Azzam Bilal Chamdy
Neng Nana
Nana Muazin
Dwi Wanna
Raul Delapena Setiawan
Jia Lissa
At the Skift Data & AI Summit Europe, the conversation surrounding artificial intelligence shifted from the typical enthusiasm for "next-gen" capabilities to a more grounded, essential discussion: the mechanics of trust. Sheena Varma, Chief Privacy Officer, VP, and Senior Counsel at American Express Global Business Travel (Amex GBT), provided a rare, granular look into how a global travel giant balances the breakneck speed of AI innovation with the uncompromising necessity of corporate governance.
As companies worldwide rush to integrate large language models and machine learning into their workflows, Amex GBT’s strategy serves as a blueprint for the travel industry. By formalizing a rigorous review process, the company is demonstrating that in the age of generative AI, privacy and compliance are not obstacles to innovation—they are the essential foundations upon which it is built.
The Main Facts: A Decade of Change in a Single Year
The headline figure from Varma’s presentation was striking: Amex GBT processed 139 third-party AI tools or internal AI use cases in the past year alone. This represents a tenfold increase from the 13 reviews conducted just one year prior.
This meteoric rise in AI adoption is not merely a sign of corporate enthusiasm; it is a testament to the shifting landscape of travel management. From automated itinerary adjustments and sentiment analysis in customer support to sophisticated predictive modeling for corporate travel spend, the surface area for potential risk has expanded exponentially.
Amex GBT’s approach is centered on a "gatekeeper" model. Rather than banning AI tools to mitigate risk, the company has institutionalized a review framework that evaluates every new AI implementation for data sovereignty, privacy implications, and ethical alignment. For a company that handles the sensitive travel data of thousands of multinational corporations, the stakes of a data breach or an algorithmic bias incident are not just financial—they are existential.
Chronology: The Evolution of the AI Review Framework
To understand how Amex GBT arrived at this level of maturity, one must look at the timeline of corporate AI adoption.
The Experimental Phase (2022–2023)
In the early days of the generative AI boom, many organizations took a "shadow AI" approach, where individual departments experimented with tools like ChatGPT or specialized plugins without central oversight. At this stage, the risks were primarily internal—data leakage and lack of enterprise-grade security. Amex GBT recognized early that this ad-hoc experimentation was unsustainable.
The Implementation of Governance (2023–2024)
As enterprise-grade AI tools hit the market, Amex GBT began formalizing its internal policies. The jump from 13 to 139 reviews indicates the transition from "we should probably look at these tools" to "every tool must be vetted." The company established cross-functional teams comprising legal, cybersecurity, and IT architecture to evaluate the technical and ethical implications of every vendor integration.
The Current Landscape (2025–Present)
Today, the review process is integrated into the procurement lifecycle. It is no longer a "special project" but a standard operational procedure. As Varma noted during the Summit, the rigor applied to these tools is intended to protect the company’s reputation—a commodity far harder to rebuild than it is to lose.
Supporting Data: The Velocity of Adoption
The data provided by Amex GBT offers a mirror to the broader travel tech industry. If we analyze the 139 reviews conducted over the last 12 months, several trends emerge:
- Third-Party Dependency: The vast majority of these reviews concern third-party software integrations rather than proprietary, in-house built models. This highlights the industry’s reliance on specialized SaaS providers for AI capabilities.
- The "Privacy-First" Filter: Not every tool submitted for review makes it to the deployment stage. While the exact rejection rate is proprietary, industry benchmarks suggest that stringent privacy standards often filter out up to 30% of proposed AI tools due to non-compliance with data residency laws (such as GDPR in Europe or CCPA in California).
- Use-Case Diversity: The nature of the AI tools being reviewed has shifted from simple text generation to complex decision-support systems. These tools now influence everything from supplier negotiations to individual traveler safety alerts.
Official Responses and Perspectives
During her conversation with Skift Climate & Experiences Reporter Tasmin Lockwood, Varma emphasized that the human element is the ultimate arbiter of AI success.
"Think about your company’s reputation," Varma stated. "You don’t want to be that person who’s created something that suddenly gets them into the press headlines for all the wrong reasons. So that’s something that I think has to be put front and center."
This perspective shifts the narrative away from technical performance and toward ethical accountability. Amex GBT’s position is clear: AI is not a "set-it-and-forget-it" technology. It requires a permanent, watchful presence from legal and compliance teams to ensure that the tools of today don’t become the liabilities of tomorrow.
When asked about the balance between speed and security, Varma noted that "rigor is not the enemy of velocity." Instead, she argues that a well-defined process actually speeds up adoption because it provides a clear "yes/no" roadmap for teams across the organization.
Implications: The New Standard for Travel Management
The implications of Amex GBT’s model extend far beyond the travel industry. Here is how this approach impacts the broader market:
1. The Death of Shadow AI
As more companies adopt formal review processes like the one described by Varma, the era of shadow AI—where employees use unauthorized tools to get work done—is coming to an end. This creates a safer, more unified digital environment, but it also forces software vendors to be more transparent about their own privacy practices.
2. Reputation as a Business Metric
In the past, privacy was a box-ticking exercise for the legal department. Today, as evidenced by Varma’s comments, it is a core business strategy. Companies that can demonstrate robust AI governance are winning more corporate contracts. Clients are now asking, "How do you use AI?" as a standard part of their Request for Proposal (RFP) process.
3. The Human-in-the-Loop Requirement
The high volume of reviews underscores a critical trend: automation is not replacing human oversight; it is necessitating more of it. Whether it is a human lawyer reviewing a third-party AI contract or a human operator monitoring an automated booking flow, the "human-in-the-loop" model is becoming the gold standard for compliance.
4. Regulatory Preparedness
With the EU AI Act and other global regulations coming into force, Amex GBT’s proactive review process puts them in a strong position. By building compliance into the development cycle, they are avoiding the "compliance debt" that many firms will face when these regulations become strictly enforced.
Conclusion: Trust as a Competitive Advantage
As the travel industry moves deeper into the AI era, the divide between companies that treat AI as a wild-west opportunity and those that treat it as a managed asset will only widen. Amex GBT’s commitment to a formal review process—as highlighted by the tenfold increase in vetted use cases—proves that large organizations can be both innovative and cautious.
For travelers and corporate clients, the message is one of reassurance. The technology that powers their trips is being scrutinized by professionals who prioritize privacy and ethical responsibility as much as they do efficiency. In a world where AI can generate content, code, and insights in milliseconds, the ability to generate trust remains the most valuable skill a company can possess.
As Varma concluded at the summit, the goal is not to stop the AI revolution, but to ensure that when it arrives, it is a tool that serves the customer—and the company’s reputation—with integrity. For the rest of the travel sector, the path forward is clear: define your standards, build your review process, and never stop questioning the tools you put in front of your users.
Asro
