Most organisations already run a great deal of automation. It just does not act. Environmental sensors, sub-meters, asset trackers, access control, cameras. They cleared procurement easily because they carry almost no risk. They produce information, and a person decides what to do with it.
Then something acts on the data
An AMR arrives, or a delivery robot, or an inspection drone. Now a reading that used to inform a decision triggers one, with nobody in between. The sensor did not change. Its consequences did.
The join is the governed thing
Neither the sensor nor the machine carries the risk alone. The risk lives in the join: what the machine may do in response to what the sensor reports, who agreed to that, and whether anyone can show it eighteen months later. AG-4 Policy governs the first, AG-7 Audit the last.
Which is why the sensors come first
The fastest useful move brings the operation already in the ground under one set of rules, before the first machines land. No new hardware, no new supplier. By the time something acts, the layer that governs it already runs.