Paula Oses

Most discussions about enterprise AI focus on models, infrastructure, and adoption. Our experience was different. Creative Studio was built within IAG Transform AI by a multidisciplinary team of creatives and technologists operating with a startup-style model inside one of the world's largest airline groups. The objective seemed straightforward: provide secure access to Generative AI capabilities for British Airways, Iberia, Vueling, LEVEL, Aer Lingus and IAG Loyalty while keeping enterprise data, brand assets and intellectual property protected. The technology challenge turned out to be the easy part. The real challenge was designing an operating model capable of balancing innovation and control across multiple brands, business units and risk profiles. As adoption expanded, we discovered that governance could not be implemented as a layer on top of the platform. It had to become part of the architecture itself. In this session, we will share the technical and operational lessons learned from running Generative AI in production inside a regulated enterprise environment. We will discuss how we approached identity and access management, content provenance, auditability, intellectual property protection through image similarity controls, EU AI Act considerations, approval workflows, and role-based guardrails driven by risk rather than job title. We will also explore one of our biggest lessons learned: not every user should have access to the same AI capabilities, and not every piece of content should follow the same governance path. Using real examples from supporting six operating companies, we will explain how governance decisions influenced platform architecture, permission models, content workflows and operational processes. Attendees will leave with practical patterns for building AI platforms where security, governance and compliance are not afterthoughts, but foundational design principles.