Before the gateway existed, H&M's approach to LLM adoption created what their team called "a high-risk environment with critical challenges across three key areas." Each one compounded the others.

The first was security and compliance. Without a central enforcement point, each team's direct integration with LLMs produced a fragmented security posture — inconsistent authentication, weak secrets management, and real exposure of sensitive data. As Qin An put it, they lacked the "centralized guardrails necessary to prevent malicious inputs or enforce consistent, auditable compliance policies for data handling."

"Each team's direct integration with LLMs created a fragmented security posture… a high risk of sensitive data exposure."

— Qin An, Product Owner, H&M

The second was operational drag. Engineering cycles were being consumed by redundant work — every new AI feature required rebuilding credential management, logging, and error handling from scratch. This wasn't just wasteful; it was actively slowing H&M's ability to compete in a fast-moving market.

The third risk was financial. With no centralized visibility into LLM consumption, cost attribution by team was impossible. Budget forecasting was guesswork. And without observability into API performance, the data needed to guide AI strategy simply didn't exist.

**Key insight:**

"We had no centralized visibility into LLM consumption, making it impossible to track costs by team or forecast budgets, creating significant financial risk." — Qin An, Product Owner, H&M

H&M's answer was to centralize all LLM traffic through Kong Gateway, transforming it into a unified control plane for every AI-driven application in the organization. The architecture enforces authentication, implements rate-limiting for cost control, and deploys security plugins as "essential guardrails" — not as friction, but as the foundation that makes rapid experimentation safe.

The framing is deliberate. This isn't governance as a brake on innovation. It's governance as the thing that makes more innovation possible. By abstracting the complexity of security and compliance into a single layer, H&M's development teams no longer have to think about it — they simply build.

"By abstracting the complex layer of security and governance, we have drastically reduced the time-to-market for new AI features, allowing our development teams to focus on creating business value rather than redundant infrastructure."

— Qin An, Product Owner, H&M

The projected impact across all three risk domains is significant. Onboarding time for new AI services is expected to drop from weeks to days — an ~80% reduction in time-to-market for new capabilities. LLM operational costs are expected to fall materially through intelligent routing and centralized rate-limiting. And the platform delivers 100% centralized logging and auditability for all AI traffic, giving compliance teams the visibility they need without slowing engineers down.

What makes H&M's approach distinctive isn't the technology stack — it's the sequence. Most enterprises race to ship AI features, then scramble to retrofit governance. H&M inverted that order. They built the infrastructure first, then opened it up to the entire organization.

The result is a platform that "democratizes access to powerful tools while centrally managing the dangers" — a phrase that captures the core tension of enterprise AI adoption more precisely than most industry frameworks manage.

"It provides the essential guardrails for security, cost, and compliance that give our teams the confidence and freedom to experiment safely and rapidly."

— Qin An, Product Owner, H&M

In a market where clear best practices for enterprise AI governance are still forming, H&M's "platform-first" approach positions them to scale AI initiatives across the entire organization — without accumulating the technical debt.