H&M's Generative AI Gateway shows what happens when a global retailer stops treating AI as a collection of experiments — and starts treating it as infrastructure.H&M's Generative AI Gateway shows what happens when a global retailer stops treating AI as a collection of experiments — and starts treating it as infrastructure.
There's a familiar pattern playing out across the enterprise world right now: a company moves fast on generative AI, different teams spin up their own LLM integrations, and within months the organization is sitting on a sprawling, ungoverned tangle of API keys, ad-hoc logging, and invisible cost exposure. H&M saw this coming — and chose to solve the governance problem before it became unmanageable.
The result is a Kong-powered Generative AI Gateway that the team describes not as a product, but as a platform — a centralized "nervous system" for all future AI innovation at one of the world's largest fashion retailers.
"Rather than pursuing isolated AI projects, we chose to first build a centralized 'nervous system' for all future AI innovation."
— Qin An, Product Owner, H&M
Before the gateway existed, H&M's approach to LLM adoption created what their team called "a high-risk environment with critical challenges across three key areas." Each one compounded the others.
The first was security and compliance. Without a central enforcement point, each team's direct integration with LLMs produced a fragmented security posture — inconsistent authentication, weak secrets management, and real exposure of sensitive data. As Qin An put it, they lacked the "centralized guardrails necessary to prevent malicious inputs or enforce consistent, auditable compliance policies for data handling."
"Each team's direct integration with LLMs created a fragmented security posture… a high risk of sensitive data exposure."
— Qin An, Product Owner, H&M
The second was operational drag. Engineering cycles were being consumed by redundant work — every new AI feature required rebuilding credential management, logging, and error handling from scratch. This wasn't just wasteful; it was actively slowing H&M's ability to compete in a fast-moving market.
The third risk was financial. With no centralized visibility into LLM consumption, cost attribution by team was impossible. Budget forecasting was guesswork. And without observability into API performance, the data needed to guide AI strategy simply didn't exist.
**Key insight:**
"We had no centralized visibility into LLM consumption, making it impossible to track costs by team or forecast budgets, creating significant financial risk." — Qin An, Product Owner, H&M
H&M's answer was to centralize all LLM traffic through Kong Gateway, transforming it into a unified control plane for every AI-driven application in the organization. The architecture enforces authentication, implements rate-limiting for cost control, and deploys security plugins as "essential guardrails" — not as friction, but as the foundation that makes rapid experimentation safe.
The framing is deliberate. This isn't governance as a brake on innovation. It's governance as the thing that makes more innovation possible. By abstracting the complexity of security and compliance into a single layer, H&M's development teams no longer have to think about it — they simply build.
"By abstracting the complex layer of security and governance, we have drastically reduced the time-to-market for new AI features, allowing our development teams to focus on creating business value rather than redundant infrastructure."
— Qin An, Product Owner, H&M
The projected impact across all three risk domains is significant. Onboarding time for new AI services is expected to drop from weeks to days — an ~80% reduction in time-to-market for new capabilities. LLM operational costs are expected to fall materially through intelligent routing and centralized rate-limiting. And the platform delivers 100% centralized logging and auditability for all AI traffic, giving compliance teams the visibility they need without slowing engineers down.
What makes H&M's approach distinctive isn't the technology stack — it's the sequence. Most enterprises race to ship AI features, then scramble to retrofit governance. H&M inverted that order. They built the infrastructure first, then opened it up to the entire organization.
The result is a platform that "democratizes access to powerful tools while centrally managing the dangers" — a phrase that captures the core tension of enterprise AI adoption more precisely than most industry frameworks manage.
"It provides the essential guardrails for security, cost, and compliance that give our teams the confidence and freedom to experiment safely and rapidly."
— Qin An, Product Owner, H&M
In a market where clear best practices for enterprise AI governance are still forming, H&M's "platform-first" approach positions them to scale AI initiatives across the entire organization — without accumulating the technical debt.
Shadow AI is any AI tool, model, or API integration deployed inside an organization without IT or security approval. Unlike sanctioned systems, it operates outside every review process your governance program depends on. That makes detection the fir
You can see this visualized in the diagram below. As you move to the right, you get smaller and smaller circles — more services, deployed faster, in a more distributed manner to add resiliency and features. As you move to the right, your control and
The Stainless deal tells you where the easy wins are headed. Turning an OpenAPI spec into a TypeScript SDK, a Python client, and an MCP server is going to be a button. That's good. It lowers the activation energy for getting an agent to call your
An AI control layer is the governance and observability infrastructure that sits between AI agents and enterprise applications, handling authentication, routing, rate limiting, and auditability to ensure secure, managed access. Unlike traditional in
The Demo-to-Production Gap Production reality multiplies complexity exponentially. In production, you need: Multi-tool orchestration with different authentication methods Robust retry logic with exponential backoff and circuit breakers Performance
The Anatomy of Architectural Complexity Modern architectures now juggle three distinct traffic patterns. Each brings unique demands. Traditional approaches treat them separately. This separation creates unnecessary complexity. North-South API Traf
Executive Summary AI adoption has moved past the "honeymoon phase" and into the "operational chaos" phase. As enterprises juggle multiple LLM providers, skyrocketing token costs, and "Shadow AI" usage, the need for a centralized control plane has be