For teams shipping AI to regulated industries, what's the slowest part of the deployment cycle?

From what I've seen, regulated industry AI deployments have a predictable bottleneck. Build is fast. Deploy is slow.

The slow parts I keep seeing:

- Vendor security review (often 4 to 12 weeks)

- Internal data classification before any model can touch it

- Legal sign-off on what gets logged, retained, and where

- Production change board approval, even for minor agent updates

For folks shipping in BFSI, healthcare, or government, what's been the longest stretch in your timeline that wasn't on the original Gantt chart?