The first two installments in this series covered the strategic case for AI in oil & gas and the architecture that supports it. This post expands on that playbook by taking a closer look at a critical aspect that determines whether any of that actually ships: the governance operating model, who’s accountable for what, and the roadmap that sequences it all against a compliance clock that’s already running.
In a critical-infrastructure industry under process-safety and federal oversight, most AI conversations still treat governance as friction: a review process standing between a good idea and a shipped pilot. Flip that. A defensible, well-documented governance model is what lets a TSA audit, a PHMSA inspection, or a board risk committee say yes faster. Weak governance doesn’t just create risk. It creates delay.
One Body, Three Decisions
The operating model starts with a single cross-functional AI governance body, spanning subsurface and production operations, IT and data, legal and regulatory, HSE, and commercial. That body owns three things: what graduates from pilot to production, the shared risk-tiering standard applied across every use case, and who has authority to pause or roll back a deployed model, regardless of whether it runs in a purpose-built harness or inside SAP’s own agent layer.
That last point matters more than it sounds. As SAP’s agent layer matures, it becomes a peer system that has to be integrated with deliberately, not a second, ungoverned path where models can operate outside the same risk-tiering standard.
Every Agent Needs a Written Boundary
The core governance artifact here is a “seam of relevance”: an explicit, written boundary for what any given agent or model is authorized to do, enforced by the guardrail engine itself rather than left to policy documents nobody checks at runtime.
Practically, that means every domain gets a three-tier map: what an agent can do autonomously, what it can recommend or assist with but not execute, and what must always stay human-decided. In subsurface and drilling, an agent might autonomously handle analog-well search and assist with completion-design recommendations, but never take a well-control action. In midstream and pipeline integrity, an agent might triage leak alerts and draft emissions-quantification reports, but a pipeline shutdown or a regulatory submission still requires a person’s sign-off.
Determinism wins by default, and reasoning is reserved for genuine ambiguity, gated behind human review. Enterprise-wide, close to half of organizations using generative AI report having made at least one material business decision based on hallucinated output, and the fix isn’t picking a better model. It’s building systematic evaluation infrastructure before scaling, treating safety and emissions-reporting decisions as the highest bias tier from day one rather than an afterthought.
Joint Team, With Decision Rights Made Explicit
The recommended delivery model is a co-build pod, pairing an IBM Strategy & Build Team one-to-one with operator domain and platform owners, so specs, harness components, and knowledge assets get built jointly from day one rather than handed off at the end. On the IBM side, that means dedicated leads for strategy, governance and risk, solution architecture, and platform engineering. On the operator side, it means an executive sponsor, domain SMEs across subsurface, production, midstream, HSE, and commercial, and a governance council representative who co-owns risk tiering and graduation sign-off.
Ten recurring activities anchor how that team actually operates, from use case intake and spec approval through production deployment, rollback authority, and regulatory evidence assembly. Each gets an explicit RACI: who’s responsible for the work, who’s accountable for sign-off, who’s consulted, and who’s simply informed. That specificity is what turns “we have a governance process” from a slide into something an auditor can verify.
A Governance Model With a Pulse
None of this works as a one-time kickoff exercise. It runs on a recurring cadence: weekly build-pod stand-ups to unblock spec progress, bi-weekly intake triage to score new use case requests against value and risk, monthly governance council reviews for graduation sign-offs, and quarterly roadmap and regulatory alignment check-ins.
Nothing here is fixed at the start. The quarterly review is an explicit checkpoint to revise pillars, risk tiers, and even the cadence itself as the platform matures.
Designed to the Regulatory Reality
The framework doesn’t treat regulation as a constraint layered on afterward. TSA’s pipeline cybersecurity directives shape access-control and segmentation requirements for any AI system touching pipeline SCADA. EPA’s methane rule makes AI-assisted emissions quantification both a compliance and a reduction use case, with first annual reporting due November 2026. PHMSA’s leak-detection rule means AI-based anomaly detection complements certified computational pipeline monitoring rather than replacing it. And OSHA’s process safety management obligations mean field- and process-facing AI has to stay advisory by design. It can’t remove a human check that used to exist.
Proof This Pattern Works
This isn’t a theoretical framework. ADNOC worked with IBM to train visual recognition models classifying 25,000 rock-sample images a day, evaluating far more subsurface samples per well than manual review allowed. Wintershall Dea partnered with IBM Consulting to stand up an AI Center of Competence spanning technical architecture, operating model, and culture, running more than 80 AI use cases from small, fast pilots to larger initiatives like well-integrity sensor analytics. Both are directly analogous to the co-build team and fast-graduation intake loop described above. The transferable lesson is the operating discipline, not the specific software.
A Roadmap Sequenced to the Compliance Clock
The rollout doesn’t run on a separate timeline from regulatory reality, but is sequenced against it.
- Months 1 to 3 stand up the governance body, risk-tiering standard, and intake backlog, running the first spec end to end on production surveillance, the domain with the most mature, already-governed telemetry.
- Months 4 to 6 deploy pilots in parallel with existing process and publish the first governed data products.
- Months 7 to 12 layer in decline-curve forecasting, pipeline integrity triage, and methane quantification ahead of the November 2026 reporting deadline, alongside the first live agent-to-agent pilot between a SAP-side agent and a harness-side data agent.
- Year 2 and beyond stands up full cross-domain orchestration, but only once subsurface, field, midstream, and SAP-side agents each have an established graduation track record.
The Pragmatic Middle Ground
Across the three parts of this series to date, a few principles hold the whole framework together: AI earns its way into the capital plan rather than being declared onto it. The existing data and systems investment is the platform, not a legacy constraint. Multi-cloud is a design choice, not a fallback. Determinism wins, and reasoning gets gated. And governance is what earns the speed, not what taxes it.
An operator that can show a regulator or a JV partner exactly what every AI system is authorized to do, in terms as concrete as a line item, moves faster through compliance and capital review than one still explaining its AI program in generalities.
If your organization is building the governance model to sit underneath its AI roadmap, get in touch to talk through how Hakkoda and IBM structure this for oil & gas operators specifically.
