In Mary Shelley’s gothic novel Frankenstein, the eponymous scientist works frantically to breathe new life into a body stitched together from a patchwork of human remains.

Which is kind of like what enterprises are trying to do with AI — by stitching together fragmented, misshapen systems and data to animate them into a new form.

But like Frankenstein, they are also discovering that the act of creation is not the end of the story — because creation also brings a set of unpleasant responsibilities towards the thing that is brought to life.

And these responsibilities — the need to care for the thing you have created — were at the heart of my recent discussion with OutSystems CEO Woodson Martin.

Because when I last spoke to Martin in the fall of 2025, his observation was that organizations were still struggling with the act of creation itself — struggling with talent scarcity, confusion about what AI really was, and the inertia created by fragmented narratives about where to go next.

So when we met again during OutSystems ONE in June, I was interested to hear what changes he’s observed in the interim.

The good news? It’s alive!

In Martin's telling, AI is now making it into production as organizations patch together the pieces necessary to make it work.

The bad news? It’s alive!

Which means that — like Frankenstein — Martin says companies are discovering a whole new set of responsibilities for governing what they have created — not only inside the enterprise, but increasingly across the wider ecosystems in which they participate:

The number one word that keeps bouncing back at me is governance — like, we got to figure out how to get our hands around this thing.

Martin starts by explaining that the foundation of the governance challenge is often understanding what exists — and how to manage it before it spirals out of control:

Every CIO now has a lot of agents in production — and they’re already starting to see conflicts emerging, architectural standards questions, very inconsistent approaches.

As a veteran of Salesforce, Martin sees parallels with the early days of Software as a Service (SaaS):

It’s like in the early days of SaaS, when an enterprise would end up with data in all kinds of third parties — and customers would want to know where their data was. And CIOs had to go figure that out. That same question is resurfacing now.

But Martin goes on to suggest that the issue is even more pronounced this time — because the diversity of tools, data, and users is even greater:

People are using a range of models, architectures and systems. There’s a bunch of stuff in clear text files [like markdown] or spreadsheets spread around on laptops everywhere. And everybody's making judgment calls individually. So this is a pretty significant data proliferation problem.

The difference is partly one of scale — because while SaaS created perhaps tens of centralized data silos, AI can lead to unstructured data and context proliferating across thousands of local machines.

All of which, Martin says, leaves CIOs confronting a fairly basic question:

So if you're a CIO, how are you securing that? How are you scalably engineering context so it’s not on laptops or in clear text files? Ensuring that if a person leaves, they don’t take it on a thumb drive?

Martin’s answer is to bring that context back under enterprise control:

The data should be in core Enterprise Services, provided as context through an MCP [Model Context Protocol] service that I can stand up and manage with role-based access controls. This has become a big thing — the governance bucket that we’re seeing surge as a priority.

Martin says this is where OutSystems’ Enterprise Context Graph comes in — seeking to maintain governed context across an estate that extends well beyond OutSystems itself:

We're a part of the landscape — and so what's connected to the Enterprise Context Graph matters as much as what's native to OutSystems itself. APIs and data sources can be connected through a graph that is available through an MCP service and which constantly evolves as things change — so that your agents can know immediately.

But Martin goes on to explain that context fragmentation is only the first tier of the governance challenge he sees organizations struggling with.

Because as you widen the lens from data to the surrounding technology estate, you also encounter problems of system proliferation — and an increasing number of potential attack vectors. He says this means he is seeing organizations becoming much more pragmatic about what they allow into the enterprise:

I would say the other concern that we are starting to see is around security posture. A lot of boards, CIOs and CISOs are taking a step back to assess their posture and vulnerabilities.

And this retrenchment, Martin explains, is leading to a change in attitude towards the adoption of new AI-enabled services:

It’s created an interesting dynamic because a lot of organizations were on a spree — deploying a lot of new technology and experimenting in a lot of ways. But they are now saying, hold on, we're actually going to take a step back from that pace and very carefully consider the estate that we have. And I think it's just a rational response from CISOs saying ‘if this threat is coming, I want to be ready and on top of it.’

Effectively Martin says this greater caution is a natural response to the proliferation created by the first wave of experimentation:

It’s just another argument for why we don't want a proliferation of things — people are just trying to limit the control points in the organization. We want to reduce the potential attack surface. We want to harden that attack surface. So the backlog of tools and systems to get through security reviews is growing fast — in part because the gate is closed on a lot of it. Essentially, they are assessing what they have.

And this is also proving to be a tailwind for platforms in Martin’s view — one which can benefit companies like OutSystems:

I think broadly speaking, the rapid evolution of the landscape favors platforms, because we're trying to rationalize, govern and get control. There's relief in the idea that customers can innovate with AI and put agentic systems into production on a platform they already trust and know.

While much of our discussion focuses on the inside of the organization, Martin also turns to governance from the perspective of his customers’ external environment — and specifically the topic of sovereignty:

Without a doubt, the number one surging thing that I’m hearing right now is the sovereignty concern. And obviously, we all know why — the world’s changing fast in terms of international trust breaking down.

And while this initially feels like a shift in topic, it’s more of a change of gear — because ultimately sovereignty is simply governance applied at its largest scale.

Because for many outside the US, Martin argues, geopolitical tensions and growing government involvement in foundation model releases are raising legitimate governance concerns as the implications for future model access become less clear — especially as organizations are being encouraged to rebuild themselves around models whose availability can be withdrawn abruptly. And even beyond the grand sweep of geopolitics, there is a more self-interested source of discomfort too — caused by potential over-dependence on hyperscalers whose incentives may increasingly diverge from those of their customers.

All of which, Martin says, have reopened seemingly settled questions:

The landscape’s changing fast and people are saying, ‘Okay, my fundamental assumption during the last two decades that everything will consolidate into these mega cloud hyperscaler infrastructures operated by either US or Chinese entities maybe no longer holds.’ They’re saying maybe we need something different — and it’s really fascinating how that has surged.

And as part of this changing landscape, OutSystems’ strategy seems to be to position itself as an ‘honest broker’ — one that helps connect and govern the patchwork of data, systems, and AI necessary to build an AI-enabled operating model.

Which brings Martin’s argument back to where it started.

Because, like Frankenstein’s monster, AI-enabled operating models are assembled from many disparate parts — and once you bring the resulting whole into being, you also have to care for it.

To ensure it doesn’t run amok.

In an enterprise context, that means governance at multiple levels — controlling your data, controlling your boundaries, and — most importantly — controlling your future.

I always enjoy conversations with Martin because he tends to spend much more time talking about the state of the market — and the mindset of his customers — than he does talking about OutSystems itself.

And one of the main takeaways from our discussion for me is that there are probably CIOs and CISOs all over the world recoiling in horror at what they have wrought during the first wave of AI experimentation — and wishing, like Frankenstein, that they could simply walk away from the ugly consequences.

Because like Frankenstein’s monster, many of those systems have been cobbled together from whatever assets and data were to hand — while organizations were simultaneously trying to learn how to infuse them with life.

And so the mess that Martin describes — models chosen opportunistically, context assembled wherever it could be found, data copied into whatever tools were available — is a recognizable sign of early-stage adoption. And there is nothing necessarily wrong with that — companies have to build experience somehow, and it’s often possible to get useful benefits from less-than-perfect systems.

But Martin is also correct that long-term scaling is not really feasible without taking responsibility for the governance of those systems and the ones that follow — as any lack of architectural coherence, security and operational manageability will quickly allow complexity to spiral out of control if not brought to heel.

So yes, enterprises have brought their AI monsters to life.

And now they just have to take responsibility for what they have created.