sentinel enable ‘policy-as-code’ enforcement, so compliance is checked at the time of development.
- Automated risk monitoring and runtime checks: Continuous static code analysis, such as SonarQube and Checkmarx, and runtime monitoring can identify configuration drift or secrets exposure to detect compliance or security issues before they become incidents.
- Cross-functional value teams, clearly accountable: Based on McKinsey’s case studies, top telcos are being organised into cross-functional ‘tribes’ and squads with product, network, security and regulatory roles, making governance a collective undertaking as opposed to a siloed audit role.
- Governance loops, not waterfalls: Agile governance is a way of working at every scale level, most prominently squads, tribes and leadership. McKinsey suggests that good telcos don’t have a one-off transformation journey.
- Cyber resilience embedded in agile structures: EY’s Cognitive Cybersecurity Centre (CCC) may give companies the ability to identify, react to and potentially deter new attacks using its unprecedented AI, ML and cognitive resources. In addition, the EY Responsible AI framework delivers an end-to-end, multi-dimensional model of governance by enhancing the EY AI risk and governance baseline to include considerations on model security, regulatory compliance and risk through eight primary domains, which, as a whole, provide the power of an integrated shield of controls and oversight.
Why accountability doesn’t mean slowing down
Agile governance works only if it’s clear who owns what and when.
- Clear RACI per sprint. Using the RACI project management model (Responsible (does the work), Accountable (owns the outcome/approves), Consulted (provides input/expertise), and Informed (kept updated)), every release must name accountable owners for security, compliance and operational risk. Squads know who’s driving policy checks and who handles audit readiness.
- Evidence pipelines, not audit panic. Build systems that automatically collect deployment manifests, signed artifacts, configuration drift logs and test results into immutable evidence stores. When regulators ask, you don’t scramble — you query.
- Culture and capability. EY’s Agile Risk framework helps risk teams embed real-time monitoring, scenario planning and control automation, turning risk functions from gatekeepers to enablers.
Cross-border compliance tests how telcos stay accountable
Deploying agile projects across multiple countries is especially tricky as global rules and regulations vary wildly.
Here’s how telcos can thread that needle:
- Regulatory sandboxes and performance-based approaches
- Regulators are increasingly embracing ‘agile regulation,’ such as sandboxing or adaptive regulatory frameworks. The OECD’s G20 survey shows jurisdictions are experimenting with performance‑oriented regulation, allowing telcos to innovate while being held to risk-based outcomes.
- Responsible AI governance
- McKinsey contends that telcos should develop Responsible AI (RAI) frameworks to address the business and societal imperatives of innovation and trust. With telcos handling massive volumes of data, the pressure is on, and often transparency is required; biases and data privacy need to be baked into governance, not bolted on. Telecoms operators that implement advanced RAI could capture US$250 billion in global value by 2040, according to McKinsey.
- Global GRC platforms for centralised management
- To address risk and compliance at a multi-national level, many telcos use governance, risk and compliance (GRC) solutions. Forrester research shows GRC platforms provide insight into risk, enable centralised workflows for compliance, enhance decision-making with centralised risk data and reduce fragmentation.
- Cyber risk quantification comes into its own
- With the advent of cyber risk quantification tools that are altering the way organisations measure and manage security risk and threats, the goal is to make risk quantifiable, actionable and fundamentally rooted in business strategy. Some solutions address the gaps of the earlier GRC systems by providing real-time monitoring, better reporting, and enhanced third-party risk management. Some specialise in day-to-day cyber operations such as exposure management, threat modeling, and remediation prioritisation. Now, at least some solutions are bringing strategic and tactical capabilities together, which may be indicative of a more holistic, mature generation of cyber risk management tools.
Turning governance into competitive advantage
When done right, telco agile governance is not just about avoiding fines or network outages. And when telcos are able to move faster, stay compliant, and build trust all at the same time, agile governance becomes a strategic differentiator. With compliance built into development pipelines, new offerings can be launched to market at scale, even across highly regulated markets. Organisations can perform continuous monitoring, maintain visibility into controls, and have shared responsibility for governance to strengthen their position before regulators and, in turn, may allow for sandboxes, waivers, or other forms of assistance.
This model establishes trust in the brand. Customers want speed, but also reassurance that the provider is innovating responsibly. The RAI framework can also help communicate that trustworthiness. In place of conventional audits and assessments, telcos can enhance risk profiling and posture with continuous monitoring and governance-as-code, reaching a more resilient and scalable risk posture that can be consistently implemented across global markets.
The fast lane needs guardrails
Trust and speed have come to be considered as a given in the telecom industry today. Telecoms operators need agile governance, not as a luxury but as the very infrastructure that makes it possible for them to innovate boldly, satisfy regulators and remain accountable on a country-by-country basis. As McKinsey’s data shows, telecoms operators that manage to do that don’t just survive; they leave their peers in the dust.
According to EY’s Responsible AI Pulse Survey, telco CEOs are progressively concerned about whether they have the capabilities and governance structures to implement AI responsibly. While 33% of leaders are accelerating investments in AI, the tension is splitting the industry, with nearly the same amount 32% pulling back or reconsidering what they meant by ‘implementing AI.’ That’s not where the pressure ends.
While operators are being pressed to retire legacy IT and network systems, some are also doing so as they move towards increasingly AI-native operations. If the pace of those two imperatives does not keep step, AI adoption risks becoming fragmented and unsustainable.
Anna Ribeiro