AI regulation and risk governance have evolved from niche concerns to board-level priorities in under three years.