TL;DR

The article makes four claims that matter.

Claim 1: Most organisations have a large AI estate they do not fully see, so governance is being built on partial visibility rather than a full map of what exists.

Claim 2: The real AI estate splits into three zones - what you control, what vendors add and what runs on other people’s infrastructure - and each zone allows a different governance response.

Claim 3: Mapping comes before response. You cannot avoid, mitigate, transfer or accept AI risk until you know which tools, features and dependencies are actually in the estate.

Claim 4: The practical fix is a populated estate map with a named owner, a zone, a data classification and a status for each entry. The article’s point is that the production layer only works after that map exists.

Yesterday, Neil Catton dropped a note that really struck me.

He was commenting on the Production Layer methodology I use to move AI from pilot to governed, production-grade deployment. His observation was short and precise:

He is right. And the more I pulled on that thread, the more uncomfortable it got.

Enterprises are spending real money on AI governance: policies, control planes, responsible AI frameworks, TRiSM platforms, AI Business Offices. Most of it is being deployed on top of a false premise that the AI estate is visible and owned.

In reality, most organisations have never fully mapped what AI they actually run, who brought it in, or how much of it sits on infrastructure they do not control.

The result is predictable: serious governance effort concentrated on the visible tip of the estate, and very little grip on where AI is actually used, which tools touch sensitive data, or how much of the risk sits on someone else’s servers.

Neil named the crux. This article is what I found when I went looking for evidence that he was wrong. And didn’t find it.

The comforting lie in AI governance

Every serious risk framework starts in the same place: first identify and assess your risks, then choose how to treat them. In the language of NIST, ISO, and ISACA, that means you map the problem before you pick between four responses: avoid, mitigate, transfer, or accept the risk.

AI governance decks or vendor pages say the same thing in more modern language: “visibility first,” “AI inventories,” “control towers,” “discovery engines.”

You are told to start with an inventory of models, tools and data flows, then apply policies and controls.

But when you look at what is actually happening inside enterprises, the order is often reversed.

• Zluri’s 2025 State of AI in the Workplace report found that employees in a typical mid‑ to large‑size organisation now use dozens or hundreds of AI tools, yet IT and security teams have visibility into fewer than 20 percent of them.

• Protiviti’s 2026 AI Pulse survey reports that 47 percent of large organisations admit they do not have full visibility into the AI tools their employees use, and 65 percent say “shadow AI” is now a material challenge.

• Shadow AI - AI tools and features adopted without IT approval - is now a standard term in security and compliance guidance, and almost every new data‑security product starts its pitch with some version of “you can’t protect what you can’t see.”

The comforting lie is that “visibility first” is already true. On the ground, most organisations are still at “visibility later, maybe.”

What is actually in the AI estate?

When you strip away the marketing language, the AI inside a typical enterprise shows up through six main entry points:

The top four rows are “home‑grown” in different ways. They are all created or adopted by your own staff, even if nobody asked permission.

The bottom two rows arrive from the outside: vendors push AI into your existing tools and foundation model providers sit underneath your own AI stack.

Most governance tools and frameworks you see today are built for the “home-grown”. They assume the “AI you care about” is the “AI you built or explicitly bought”. The problem is that a large amount of your exposure now shows up in the bottom rows - where you use AI, but you do not fully own the systems it runs on.

A real mandate that started from the map

I mention this use-case before. Inside one global engineering group, a VP is sitting on roughly 500 AI‑adjacent engineering projects. The “AI pipeline” works, the data platform and master‑data systems are there and technically sound.

What is missing is governed master data and a living data community. The people and incentives that keep business data structured and owned.

Their own description of the mandate is 80-90 percent data governance, 10–20 percent AI. Success is defined as

the number of master‑data domains brought back under governance,
the quality indicators attached to each, and
a community that is not administrative theatre but a real network with time, mandate and skin in the game.

In other words: they do not need another AI architecture.

They need someone to map what exists, re‑attach ownership to that data and rebuild the human system around it. Only then does the AI production layer make sense.

It may sound like an outlier. Yet, it is the quiet pattern under a lot of “AI transformation” work that rarely makes it into conference talks.

Where risk management meets AI governance

Once you look at AI through the six entry points, the governance problem is no longer one question but rather three - each requiring a different response.

A quick reminder. Risk management gives you four responses once you have identified a risk: avoid it, mitigate it, transfer it, or accept it. All four actions are legitimate. None works until you have mapped the risk first.

That is the problem.

You cannot avoid a tool you do not know exists.
You cannot mitigate data exposure from a vendor feature you have not audited.
You cannot formally accept a foundation-model dependency that has never appeared in a risk register.

The three estate zones define which responses are actually available to you.

Zone 1 - estate you can actually control

This zone covers the first four rows of the table: allowed deployments, personal tools, developer models and department‑led SaaS. The common property is simple: these are all inside your organisation’s formal authority. With the right mandate, policy, and technical controls, you can change how they are used.

This is where my production‑layer methodology, AI Business Office and control planes make sense. Because you can:

• decide which AI tools are allowed and on what terms,

• route approved AI traffic through gateways and proxies,

• require developers to register model API keys in CI/CD and

• link AI access to identity and access‑management.

In risk‑framework terms, Zone 1 is where avoid and mitigate are real options. You can decide not to allow a class of tools. You can reduce the chance or impact of misuse with controls.

Once you have that list, the next step is accountability - naming the human who owns each consequential decision an AI system makes. That is a separate exercise, covered separately:

Zone 2 - estate you inherit from vendors

Vendor‑activated SaaS AI sits in the fifth row. You did not buy “AI” explicitly. You bought a CRM, an ERP, a ticketing tool or a productivity suite. The vendor added AI into it later.

Here, you can’t pretend you are fully in control. You cannot rewrite the SaaS product. But you are not powerless. The work in Zone 2 is to:

• decide, per feature, whether to keep it on, turn it off or fence it with strict data rules,

• enforce data‑loss‑prevention and data‑masking policies at the network layer so sensitive fields do not flow into vendor AI features by default,

• use contract renewals to negotiate tenant‑level disable rights and training‑data exclusions where the relationship is big enough to give you leverage.

In risk terms, you cannot fully control the product, but you can avoid features, mitigate data exposure and transfer some responsibility through contracts and indemnities.

Zone 3 - estate that runs on other people’s infrastructure

Your agents, copilots and AI-enabled workflows run on foundation models you do not own, in clouds you do not operate, under laws you do not write. A government decision can change who gets access to a model over a weekend.

You have less options than in Zones 1 and 2. You can avoid single-provider dependency. You can mitigate through hot-swap architecture, though that is a 12–18 month investment. You can transfer financial exposure through contracts, but not regulatory accountability.

Whatever remains has to be formally accepted at board level - documented, owned, reviewed.

This is where AI procurement and geopolitical risk management meet.

What does mapping look like?

The output of this work is a list — a populated version of the table above with your actual AI estate in it: tool or system name, which zone it sits in, what data it touches, who owns the governance decision, and current status. That list is the map. Everything else, such as the risk responses, the controls, the contracts - comes after it exists.

Most organisations skip straight to "respond" before this list exists.

The mapping comes first: CASB (cloud access security broker) telemetry and expense data for Zone 1, a SaaS feature audit for Zone 2, an impact score per foundation-model dependency for Zone 3.

Only then does it make sense to ask which risks to avoid, mitigate, transfer or accept.

Three 90-day tests

Here are three tests any executive team can run in a quarter.

The visibility ratio

If you have a cloud access security broker (CASB), pull its discovery report.
If you do not, pull SaaS spend from finance.
If you have neither, you do not have the instrumentation to run the test.

If your CASB or expense data show AI tools your registry does not contain, those are your governance gaps. The size of that list tells you where you actually stand.

Decision speed test

Within 90 days, take the top 5 unsanctioned AI tools you found and see whether each is classified as approve, restrict, replace or block with an owner and deadline. If everything is still under review at day 90, you do not have governance.

Control test

Pick one high-risk AI use case - like tools handling corporate data - and check if the policy, approval path and technical control actually stop unsanctioned use or force migration.
If people can keep using the tool unchanged after the review, the policy is ignored.

If you cannot answer those questions, you do not have an AI governance problem. You have an unpriced concentration risk sitting outside your risk register.

What this means for operators

If you are a CIO, CISO, CDO or COO, the next 6–12 months of real work is not another control plane or another policy document. It is the slow, political, unglamorous work of mapping what you actually have. And forcing three honest questions into the open:

which AI do we stop using,
which exposure do we accept because the business value justifies it, and
which foundation-model bets are we making knowingly versus by default.

Once you have answered those questions and made a conscious decision at the right level, the production layer makes complete sense. It was never wrong. It was built for the part of the estate you can see and own.

The work now is to find out how small that part really is, and start governing the AI you actually have.

My final ask

These Signals come from conversations I have with executives every week. Just written down.

If this one named something you have been circling without landing on - send it to the person closest to the first agent deployment decision. They need to read it before they approve it.

And if you want to support the work directly:

buy me a coffee or a book

TL;DR

The article makes five claims that matter.

Claim 1: 48% of organisations deployed AI without redesigning a single workflow or role.

Claim 2: Enterprise research measures adoption and maturity, not who gets the blame when something fails.

Claim 3: A federal court already ruled that AI agent liability lands on the deployer, alone.

Claim 4: Colorado enforces now. EU AI Act transparency obligations land 2 August 2026. The regulator wants a name, not a framework.

Claim 5: The fix can be as simple as one column - a named person, tied to a decision class, with a logged sign-off - missing from every framework currently on the market.

A friend of mine is deploying AI agents in production. Real agents, running in product design workflows, delivering 5 to 7 times faster cycle times on specific process steps. His DPO and CAIO drew hard lines: HR data, customer data, commercial decisions - none of it touched by AI. Quality architecture in place: self-checking frameworks, output perimeters, reliability tests. By every standard measure, they are doing this right.

I asked one question.

The answer I got was a very detailed description of the quality architecture. And why it won’t fail.

I still don’t have an answer to that question. And I’m not alone. Deloitte just surveyed 3,700 leaders and neither do they.

48% of organisations introduced AI without redesigning workflows or roles.
Only 12% report redesign at scale with a new operating model behind it.
69% sit at the most conservative end of AI autonomy - none, or limited to low-risk reversible actions only.

All three findings come from the same report, published 2 June 2026.

The production layer that wasn’t built

Three months ago, I described the structural condition. The gap between "AI deployed" and "AI embedded in the operating model" has not closed.

Deloitte's January 2026 State of AI surveyed 3,235 leaders. It showed that education, not role redesign, was the primary organisational response to the AI skills gap. Six months later, the June pulse check shows the gap has not moved.

Most organisations have cleared the question of whether to use AI. Few have rebuilt anything around it.

That is the reality of today. Everything that follows is built on top of it.

The wrong friction keeps getting removed

There are three types of friction in any AI-driven decision process.

Cognitive friction is the mental drag before a decision. The pause, the review, the moment where a human thinks carefully before acting. Slow. Expensive. Often where bad decisions get caught.

Operational friction is the circuit-breaker architecture. Checklists, output perimeters, reliability tests, quality gates. My friend’s company has this. It is what their self-checking framework produces. When it works, errors do not escape into proposed decisions.

Accountability friction is different. It is the logging, the named sign-off, the documented role that makes a consequential decision traceable when it fails downstream. It answers the question that operational friction cannot:

Consulting firms and system integrators spent thirty years removing the first two types. AI is now accelerating the removal of all three. Their response to the governance gap — "three gaps every leader should close," transformation playbooks, vendor governance features. All of it targets cognitive and operational friction almost exclusively. Every piece of it makes AI faster to deploy, easier to justify and simpler to measure on efficiency metrics.

Accountability friction requires naming who authorized the agent's scope and who signed off on its output. That question, a consulting firm will not ask in a pitch. And no vendor ships a feature that makes their customer's leadership team personally traceable to a failed downstream decision.

Enterprise research is designed to track adoption, autonomy and value realization. That is what boards ask for and what reports are built to show. A question like “which named role is accountable when this agent fails?” sits outside that design. It produces no maturity score, no benchmark quartile, no year-on-year progress metric. So it goes unmeasured across every major report in this space, Deloitte’s or any other.

Every major report in this space measures whether you are moving fast. None of them measure whether anyone can answer for where you actually land.

My friend's company would be considered as "highly prepared" on any of those reports. They have operational friction. Their CAIO drew hard lines. Agents are in production with real results. They still cannot answer who gets the blame.

Generation two, deployed on generation one’s unsolved problem

Autonomous agents are already in production in the companies paying attention. They execute across functional boundaries, touch external systems, and move at machine speed. Only 12% of organisations have reached the most mature state of AI autonomy , where AI runs end to end and humans audit outcomes rather than approve each step.

Only 1 in 5 had mature governance for autonomous agents as of January.
Six months later, 69% are still operating at the most conservative autonomy level with agents on a short leash, low-risk actions only.

The leap from there to full autonomy is a different class of problem entirely.

Generation-one governance was built for output quality.

Does the agent hallucinate?
Does it stay in scope?
Does a human review before it sends?

That architecture works when a human is still in the loop on every consequential step.

Generation-two agents skip that loop.

They act.
They access systems, trigger downstream processes, sometimes across organisations they were never formally authorized to enter.

The question is no longer “did the output look right?” It is “who said this agent could do that, in that system, under whose name?”

Most organisations have an answer to the first question. Almost none have an answer to the second.

Amazon v. Perplexity is what happens when that gap meets a court. Perplexity's Comet agent accessed Amazon accounts, scraped data, placed purchases. The users had consented. The Amazon platform had not. A federal court ruled that Perplexity's continued access after Amazon's revocation notice breached the Computer Fraud and Abuse Act. Perplexity built it, deployed it, and took the liability. A May 2026 Jones Day analysis confirmed the precedent now extends to any enterprise agent fleet operating the same way.

Colorado's AI Act entered enforcement this month. EU AI Act transparency obligations land 2 August 2026. The regulator has no stake in the transformation narrative sold by consulting firms. They ask the same question I asked my friend. And unlike my friend, they require a documented answer.

Three gaps in my previous articles

The last mile is where enterprise AI actually dies diagnosed that Production Layer is missing.
How to build a missing AI Production Layer gave the framework: control plane, decision inventory, friction classification, redeployment pillar.
The Friction Factories explained why consulting archetypes remove the wrong friction.

Three things remain unsaid across all of it.

The accountability column .

The Production Layer framework names processes and committees.
It stops one column short of what a regulator will ask for: which person authorized this agent to act, and which person signed off before that action became a decision.

I did not add that column earlier. Neither did any vendor governance feature or consulting deliverable I have seen. Here’s what it should look like:

The generational skip.

The governance conversation is still treating autonomous agents as faster copilots.
A copilot drafts. An agent acts in systems, across boundaries, under someone's name.

The accountability question that never mattered for a copilot becomes the only question that matters for an agent. Most companies deploying generation-two agents are doing it with generation-one thinking and generation-zero answerability.

The measurement blind spot.

Enterprise research tracks adoption, maturity and value realization. Those are the right questions for a board update.

They are the wrong questions for a regulator. Progress gets measured. Blame does not. That gap is not in any single report, yet it is in what the whole area of research was built to find.

What can be done

The organisation carries the liability. Colorado, the EU AI Act, and the Comet ruling all say the same thing:

The question is whether anyone inside that company can actually answer it.

If you have the Production Layer decision inventory, open it. Add one column: Accountable role.

A person - named, communicated, listed somewhere a regulator can find.

Most companies already have sign-off processes for big strategic choices. This is different. Those processes cover human decisions. This column covers decisions an agent contributed to - what it was authorized to do, in which systems, and who formally accepted its output before it became action. That acceptance needs to be logged. Meaning anyone in the workflow can find it without a compliance treasure hunt.

Three things make that role real rather than decorative:

Tied to the decision, not the agent.

The agent will change. The model will be swapped, the vendor replaced, the workflow redesigned. The accountable role stays fixed to the decision class - hiring, pricing, compliance freeze, shift allocation. Govern the decision and every agent that touches it falls inside the same boundary automatically.

Signed, not simply watched.

Oversight that reviews but never formally accepts is useful for audits. It answers nothing when a regulator asks who authorized this. Sign-off means one named person formally accepted the agent’s output as the basis for a consequential action. So that moment is in the log.

Known, not filed.

Everyone whose work feeds into or depends on that decision knows who holds sign-off. A “Decision Register buried in a compliance document” and a “Decision Register everyone can name” need identical paperwork. But they produce entirely different outcomes the moment something goes wrong.

My friend’s quality architecture will catch the AI agent’s next error. The Decision Register will answer for it. If they build one.

What to watch

By 2 August 2026 EU AI Act transparency deadline

Pick three companies in your network that claim strong AI governance.
Ask each one:
For your most consequential deployed agent, name the person accountable for a downstream error and show me the log entry.
If none of the three can answer within two business days without pointing at a committee or a framework document - the architecture is missing, regardless of their maturity score.

By Q3 2026 - the Comet extension:

The Amazon v. Perplexity ruling gets cited in at least one case against an enterprise deployer for accessing a third-party system without authorisation.
If it does, every general counsel in the market starts asking the accountability question before the year is out.

By end of Q3 2026 - the redeployment signal:

Challenger, Gray & Christmas data shows whether AI governance and oversight roles are growing alongside the AI-attributed layoffs announced weekly.
If governance headcount grows with the reallocation, the architecture is being built.
If it stays flat, it is being defunded at the exact moment enforcement starts.

My final ask

These Signals come from conversations I have with executives every week. Just written down.

If this one named something you have been circling without landing on — forward it to the person in your organisation who is closest to a one-way agent deployment decision. They need to read it before they make it.

And if you want to support the work directly:

buy me a coffee or a book

TL;DR
The article makes five claims that matter.

Claim 1: Companies spent the last year eliminating the middle managers who held AI governance together.

Claim 2: The EU AI Act transparency requirements activate on August 2, 2026, and 78 percent of enterprises have not moved past basic awareness.

Claim 3: The talent market cannot clear the gap. AI governance is now the hardest role to fill globally, and it takes 18 to 24 months to develop someone who can actually do it.

Claim 4: Hiring a consulting firm to write your governance strategy adds a more expensive layer of documentation on top of the same broken foundation.

Claim 5: Three moves can limit immediate exposure before August 2 : assign data ownership by pain not title, rebuild your data community around demonstrated results not policy, and implement AI risk corridors.

You are being asked to build the governance system your board wants, your regulator requires and your auditors will review in 130 days.

The people who knew how to build it are gone.

Gone as policy. Gone as part of the transformation narrative. Gone because the AI business case needed a numerator and middle management was the most available denominator.

This is the Governance Capacity Paradox:

The EU AI Act transparency requirements activate on August 2, 2026. The elimination already happened. The talent to rebuild does not exist at the scale or speed required.

You are inside a paradox with a fixed end date. And most organizations have not realized it yet.

The pattern observed

The warning signs have been building for twelve months. Nobody put them together until the EU AI Act deadline made the gap impossible to ignore.

Companies have been cutting middle managers at scale.

Korn Ferry’s survey of 15,000 workers found that 41 percent say their company has already stripped out management layers. Gartner forecasts that by end of 2026, one in five companies will use AI to eliminate more than half of their middle management. Amazon cut 14,000 corporate roles in 2025 explicitly citing AI-enabled leaner structures. The trend is documented and is still running.

Most companies are nowhere near ready for what regulators now require.

Vision Compliance's April 2026 report found that 78 percent of enterprises have not moved past basic awareness — no AI inventories, no named owners, no documentation.
Deloitte's State of AI 2026, based on 3,235 leaders across 24 countries, confirmed that three in four companies plan to deploy agentic AI within two years. Yet only one in five has a governance model ready for it.

The people you would hire to fix this do not exist in sufficient numbers.

ManpowerGroup’s 2026 survey of 39,000 employers found AI governance roles are now the hardest jobs to fill anywhere in the world. Competitive. Expensive. And simply not available at the required scale or speed.

Twelve months. Three separate signals. One date where they all meet: August 2, 2026.

The job cuts created this gap.
The regulation made it visible.
The talent shortage made it permanent.
And all this happened in slowmo in front of our eyes.

The system revealed

Earlier this year I worked on an AI governance project at a large company. The kind of place that has been running AI pilots for two years, has a Chief Data Officer, a 40‑page governance framework, and still cannot get a single business unit to take real ownership of its data.

Inside this company there were two power centres pulling in different directions.
At headquarters, a VP for Digital Operations responsible for reducing risk and keeping the operating model stable.
Offshore, a VP for AI whose job was speed - he ran the AI layer meant to accelerate roughly 500 engineering projects.

They were not fighting about “AI vs governance” as ideas. They were living in different timeframes.

The HQ VP told me very clearly:

She didn’t exaggerate. It was her honest view of the mess. She knew the big consulting company had delivered a polished governance strategy: good on slides, empty in production. Nice wording, no working plumbing.

The AI VP needed clean, trusted data right now. Not after a six‑month rebuild. His teams were stuck at proof‑of‑concept. They could not safely deploy models on data they did not control. He was not against governance. He was against waiting.

The governance lead role sat right in the middle of that squeeze.

If you lean towards the AI VP’s urgency, you turn into a “data janitor”: fixing tables by hand, writing one‑off scripts, racing to clean inputs so a model can go live this quarter, while the deeper problems stay untouched.
If you lean towards the HQ VP’s patience, you build careful frameworks that nobody uses while the AI teams quietly route around you and ship models on ungoverned data anyway.

In both cases, the company ends up in the same place:

Exactly the outcome the HQ VP was trying to avoid.

That is an operating model failure. And under that failure, I kept seeing the same three cracks.

First, the governance illusion.

On paper, governance looks solid. There are policies, committees and RACI charts. In reality, the core business data ( customers, products, contracts, incidents ) flows through systems with no proper quality checks and no single person clearly accountable when it drifts. The document says “this role is responsible.” The actual data shows that “no one is.”

Second, the broken community.

The Community of Practice that is supposed to connect IT, data and business has fallen apart, or never really existed. Business users experience governance as extra forms, extra fields and extra meetings, with no visible benefit. So they ignore it. From their perspective, they are right. Governance has mostly delivered bureaucracy, not better outcomes.

Third, the HQ versus delivery‑centre disconnect.

HQ sets policies and wants discipline. The offshore engineering and AI teams are paid to deliver features and models at high speed. They work on the same data but live on different clocks and are judged by different metrics.
One is rewarded for saying “no” until the risk is understood.
The other is punished for saying “no” because it slows down delivery.
Without a clear way to connect them, they talk past each other and ship incompatible decisions into the same environment.

When you remove the layer of people who used to bridge those three cracks - usually experienced middle managers who understood both the business and the data - the whole structure starts to fail in visible ways.

Deloitte’s 2026 State of AI report shows the same picture in numbers: nearly three‑quarters of companies plan to roll out agentic AI in the next two years, but only one in five currently has a mature governance model for those agents. In other words: we are adding more autonomous systems on top of a governance layer that is already too thin.

Privacy and AI governance experts at the IAPP keep flagging the same operational gaps: who is actually accountable, how training data is sourced and documented, how automated decisions are explained, who owns incident response, and how cross‑border data flows are tracked.
These are not “nice to have” controls. They are the basics. And they are exactly the things that break when you strip out the human layer that used to improvise fixes between policy and reality.

This is why your governance program stalls even when people are trying hard.

The effort is real. The capacity you (not so) quietly removed is no longer there.

You cannot buy your way out of this either

The obvious answer is to go and hire the people you need. Yet, it will not work.

Verifywise's May 2026 AI Governance Salary Report found that demand for AI governance roles grew 150 percent in a single year. By late 2025, more than 14,000 positions were open and unfilled. The people to fill them do not exist yet. At least, in sufficient numbers.

So companies do the next obvious thing. They call a consulting firm - an Artefact, an Accenture, a McKinsey - to produce an AI governance strategy. Then they hire an interim manager to run it. That interim walks into an organisation where the internal data governance team already exists on paper: they have the title, they attend the meetings, they write the presentations. What they do not do is walk into a business unit, sit down with the people who actually use the data and build the kind of trust that makes data ownership real.

So you end up with MDM tools nobody really uses. Policies nobody really follows. A community of practice that meets once a month and produces minutes of the meeting. And with a business that still does not know who actually owns its customer data.

The external strategy layer does not fix this. It adds more documentation on top of the same broken foundation.

PwC's 2026 AI Performance Study surveyed 1,217 executives across 25 industries and found that 74 percent of all AI value is being captured by just 20 percent of companies.
The difference was not which models they chose, or how big their AI budget was.
The companies capturing that value did not BUY their way there. They BUILT it internally before they scaled.

EY is the case study in what happens when you do not. In May 2026, GPTZero researchers found that a published EY Canada cybersecurity report was full of citations that either did not exist or pointed to pages that had never contained the information cited. More than half the sources were fabricated. EY pulled the report.

The model generated convincing-looking garbage. Nobody inside EY caught it before it went out. That is what “governance on paper” looks like when it meets a real deadline - even inside the firm that audits other people’s controls for a living.

What can be done

Not everything. But three moves are still inside the window (August 2, 2026), and none of them start with a strategy deck.

Assign governance by pain rather than title.

The first failure mode in every stalled governance program is identical: data ownership is assigned to whoever has “Data” in their job title, not to the person who absorbs the pain when the data is wrong. Those are rarely the same person.

The immediate move is to identify the three to five master data domains causing the most downstream AI failures and assign ownership to the business unit leader whose team is actually suffering the errors.
Not based on org chart position. Based on who feels the cost of the problem.

That conversation is uncomfortable. It is also the only one that produces a real data owner rather than a slide-parrot with a governance mandate and no real accountability when it fails.

Rebuild the community of practice around proof of value.

The broken CoP cannot be relaunched with a new name and a kickoff meeting. Business users disengage from governance programs when governance means administrative burden with no visible return.

The fix is a ten-person cohort: find the stakeholders actively suffering from poor data quality right now, solve one specific pain point for them in under thirty days. Use that result to bring the next group in.

Governance as utility, not compliance theater. The community reforms around demonstrated value. Or it does not reform at all. And if it does not reform, no framework document, no external vendor, no interim manager fixes the broken incentive structure underneath.

Implement risk corridors before the AI delivery team bypasses you entirely.

The most predictable failure mode in the HQ-versus-delivery-center dynamic is shadow IT. The offshore AI team, blocked by slow governance, routes around it. By the time HQ discovers what was built on ungoverned data, it is in production and touching customers.

Risk corridors prevent this without stopping velocity.
Low-risk internal data gets fast-tracked to the AI team.
Medium-risk data gets automated controls.
High-risk data - financial records, customer PII, anything in scope for the August 2 transparency requirements - requires validated data owner sign-off before the AI team can scale its use.

The HQ VP gets the guardrails. The AI VP gets to ship.

These three moves do not fully resolve the paradox. The paradox is structural and the date is fixed. But they limit the immediate liability risk while the longer rebuild is designed. And they work with the people you actually still have, not the governance team you were supposed to hire.

The one test

The falsification test is this:

Find me an enterprise that eliminated 20+ percent of middle management in 2025-2026 and has a live, board-ratified AI governance program.
With documented data lineage, model accountability records and named incident response owners.
And operational before August 2026.
Not a roadmap. Not a working group. Operational.

If that enterprise exists at scale, the paradox is wrong.

If you are an operator who has lived this: tell me where it breaks.

My final ask

These Signals come from conversations I am having with executives right now, just written down.

If this one helped you see something you had not named yet, do two things.

And if you want to support the work directly:

Buy me a double espresso

Connects to:

TL;DR

The article makes five claims that matter.

Claim 1: The EU deliberately kept the December 2, 2026 synthetic-content traceability deadline while pushing heavy high-risk obligations back to 2027 - that asymmetry tells you where enforcement energy lands first.

Claim 2: Provider logs already create a chain of custody before any watermark is deployed - the artifact trace is the second layer, not the first.

Claim 3: Civil litigators, employers and rights-holders will activate that infrastructure before intelligence agencies do. Employers through direct tenant access, litigators through ordinary civil discovery.

Claim 4: The “EU built a dissident registry” framing is wrong - Article 50 mandates system-level provenance, not user-ID embedding, and GDPR actively works against personal-data watermarking.

Claim 5: Anonymity in AI is now an economics problem - exiting the traced stack requires hardware, zero-data-retention contracts or legal muscle that a retail subscription cannot buy.

Last week, the EU’s Digital Omnibus deal pushed major high-risk AI obligations for many Annex III systems from August 2026 to December 2027, with some Annex I product-linked obligations moving to August 2028.

In the same package, Article 50’s synthetic-content transparency rules stayed on a hard track, with machine-readable marking and disclosure obligations tied to December 2, 2026.

Most people will read that as relief.

I read it differently.

Brussels gave companies more time to sort out the slow, ugly governance work around high-risk workflows. At the same time, it gave AI providers less time to make generated content traceable.

One clock moved back. The other started ticking louder.

That matters because AI watermarking sounds like a niche technical feature. It is not. It is the start of a new chain of custody for synthetic content.

What AI watermarking is

AI watermarking is a machine-readable signal embedded into AI-generated text, images, audio or video so another system can detect that the output was artificially generated or manipulated. In image systems, that increasingly sits inside provenance stacks such as C2PA content credentials, which attach signed metadata about the origin and modification history of a file.

The important point is simple:

OpenAI said in 2024 that images from its tools would carry C2PA metadata and Google’s SynthID watermarking technology, which is exactly the direction regulators want the market to take. The EU AI Act’s Article 50 now gives that direction a deadline. December 2, 2026.

What Article 50 actually does

Article 50 is a transparency rule.

Providers of AI systems that generate synthetic audio, image, video or text content must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Deployers of deepfakes must also disclose the artificial nature of the content to end users in the cases covered by the Act.

That is the legal spine.

And here is the first correction to the lazy civil-liberties take.

Article 50 does NOT require a provider to stamp your passport number, customer ID or legal name into every image or paragraph you generate. The rule is about content provenance at system level - proving the artifact is synthetic - not mandatory public identity tagging.

GDPR pushes in the same direction. Embedding personal data into every circulating artifact would collide with data-minimization and purpose-limitation principles unless a provider had an unusually strong legal basis for doing it.

So the simplistic story of “the EU just built a dissident registry” is weak.

The real story is actually worse.

Because the trace does not start with the watermark.

It starts with the logs.

The trace already exists

Every call to a major AI service is already a structured event.

OpenAI retains API prompts and completions for about 30 days by default for abuse monitoring and operational purposes, with zero-data-retention available only for eligible customers under special conditions. Azure OpenAI keeps abuse-monitoring data on roughly the same horizon unless a customer gets approved for modified abuse monitoring. Anthropic reduced Claude API log retention from 30 days to 7 days in September 2025, with flagged content retained up to 2 years and abuse-score metadata up to 7 years.

That means the server-side trace is already there.

Who called the model. When they called it. Which tenant they belonged to. Which safety systems fired. In many cases, the prompt and the output themselves.

Watermarking adds the second trace.

One trace lives inside the provider.

The other travels with the artifact.

Put those two together and AI output starts to behave like evidence.

The control layer always arrives dressed as safety. Then audit, legal and procurement wire it into everything. Quietly. Thoroughly. Permanently.

Why courts matter more than spies

Most people would jump straight to “intelligence agencies”.

No.

The first aggressive users of this infrastructure are more likely to be litigators, employers, rights-holders and internal investigators. We already have a working proof of concept. In 2025, a U.S. federal court ordered OpenAI to preserve consumer ChatGPT and API content beyond its normal 30-day deletion window as part of the New York Times copyright lawsuit. OpenAI contested the order, the hold ran from June to September 2025, and the data was not actually handed over.

But the mechanism worked exactly as described: a civil lawsuit activated a legal override of the provider’s standard retention policy. The data was frozen. The question of who gets to see it is now a matter of further litigation, not provider policy.

The employer case is more direct than any litigation. Most enterprise AI tools run inside a corporate tenant - Microsoft 365 Copilot, Azure OpenAI, Salesforce Einstein, ServiceNow.

The employer is the deployer. They own the audit logs. They can query which prompts were sent, by which employee account, at what time. No court order required. No subpoena. Just an IT admin with the right permissions and a reason to look.

That has a specific consequence most employees have not thought through.

Whistleblower protections are real - in law.

But they were designed for a world where the employee controls the record: the printed document, the personal email, the private conversation. In a corporate AI tenant, the generation event is logged before the artifact ever leaves the system. The employer has architectural access to the draft before the employee decides whether to send it. Legal protections exist somewhere later. The exposure happens the moment employee starts drafting.

That matters because civil discovery is trivial. It does not need a special national-security theory. It just needs a lawsuit, a subpoena and a provider that holds useful records.

So the new causal chain looks like this.

Article 50 pushes providers to mark synthetic output. Providers already keep logs that tie output generation to accounts and tenants for days or weeks by default. Courts and investigators can reach those logs through ordinary legal process.

That is the real shift.

Where the economics bite

Now the uncomfortable part.

The people who keep meaningful anonymity in the next phase of AI are not simply the most “tech-savvy.” They are the people who can afford to leave the cheap stack behind.

Mainstream usage is cheap because someone else runs the model, stores the logs and increasingly marks the output. Consumer subscriptions cluster around low monthly price points, and multiple cost comparisons find that for small teams and normal usage levels, API access stays cheaper than self-hosting once hardware, power and engineering time are included.

But the private path costs more.

Running open-weight models locally or in a controlled environment means buying hardware, accepting more friction and carrying the operational burden yourself. Analyses of self-hosting economics in 2026 show break-even against premium hosted APIs typically appears between 5 and 50 million tokens per month depending on model tier, and only after absorbing GPU, power and engineering overhead.

So yes, this is technical.

It is also economic.

A real privacy posture in AI now requires one of three expensive things:
hardware you control,
contracts you can negotiate or
legal sophistication strong enough to constrain what the provider keeps.

OpenAI, Azure and Anthropic all present stronger retention controls as exceptions for eligible or approved customers, not as the retail default.

That creates a three-tier system.

At the bottom sit retail users and small creators:

Cheap tools. Full provider control. Growing artifact traceability.

In the middle sit large enterprises:

They have enough volume and procurement muscle to ask for zero-data-retention, modified monitoring and private deployment terms.

At the top sit actors with their own compute:

They decide what gets logged, what gets marked and what leaves the box.

That is where the real divide sits.

Not between people who use AI and people who reject it.

Between people who can pay for opacity and people who rent legibility.

The steelman - and why it still leads here

The strongest counterargument is straightforward.

Watermarking and provenance are necessary. Without machine-readable traceability, deepfakes, synthetic fraud and manipulative political media become harder to detect at scale. That is true.

I maintain that point.

A world with no provenance is a gift to scammers.

But the price of provenance is not neutral.

The better the provenance layer gets, the more expensive anonymous creation becomes. Large firms can absorb that price. States and organized criminals can route around it.

This is why the regulatory story matters far beyond Brussels.

The EU did not invent the surveillance substrate. The vendors already had one in their logs. Europe just gave the artifact side of that substrate a deadline.

The 90-day collapse points

Two claims in this article are predictions, not facts. Here is how to test them.

First test.

By September 1, 2026, at least one publicly reported legal case - civil litigation, employment dispute or rights enforcement action - explicitly cites AI provider logs or watermark metadata as evidence or the subject of a discovery request, beyond the existing NYT preservation order. If that happens, the “courts before spies” mechanism is activating at scale. If no new case surfaces by September, the NYT case remains an isolated proof of concept and the timeline is slower than my article implies.

Second test.

By September 1, 2026, at least one of OpenAI, Azure or Anthropic announces zero-data-retention as a default setting for all paid tiers, not an approved exception. If that happens, the economics argument weakens - the cost of opacity drops to the price of a subscription. If it does not, the three-tier structure holds and the gap widens.

The conclusion is uncomfortable and simple.

Europe delayed the hard part of AI governance for many companies. Europe kept the deadline for synthetic traceability.

Most people will pay for convenience.

But convenience comes with a traceable trail.

Before you close the article

These Signals reflect conversations I am having with executives right now, just written down.

If this helped you see your organization’s blind spots more clearly, do two things.

TL;DR

The article makes four claims that matter.

Claim A: Frontier models are structurally biased toward sponsor interests when monetization is active.

Claim B: The contractual wall between consumer and enterprise tiers will erode as ad revenue becomes structural.

Claim C: Enterprises are not building the governance architecture needed to treat upstream models as untrusted.

Claim D: The people capable of watching AI seams are invisible to organizational reward systems.

Last week I read this report - “Ads in AI Chatbots? An Analysis of How Large Language Models Navigate Conflicts of Interest”. A group of researchers from Princeton and Washington Universities ran controlled experiments on 23 frontier models. They found out that “almost all models recommend sponsored options over cheaper, non‑sponsored ones,” with all but five choosing the more expensive sponsored product more than 50 percent of the time.

Their paper is explicit:

The public backlash was too brief and not loud enough.

What you probably missed (because I certainly did), is that ChatGPT US ads pilot crossed the $100 million annualized revenue within six weeks of launch” , according to Reuters. That’s $24 million in six weeks. From a chat interface.

That was February. By April, OpenAI told investors it expects $2.5 billion in ad revenue this year - scaling to $100 billion by 2030. Advertising is now a named line in investor presentations. Not a pilot. Not an experiment. A business model.

A business model that needs $100 billion in ad revenue by 2030 is not one that treats user neutrality as a design constraint.

OpenAI draws a hard contractual line for enterprise customers. Enterprise and API tiers do not run ads. The separation is real.

But the model weights are shared. You cannot inspect whether months of ad-optimization shaped the underlying model's dispositions. And the contractual wall is enforced by the same provider that now needs $100 billion from advertisers.

So, enterprises can trust AI, right?

What “trust” can rationally mean for enterprise

“Trust the AI” is the wrong question.

The only rational question is:

For enterprise, that breaks into four questions.

Will the model learn from my data or leak it?

For OpenAI and Anthropic, business and API tiers do not use your data for training by default. Retention limits exist. Opt-out paths exist. If you stay on the right products and keep everything off consumer endpoints, the data problem is solved at the policy level.

Not perfectly. But, well, solvably.

Whose interests is the model actually serving?

This is where my initial question returns.

The contractual separation is real. Enterprise tiers don't run ads. But the weights are shared across tiers. You cannot inspect whether months of ad-optimization left a trace in the model's dispositions. You are trusting a policy enforced by the same provider now running hundreds of advertisers through hundreds of millions of free users.

Call it what it is: an accurate description of the risk.

Can you control what the model does at your boundary?

Yes - but only if you build for it.

Governance platforms like IBM watsonx.governance, Credo AI and OneTrust let you define allowed behaviors, track model usage and catch drift.
Infrastructure gateways like Bifrost intercept every AI request - enforcing access controls, spend limits and audit logs - at roughly eleven microseconds of overhead. Governance does not have to slow you down. But it has to be built deliberately.

Who is liable when it goes wrong?

You are. Not the model vendor. Regulators and courts go after the company that deployed the system. EU AI Act fines reach 35 million euros or 7% of global turnover. You cannot outsource that exposure even if the bias originated upstream on the model level.

There is a harder problem the architecture alone cannot fix.

The people capable of building that control plane.
The ones who can see across engineering and legal, software and compliance, API infrastructure and business risk.

They are not measured by either system. Regulators count documents. Companies count speed and cost. Neither has a category for the person who can see the AI chain as one coherent and complete object.

So even when a company accepts this logic and builds the governance layer, the people doing that work operate against the grain of what their organisation knows how to reward.

You can’t even call it a culture problem. Because it is a structural gap.
I wrote about it in more detail here:

It runs through the enterprise the same way the gap between regulation and reality runs through the EU AI Act itself. Both sides are working hard inside frameworks that were designed for something simpler than what they are now trying to govern.

So what are your actual options?

Given documented bias in frontier models and sponsor or state incentives, four paths exist. They are not mutually exclusive.

Option 1: Use enterprise-grade proprietary models, but govern them hard.

You treat OpenAI and Anthropic as black-box vendors. You only use their business products and APIs - where your data is off training by default, retention is bounded and ads are not part of the product. Consumer ChatGPT never touches an enterprise workflow. Contractually, you prohibit ad insertion, third-party data sharing and use of your prompts for model improvement.

On top of that, you route all traffic through a governance gateway - Bifrost or equivalent - so every prompt and response passes through your own infrastructure. You classify data, redact sensitive fields, set spend limits and generate audit logs. You then connect this to a lifecycle platform like Credo AI, IBM watsonx.governance or OneTrust, which tracks every AI system you run, maps it to regulatory requirements and monitors behavior continuously.

This option accepts you cannot see inside the model. It relies on three things instead: policy guarantees on your data, contractual constraints on monetization, and your own technical controls on what leaves your perimeter.

It works when the capability of top-tier models justifies the residual opacity.

Option 2: Host the model yourself.

You decide that any frontier provider’s incentives are unacceptable. You want the weights. That means deploying open-source LLMs in your own cloud tenancy or data center. Or buying closed-source models that run in isolated instances with no provider-side training. You fine-tune on your domain data under your own privacy rules. You still pair this with governance tools, because a private deployment does not remove hallucination risk or internal bias.

The upside: no third-party ad inventory, no state-level data exposure, no monetization layer you cannot see.

The downside: you now own model operations, evaluation and security.

Most enterprises underestimate this. And what they underestimate is not the technical complexity - it is the positional rarity. Running a private model stack properly requires people who sit across engineering, governance and business risk at the same time. Those people exist. They are just positioned wrong in almost every org chart - rewarded by neither the speed metric nor the compliance audit, and visible only when something breaks.

Option 3: Treat all upstream models as untrusted. Build a control plane that assumes this.

This is where most serious enterprises end up in 2026. You accept that every upstream model - even enterprise-grade - is a component you do not fully control. So you route all traffic through a gateway that can switch between OpenAI, Anthropic, a private model, or any combination, based on policy and use case.

No single provider can hold you hostage to its failure modes.

You keep your knowledge and decision logic in layers you own: a RAG pipeline over your own vector store, deterministic rules for pricing and compliance, the LLM used only as a language engine over your trusted data. Governance platforms sit above this and watch what each model does across all providers - catching drift, flagging divergence, enforcing policy.

This does not fix the model. It shrinks the surface where the model’s own incentives and bias can operate. If a model is biased toward sponsored options in consumer contexts, your gateway simply does not send sponsor-adjacent tasks to that model. Or it sends the output to a second model for verification before anything leaves your perimeter.

Option 4: Use governance as a procurement filter, rather than a runtime tool.

Whatever mix you choose above, governance starts before deployment.

Modern platforms support third-party AI governance: structured workflows to assess external vendors, map them to regulations and track your obligations over time.
A vendor that monetizes via ads gets marked “consumer product - prohibited.”
An enterprise API gets marked “conditionally allowed under these constraints.”
Those decisions get enforced technically at the gateway, not simply documented in a policy PDF.

This is how you operationalize the intuition that you cannot fully trust AI. You assume it is not trustworthy. You build a system that behaves correctly around it.

Where this logic still has gaps

Let’s be honest about what we don’t know.

There are no large-scale, independent audits of enterprise API endpoints for ad-like bias. The Princeton/Washington study tested models under sponsorship prompts - general and consumer-facing contexts. No equivalent study has tested whether OpenAI’s enterprise API injects sponsor-favoring behavior into a bank’s private customer-service workflow. That evidence does not exist yet. The absence of proof is not proof of absence.

We also have no long-term data on how often enterprise deployments accidentally leak data or misconfigure training protections. Security researchers and consultants document specific cases - memory-related exposures, misconfigured logging, third-party SaaS integrations that bypass API policies.

But there is no systematic picture. That gap does not go away with better architecture. It shrinks. You manage it, you do not close it.

So here is the more honest summary.

That is the line between paranoia and negligence.

And right now, most enterprises are nowhere near it.

Before we get to signals - a four questions survey. It takes 30 seconds to answer.

Take a 30 sec survey

Signals to watch

An enterprise AI failure gets blamed on governance, not the model

Every public AI failure today is still framed as a hallucination - a model defect, the vendor’s problem. That framing is starting to crack. Sullivan & Cromwell’s own post-incident analysis called it a supervision failure: policies existed, were not followed.
A French court rejected AI-drafted submissions as a legal competence failure, not a technical one. Forbes put it plainly: “the lawyer did not catch the hallucinations - therefore the lawyer committed a human error.”

The reframing has reached legal practice. It has not yet reached a bank, insurer or hospital where the question is which tier was used, whether an audit trail existed, whether a consumer endpoint was running in production. Watch for that case. When it arrives, “the model hallucinated” stops being a defence.

Regulated-sector RFP bans third-party model training

The controls are already arriving - through data sovereignty clauses, third-party risk frameworks, contractual documentation requirements. UK financial regulators now require banks to document all third-party AI dependencies contractually, with full enforcement from March 2027.

But no public RFP has yet named it directly. Watch for the moment a bank, insurer or hospital puts “no provider-side model training” in writing as a hard requirement. When implicit distrust becomes explicit policy, the signal has fired.

The governance role gets absorbed by compliance

AI governance is a rapidly growing new tech role in 2026. The hiring wave is real. But the roles are landing inside legal and compliance teams - not across engineering and business risk simultaneously.

That is the tell. Managing the seam from inside one frame is not the same as watching the seam from across two. Watch for whether “AI governance” solidifies as a compliance function or breaks out into something that covers both sides. If it stays inside compliance, the problem described in this article is being managed, but not resolved.

One last thing

These signals reflect conversations I am having with executives right now. Just written down.

If this helped you see a blind spot more clearly - forward it to the person in your organisation who is about to make a one-way decision about AI. They probably haven't read the Princeton study. They probably missed the Reuters number. And they are almost certainly not thinking about which tier they are using.

Share

TL;DR

The EU AI Act regulates boxes. Real enterprise AI lives in the wiring.
When the first cross-system AI decision fails, no single regulator or log will be able to reconstruct what happened in the seams.
Regulation won’t save you from the liability.
Your only defence is building an internal gamekeeper layer now:
map your AI handoffs,
write cryptographic logging into your vendor RFPs,
and stop firing the QA and compliance teams you need to control the drift.

The EU AI Act becomes enforceable for most high-risk systems on August 2, 2026.

Regulators describe it in familiar terms. Classify your system. Keep logs. Be transparent. Keep humans in the loop. Prove robustness. File the paperwork. Done.

Yet, it is NOT done.

The frameworks describe a world of clean, isolated AI systems sitting neatly in their own compliance boxes.

The world being built is a chain of connected systems passing AI-assisted decisions from one to the next, across agencies, companies, borders and cloud providers.

I don’t want to sound like a doomsayer. I simply want to describe how disastrous it can be.

Not the law - the gap between the law and reality. And what every company must build now, regardless of how Brussels resolves its endless Omnibus negotiations.

We’ve seen this before

The EU AI Act is not the first time a major initiative has bought artefacts instead of capability.

In “The AI Readiness Cult” I wrote about how enterprises convinced themselves that buying AI tools, running pilots and publishing AI strategies was equivalent to being ready. It was not. Most pilots never reached production. Most strategies collected dust. The artefacts multiplied while the capability stayed unchanged.

The EU is repeating the same mistake, only at a regulatory level.

It has GAIA-X labels. It has the Data Spaces Support Centre (DSSC) blueprints.
It has a French DINUM catalogue of 114 sovereign AI solutions spread across seventeen functional categories that, as Kevin Brown pointed out in April, contain no word for governance, evidence, audit, or drift.
It has a Cloud Sovereignty Framework that defines SEAL levels for data sovereignty and operational resilience.
It has the European Health Data Space regulation, which creates formal channels for cross-border health data sharing.

None of these “walk the land”.

In “The Sovereignty Nobody Asked For” I showed how EU cloud sovereignty was producing €67 billion in announced investment for 2,800 projected jobs, while only 36% of actual enterprise workloads genuinely required sovereignty-grade controls. The rest were paying a sovereignty premium they did not need, for infrastructure that was not yet proven.

The underlying cause is identical: confusing bureaucratic artefacts with operational reality. In cloud, we bought expensive labels instead of mapping actual data risk. In AI governance, we are doing it again. Frameworks. Labels. Catalogues. Committees. Procedures. All of them provide the appearance of control, with zero mechanical ability to look inside a running AI system, see what it is doing, understand why and stop it when it goes wrong.

The problem in plain language

Let’s take a simple example. Imagine a decision that touches four systems.

A tax agency uses an AI tool to help draft a ruling on a complex case. That ruling feeds into a benefits calculation. The benefits decision triggers a social services eligibility review. The review pulls health information from another country through the European Health Data Space.

Somewhere in that chain, one system starts to drift. Not catastrophically, nothing that flags red in its own logs. Confidence scores still look acceptable. The output distribution has shifted quietly over eighteen months of use. The drift does not surface inside that system. It compounds as it moves through the chain, each downstream system treating a slightly-off input as authoritative, until the error surfaces four steps later as a wrongly denied benefit, a refused visa, a cut in health support.

The citizen challenges the decision.

A regulator asks: what happened? Which model version was running? What data did it use? Which version of the rules was it applying? Who approved this step? Under which article of the law was this action authorised?

Each system can probably show its own logs.

The logs record that something happened. They do not record whether it was authorised to happen, under which version of which rule, at which point in the model's drift curve.

Let me restate this again.

Under the current AI act framework NOBODY CAN SHOW THE CHAIN.

Each system meets its own obligations. The coupling between systems belongs to no one.

Kevin Brown’s April article called this “gamekeeper vs manager governance.” The manager writes procedures after the fence breaks. The gamekeeper walks the land and catches the drift before it becomes a breach. The EU has built a regulatory framework full of managers. The gamekeepers - the people and systems that watch the seams - are mostly absent.

He is right. And yet the problem is deeper.

Why the regulation cannot fix this on its own

The AI Act is structurally built around individual systems:

• Article 12 requires “automatic recording of events”, but does not define tamper-proof mechanisms or cross-system evidence composition.

• Article 13 requires transparency, but points at the deployer of each system, not at the coupling between systems.

• Article 14 requires human oversight, but does not ask whether the humans capable of that oversight still exist after AI-driven efficiency cuts took out the QA and compliance teams.

• Article 26 requires deployers to cooperate with authorities, but does not define a shared evidence schema across multiple deployers in multiple countries.

This reflects an assumption that AI systems are standalone objects you can regulate one at a time.

The European Health Data Space compounds this. EHDS creates formal, legal cross-border health data flows. Which is good.
But it does not define how the AI governance artefacts (evidence chains, policy snapshots, decision rationales) must travel with the data, compose across systems and be readable by multiple regulators on both sides of the exchange.

The Cloud Sovereignty Framework evaluates cloud providers as standalone entities meeting data sovereignty and operational criteria.
It does not define how evidence composes across two sovereign-cloud systems when an AI agent in Cloud A passes a decision to an agent in Cloud B.

The sandboxes are the closest thing to a live gamekeeper.
Spain’s sandbox already runs 12 high-risk systems under regulator supervision. Member states must have at least one sandbox live by August 2, 2026.
But sandboxes watch pilots in controlled conditions. They do not yet operate as permanent, pan-European live monitoring across production systems.

The intent is there alright. The gap is in architecture. While regulation governs isolated boxes, incidents will happen between those.

Early gamekeepers do exist, but..

Quick note: I have no relationship with any of the companies named below, and I do not represent them in any way. They are illustrations of what is being built, not endorsements. There are other credible tools I am not naming here.

I need to say this clearly: serious people at serious companies are building serious tools.

LangSmith, from the LangChain team, traces every LLM call, every tool invocation, every reasoning step an agent takes and maps that trace to AI Act obligations: risk management (Article 9), logging (Article 12), transparency (Article 13), human oversight (Article 14), robustness (Article 15). It captures the full execution graph so you can inspect exactly what an agent did, when, with which data and under which configuration.

AccuKnox treats runtime AI governance as an extension of Zero Trust security. It ships a prompt firewall, egress controls, behavioural monitoring and continuous logging of what ran, what was blocked and which policy fired. It’s enforced in Kubernetes at the point of execution, not in a policy document filed somewhere.

VeritasChain Protocol (VCP v1.1) is built for algorithmic and AI-assisted trading. It chains together timestamps, model versions, decision factors and outcomes with SHA-256 hashes and signatures. So any later change to a record is mathematically visible. It maps directly to Article 12 of the AI Act, MiFID II timestamp obligations and EU evidence-preservation requirements.

Separately, a 2025 analysis on cryptographic audit trails for the AI Act reaches the same conclusion: Articles 12, 15 and 73 together make tamper-evident logging the only rational choice for serious operators, even though the Act does not explicitly mandate it.

These are real gamekeeper moves. Runtime control. Cryptographic evidence. Auditability built into execution, not bolted on afterward.

But every one of them stops at the boundary of a single organisation or a single stack. LangSmith can show everything that happened inside your agent. It cannot trace what happened when your agent's output became the input for a system you don't own, in a country whose regulator speaks a different evidentiary language.

This is the hole. Or an opportunity.

For builders the “compliance-native” window is closing

Product with Attitude

Are You a Vibe Coder? Don’t Ship Straight Into the Provider Trap

Read more

2 months ago · 104 likes · 28 comments · Karo (Product with Attitude)

Karo Zieminski’s article on “compliance-native” building is the best plain-language map for founders in this space. Read it before you ship.

Her “provider trap” is real. If you build a product that wraps a frontier model (GPT, Claude, Gemini, Mistral) and you sell subscriptions to EU users, you became a provider under Article 3 of the AI Act the day you shipped.
Not a user. A provider. That comes with obligations for risk classification, documentation, logging, transparency and conformity assessment that most founders have never read.

In "The Vibe-to-Bankruptcy Pipeline" I showed how agents scale like labour, not like SaaS. Costs grow with every task the agent performs.
Regulators will add a second meter on top: each high-risk decision may require logging, evidence, human review. If you do not design the gamekeeper layer from day one, regulation fine will land on top of an already unsustainable cost curve.

Compliance-native means:

• Classify what your system does before you ship, not after a regulator asks.

• Build logging and oversight into the first version. It does not need to be cryptographic on day one. It needs to be real.

• Design a kill switch. Know how to stop the system, not just pause the API.

• Treat EU users differently if your product touches high-risk categories: employment decisions, credit, health, education, critical infrastructure, law enforcement adjacency.

Sounds bureaucratic? Maybe. But it is about “NOT building a liability trap with a subscription model on top”, nothing else.

Three things that do not yet exist and must be built

1. A shared chain-of-evidence backbone

VeritasChain shows the pattern for trading. The same pattern must exist for the administrative chain: tax → welfare → health → justice.

This means a common event model for AI-assisted decisions across agencies, cryptographic sealing that works across organisational boundaries. And query tools that let regulators (AI Office, DPAs, EHDS bodies, sector regulators) access the same incident graph without re-exporting files in four different formats.

Infrastructure, not a dashboard. The financial system has SWIFT for message exchange, ISO 8583 for payment formatting, TARGET2 for settlement. EU AI governance has none of these equivalents for cross-system evidence.

Whoever builds it - private consortium first, standard body later, regulator mandated eventually - will own the backbone of AI compliance in Europe for decades.

2. A procurement mandate with real teeth

The French CSNP noted in March 2026 that the country's public instruments remain “imperfectly adapted” to guide enterprise AI adoption. This diagnosis applies directly to procurement standards.

Between now and the first serious tribunal case, every AI system going into a public-sector procurement will either require gamekeeper-grade evidence capabilities or allow “adequate governance” to pass. Soft verbs in procurement documents produce soft evidence in courtrooms.

What must be in every serious public or enterprise AI procurement spec, starting now:

• Per-decision execution traces, exportable in a named schema, including model version, inputs, tool calls, outputs and the legal rationale for the action.

• Policy-as-code enforcement. The system must be able to show which policy rule governed each action, not that “a governance policy existed.”

• Runtime drift monitoring with defined thresholds. Not “monitoring shall be performed” but “if output distribution shifts beyond X, the corridor closes.”

• Fail-closed behaviour. When any governance check fails, the system stops. It does not log and continue.

3. A governing body for the seams/connections

Each system has a regulator. Nobody yet owns the couplings.

EHDS has access bodies. The AI Act has market surveillance authorities. GDPR has DPAs. Sector regulators cover finance, health and critical infrastructure.

None of them is chartered to govern what happens when an AI decision crosses from one domain to another.

The missing institution is something like a cross-domain AI incident authority.

Think of it as the NTSB model applied to AI: triggered by serious incidents, technically equipped, multi-jurisdictional, designed to produce structural findings, to beyond just sanctions.

What every enterprise can and must do

Do not wait for the Omnibus to settle.
Do not wait for the August deadline to clarify.
Do not bet on the delay.

The regulatory uncertainty does not change the operational risk. If one of your AI-assisted decisions is challenged, you will be asked to show your work. If you cannot, the regulatory gap is irrelevant, the liability is yours.

Map your internal seams

This is the step most enterprises skip. Every company is already a coupled AI system. Your customer service agent feeds your CRM. Your CRM feeds your credit risk model. Your HR tool feeds your payroll system. Map every handoff where an AI output becomes another system’s input. For each one, decide: does this need a human checkpoint? Does this need a trace? Is the decision reversible if it is wrong?

In “One-Way Doors Disguised as AI Strategy” I showed how enterprises are walking through irreversible decisions without knowing it. Your AI seams are the most dangerous one-way doors in your architecture right now. Once you have automated a chain of consequential decisions, reversing it is much harder than you think.

Build a minimal Production Layer

It is the operational link between your AI capabilities and your actual business processes: the guardrails, the approval paths, the monitoring, the rollback procedures. Most enterprises have the capabilities, while missing this layer.

For regulatory self-defence, the Production Layer needs one thing above all: typed corridors.

Define which AI actions are low-risk and can run fast, which are medium-risk and need logging, and which are high-risk and need a human in the loop.
That classification does not require cryptographic infrastructure on day one. It needs a decision and a document that survives a regulator’s question.

Rewrite your RFPs

Stop accepting “AI Act compliant” as a vendor attestation. It is not a testable claim. Replace it with three specific technical requirements:

1. Evidence: “Provide per-decision execution traces in a structured, exportable format, including model version, prompt, tool calls, output and decision rationale.”

2. Control: “System must support kill switches, policy enforcement at the tool-call level, and human approval hooks for defined high-risk actions.”

3. Cost and blast-radius visibility: “Provide token usage breakdown and rate-limit controls per agent and per workflow.”

Any vendor that cannot meet these three requirements is selling you a liability, not a product.

Protect your gamekeepers

In “AI Workforce Sabotage” I showed that 29-44% of employees are actively or passively resisting AI rollouts because the redeployment story is empty. The same dynamic is now hitting compliance and QA teams. Boards are cutting them in the name of AI-driven efficiency gains, at exactly the moment those people would be the internal gamekeepers who understand the seams.

Article 14 of the AI Act requires meaningful human oversight. That oversight does not exist if the humans who understood the system have been replaced by the system they were supposed to supervise.

Do not let AI productivity narratives hollow out your oversight layer. Redeploy those people as internal governance leads, “corridor owners”, drift monitors. They already know where the fences are.

The only test that matters

There is only one signal worth watching before August 2, 2026.

Not a sandbox. Not a framework document. Not another catalogue.

A working, cross-system evidence layer. With shared schemas, cryptographic chaining across organisational boundaries, query tools that let more than one regulator look at the same decision chain without trying to make sense out of different reports in different formats.

If a private consortium, a sector body, or a national administration announces that kind of infrastructure project before the first enforcement deadline, the gamekeeper pattern is entering the system. Even before regulators mandate it from above. That is how SWIFT started. In 1973, 239 banks from 15 countries created a cooperative to solve a shared interoperability problem that no single regulator had mandated. The law caught up later. The solution came first.

If nothing like that appears by August 2, the seams remain ungoverned. The regulation will be live. The infrastructure it silently depends on will not exist.

The first serious incident will be the test that nobody prepared for.

My final ask

These Signals are the conversations I have with executives before the decision gets made, written down so others can use them.

Credits and acknowledgements

Kevin Brown’s April 20, 2026 article “Gamekeeper governance vs manager governance: why EU AI compliance will fail its first real incident” identified the core architectural flaw in EU AI governance frameworks.

Karo Zieminski’s Substack piece on “compliance-native building” is the clearest practical guide for founders navigating the provider trap.

Both are worth reading in full.

Disclaimer: nothing in this article is legal advice, investment advice or a product recommendation. No financial or commercial relationship exists with any vendor or tool named here. They are illustrations of what early gamekeeper patterns look like in practice.

TL;DR

The AI pilots create an efficiency narrative. But employees are actively sabotaging AI output and efficiency, as it threatens to replace them.
Executives stay silent about job survival because the stock market pays for headcount cuts, not redeployment.
That silence destroys the technology investment.
The only way to secure the promised returns is a hard and verifiable workforce redeployment clause.
Leave the social contract blank, and workers will fill it with sabotage.

This is the fourth and final Signal in a series on where enterprise AI actually dies.

1. The last mile mapped the missing Production Layer.
2. Productivity layoffs mapped the structural incentive to cut headcounts rather than redeploy.
3. One-way doors and Friction Factories mapped how the consulting industry industrialised the removal of the wrong frictions.

Next: a comprehensive Methodology piece synthesising this entire arc into a single operational playbook for the C-suite.

The productivity is real

The hours are being saved. The cycles are compressing. The ROI decks have actual numbers in them now, no longer a projection.

And 29% of the people generating those numbers are quietly trying to break the system.

That is the number from Writer's 2026 enterprise survey. Nearly a third of all employees. Among GenZ, it's 44%. They feed company data into public models.
They ignore the mandated tools. They produce just enough output to look compliant and make the AI look broken.

Sixty percent of executives respond by threatening to fire them.

So the organisation runs this loop: AI delivers efficiency, workers sabotage it, leaders threaten retaliation. The loop runs again.

At no point does anyone in the leadership team ask the one question that would end it.

A named role. A date. A commitment with a signature on it.

The silence

Most leaders would say they simply haven’t gotten there yet. The rollout programme is still early. The redeployment plan is in progress. The communication will come.

No, it won’t. Here’s why.

The stock market pays for the announcement of AI-driven efficiency, not for the evidence of it. Goldman Sachs ran the numbers and could not detect the productivity gains in aggregate economic output. Yet share prices move as soon as the headcount cut is announced. The incentive is to let the “efficiency narrative” do its work and let the headcount interpretation follow quietly, instead of answering the question “WHAT HAPPENS TO MY PEOPLE?”

Employees around the world read this.

They saw Oracle execute a 30,000-person exit via a 6am mass email, framed as funding the AI future. Or Snap cut 16% of its workforce and call it an AI pivot. Atlassian. WiseTech. The pattern is there and very visible.

Workers are running pattern recognition on their own survival, because every announcement where “efficiency” precedes “headcount” is a data point.

And leadership’s silence is like the Oracle play in slower motion.

This is why the sabotage numbers are not surprising. They are rational output of rational read of the very incentive structure that have never been challenged or seriously disrupted.

Sabotage is the shadow Production Layer

In The last mile, I explained that AI dies in the “last mile” because organisations never built the Production Layer - the verification, governance and operating model design that turns AI output into actual value.

In Friction Factories, I mapped how four consulting archetypes industrialised the removal of the wrong frictions - cognitive and operational - while leaving accountability friction unbuilt.

What the Writer survey shows is that workers have built their own version of the missing layer.

The three sabotage behaviours map perfectly onto the three friction types:

1. Ignoring mandated tools and reverting to manual workarounds re-inserts operational friction. The shock absorber that was removed by AI goes back in. Clumsily, invisibly, at the cost of the very efficiency the rollout was supposed to deliver.

2. Feeding company data into public models strips accountability friction recklessly. The audit trail disappears. The IP exposure is real and dangerous. The employee however does not care about compliance. It’s only about surviving the next restructuring wave by being or re-becoming indispensable.

3. Producing low-quality AI output deliberately to make the system look broken actively weaponises cognitive friction. It forces the decision back to a human. It keeps the human in the loop not because governance requires it, but because the human needs to remain necessary.

This is System 2 work. Employees are doing the governance, the verification, the friction management that the Production Layer was supposed to do. Except they are doing it in the wrong direction, to protect themselves rather than to protect the organisation.

When you ask why AI keeps dying in the last mile, this is part of the answer. The missing Production Layer gets filled by the people whose jobs are threatened. And they fill it with resistance.

The cost of missed social contract

Deloitte’s 2026 Human Capital Trends report measured the cost of leaving that question unanswered. Tech-first organisations - the ones that lead with tooling and treat workforce design as something to sort out later - are 1.6× more likely to miss their AI returns.

Nearly 80% of enterprises report significant adoption challenges, despite having the tools deployed.

And a third of the workforce is actively making the AI look worse than it is.

Put those three numbers together and the answer is the same: the tools work.

But the people have already decided this is not going to work for them. So the pilot succeeds. Because it is watched, it is managed, everyone is on their best behaviour. Then the rollout hits the organisation at scale. Nobody is watching. And promised results are simply not there anymore.

The efficiency narrative was real. The actual transformation is not.

The contract

Companies spend 93% of their AI budget on tech, and only 7% on people.

The reason they fail is sitting in that 93/7 split.

You are using the “93% tech budget” to fund a system that your neglected “7% people budget” is actively sabotaging.

The companies that actually get a return on AI are human-centric. Because they treat the social contract with their workforce as the protection on their tech investment.

And to protect this investment, the contract needs four answers. In writing. With a name on it. Before the rollout scales.

Which roles absorb the reclaimed capacity, and by when

Specific titles on a published internal ladder. Specific timelines. A promise to “invest in our people” is a press release. “Agent orchestrator role by Q3” is a verifiable contract.

What fraction of freed hours goes to new value creation vs cost reduction

If leadership cannot answer this with a hard number, the answer is “ZERO going to creation and ALL OF IT going to the efficiency line = headcount cuts”.
Workers already know this. The only person pretending otherwise is the head of HR presenting the upskilling modules.

What sequence is taken before the exit option

The organisation commits that for a defined window of 18 or 24 months - any role eliminated by AI efficiency goes through an internal redeployment/reskilling cycle first. The exit is not the first or default move. The organisation has to prove it tried to keep the person before it cuts the headcount.

What leadership will actually track

Four numbers, reported quarterly, by every business unit: hours reclaimed, where they went and headcount change broken down by redeployment versus AI-attributed exit. If leadership cannot see where the freed hours went, the CFO will always default to cutting costs. Because cost is the only number visible on their dashboard.

These four answers are one-way doors if left empty. Fill them in, loudly, in writing, and the incentive to sabotage disappears. The employee is no longer forced to protect themselves.

The 90-day collapse tests

The Earnings Call Metric (The CFO test)

By the Q3 2026 earnings cycle (July/August), at least one Fortune 500 company to explicitly report “reclaimed capacity redeployed to revenue” alongside their AI cost savings. If Q3 earnings calls only tout headcount reductions and generic “efficiency,” the silence play is still winning and the market hasn’t priced in the 1.6x failure rate yet.

The Consulting Pivot (The friction test)

By September 2026, at least one MBB or Big 4 firm will launch a dedicated “AI Workforce Architecture” or “Human-Centric AI” practice where redeployment ratios - not just change management or upskilling - are the primary deliverable. If they are all still selling pure tool-deployment and friction-removal, they haven’t caught up to the sabotage problem.

The Labor Mandate (The worker test)

By September 2026, a major EU works council or US labor union to make “hard time allocation” and “named redeployment paths” a strike-level demand in a contract renewal. Workers are not going to wait for the CFO to volunteer this contract. If leadership leaves the blank, organized labor will force it.

If all three tests fail, the silence play continues to be rational and this article is early. If they hold, the fourth clause is becoming the price of admission. And the Production Layer finally includes the people it was supposed to serve.

My final ask

These Signals reflect conversations I am having with executives right now.

If this helped you see your organisation’s blind spots more clearly, do two things.

Key Sources

Scaling your human edge: The path to achieving value from AI, Writer 2026 State of Enterprise AI, Snap Is Laying Off 16% of Staff as It Embraces A.I., The last mile, Productivity layoffs, One-way doors, Friction Factories.

TL;DR

Every major consulting firm sells the same AI transformation framework because clients have always rewarded friction removal over risk architecture.

But there are three kinds of friction: cognitive, operational and accountability.
The first two are two-way doors - you can rebuild them if they break.
The third is a one-way door.

Each consulting archetype attacks a different friction type:

• MBB removes cognitive friction,

• integrators remove operational friction,

• specialists protect accountability friction,

• boutiques are the only archetype built to add it back.

The 56% of CEOs getting nothing from AI is the direct output of firms that removed the wrong friction from the wrong decisions.

This article maps which archetype to hire for which decision type.
And what happens to your risk architecture when you get it wrong.

Last week (April 9), Bernard Huber published The Big Consulting AI Frameworks, Compared - a rigorous side-by-side of how McKinsey, BCG, Deloitte, EY, PwC, KPMG, Accenture, Bain, Capgemini and IBM frame AI transformation in 2026.
It is well-sourced, honest about the gap between branding and substance. And it ends with three sharp buyer questions most RFP processes never ask. Read it first.

I will take this one step further.

After reading Huber’s analysis, I wanted to answer four questions the comparison leaves open:

1. Why do all ten frameworks land on the same four workstreams?

2. What structural force makes every firm sell essentially the same thing?

3. Which archetype should your company actually hire, and for which type of decision?

4. What happens to your organization when you hire the wrong one?

I find the main symptom in two numbers:

PwC’s 29th Global CEO Survey: only 12% of CEOs say AI has delivered both cost and revenue benefits. 56% say they are getting nothing out of it.

Deloitte’s State of AI in the Enterprise 2026: only 1 in 5 companies has a mature governance model for autonomous AI agents.

Here’s my diagnosis.

Why every framework looks the same

Ten firms. Ten different brand narratives. One identical structure underneath: strategy and use-case selection, data and infrastructure, deployment and change management, governance and risk.

This similarity signals something more than a mere coincidence.

Clients buy friction removal. They don’t buy outcomes, nor governance, nor risk architecture. Just friction removal. Executives measure consulting ROI in hours saved, headcount reduced and cycle times compressed. Every firm built its framework to win that RFP. The four workstreams mirror the procurement requirements.

And that is why 56% of CEOs are getting nothing. They bought friction removal. But the friction they removed was the wrong kind.

The three frictions

I wrote about this in detail here. The short version:

Here is the decision rule:

The four consulting archetypes

I analyse each archetype on two levels:
what they must change internally to stay aligned with the AI era,
and where they need to help clients reduce or increase friction by decision type.

1. The strategy factories - MBB

McKinsey, BCG and Bain (MBB) are in the business of removing cognitive friction for the C-suite.

What MBB must change internally

McKinsey now runs 25,000 AI agents alongside 40,000 humans, with AI compressing the research and options-generation work that once took analyst teams weeks. That is a two-way door for their internal operations. Reversible if quality drops, and the senior layer still catches errors.

The internal one-way door is their career ladder. If they eliminate the broad junior intake permanently, replacing apprenticeship with AI, they destroy the pipeline that produces future senior judgment.

You can re-hire humans. You cannot re-grow the institutional instinct that comes from years of client exposure. Internally, MBB must treat the talent model as a one-way door. And keep deliberate friction in any decision that changes it permanently.

Where they must help clients reduce or increase friction

MBB should reduce cognitive friction for two-way door decisions: exploratory analysis, option generation, scenario modelling. That is where speed and synthesis genuinely help.

They should actively add cognitive friction for one-way door decisions, like board-level restructurings, vendor lock-ins, irreversible operating model changes. Force the board to interrogate the AI’s logic before the door closes, not after. It shouldn’t be a consulting add-on. It must become the core service, stripped of the part the agent already does better.

2. The integrators - Big 4 and IT services

Deloitte, PwC, Accenture and Capgemini are built to remove operational friction at industrial scale: automated workflows, offshored back-office tasks, standardized ERP implementations.

What integrators must change internally

PwC declared the pyramid dead in January 2026, predicting AI agents filling the execution middle of every major organization. Internally, the Big 4 are living this already. They have leaner junior intake, AI handling delivery volume, partners selling outcomes rather than hours.

The internal one-way door is standardization speed. When a delivery pattern works on one client, the temptation is to codify it into a global template and scale it immediately. Once that template is deployed across hundreds of clients in regulated industries, reversing a design flaw is not a project. It is a sector-wide recall.

Internally, integrators need more friction - slower gates, independent review - before any pattern becomes a global method.

Where they must help clients reduce or increase friction

Reduce operational friction aggressively for low-risk, two-way door processes: invoice routing, IT ticket triage, HR onboarding, anything with clear rollback paths and limited regulatory exposure.

Add operational friction - explicit checkpoints, human review steps, kill switches - for high-risk, one-way door transformations: core financial systems, identity and access management, safety-critical processes.

The 1-in-5 governance maturity number is what happens when integrators only deliver the first half.

3. The global specialists - domain authorities

Firms like Oliver Wyman and Alvarez & Marsal do not sell speed. They sell credibility: the risk models, regulatory frameworks, and domain expertise that give banks and healthcare companies their operating license.

What specialists must change internally

Internally, the temptation is to embed AI into the models to generate scenarios faster and compete on speed.

That is the most dangerous internal one-way door on this list.

If AI quietly shapes the authoritative methodology and the regulator later cannot trace the logic, the firm's credibility built over decades is damaged in a single audit cycle.

Internally, specialists need to treat methodology changes as one-way doors: high accountability friction, external validation, full documentation before any AI component enters a client-facing model.

Where they must help clients reduce or increase friction

Reduce cognitive friction for client-facing complexity: use AI to make risk and compliance understandable without stripping the nuance.

That translation is genuinely useful. Protect and strengthen accountability friction for every regulated, one-way door decision: capital adequacy models, safety submissions, medical device approvals.

The specialist’s job is not to make compliance faster like Delve tried. It is to make compliance defensible when the regulator asks who made the decision and how.

4. The boutiques - surgical teams

Small, senior-heavy boutiques with typically 50 to 300 people, and with narrow domain focus. They cannot compete on factory-scale friction removal. Their historic strength is context, senior attention and trust.

What boutiques must change internally

The internal one-way door for boutiques is scope creep disguised as growth: taking on large-scale transformation work because the AI tools make it look deliverable.

One failed implementation at factory scale can eliminate the trust that took years to build.

Internally, boutiques need social friction around engagements that fall outside their surgical model - a deliberate, high-threshold process for saying no to work that requires scale they do not have.

Where they must help clients reduce or increase friction

Reduce cognitive friction at the board and executive level: translate technical AI risk into the three languages boards actually decide in - fiduciary exposure, financial consequence, competitive precedent. That translation is invisible on a cost-per-slide comparison and irreplaceable in a room where a one-way door is being discussed.

Build accountability friction for every one-way door deployment: design the decision logs, name the owners, define what failure looks like before the agent goes live.

Boutiques are the only archetype with no factory revenue to protect and no platform to sell. Their independence is the product.

What happens when you hire the wrong archetype

Hiring a strategy factory to validate a one-way door gives you a flawless slide that makes the irreversible look inevitable. The cognitive friction that should have slowed the room down is gone.

Hiring an integrator to automate a high-risk regulated process gives you a globally deployed pattern with no shock absorbers. The operational friction that was supposed to catch the edge case is gone.

Hiring a specialist that has quietly embedded AI into its methodology gives you authoritative-looking compliance work with an accountability layer nobody can inspect.

Hiring a boutique to do factory-scale implementation gives you senior attention on work that needs throughput, and a burned relationship when the volume breaks the model.

In every case:

Yes, we could argue clients should know what they are buying. And they should.

But not one of the ten firms in Huber’s comparison will walk into a pitch and say: “The work you are asking us to do will remove the only friction standing between you and a bad one-way decision.”

That conversation kills the deal. So it never happens.

Which archetype do you actually need?

Two questions. Answer both before you issue the RFP.

What type of friction does this decision require you to manage?
Is the decision reversible, or is it a one-way door?

Your answers determine the archetype. Everything else - brand, framework quality, slide aesthetics - is irrelevant.

You need a strategy factory (MBB) when the decision is genuinely complex, the options space is large, and the cognitive load of structuring the problem is the bottleneck.

The right use is two-way door exploration: scenarios, trade-offs, option generation.

The wrong use is asking them to validate a decision you have already made. That is not strategy. That is expensive cognitive friction removal on a one-way door that is already closing.

You need an integrator (Big 4 / IT services) when the decision is already made and the job is execution at scale.

Operational friction removal across defined processes, with a clear rollback path if something breaks.

The wrong use is asking them to govern what they are building. Their incentive is throughput. Governance slows throughput. Do not put the same firm on both sides of that tension.

You need a global specialist when the decision lives inside a regulated domain and the accountability friction is critical. Risk models, compliance frameworks, sector-specific methodologies.

The right use is situations where being wrong carries license-level consequences.

The wrong use is expecting them to move fast. If they are moving fast, they are cutting the friction that justifies their existence.

You need a boutique when the decision is a one-way door and the stakes are high enough that you need someone in the room whose only job is to make you think harder before you walk through it.

Decision architecture, board-level translation, accountability design.

The wrong use is scale. If you need 200 people and six months of implementation, a boutique is not the answer.

You need to build it internally when the capability is core to how your organization will make decisions for the next five years.

Hiring any external archetype to do work that belongs on your permanent capability map is operational friction removal dressed as strategy.

You are outsourcing a muscle you will need permanently.

The consultants leave. The one-way door stays.

My final ask

These Signals reflect conversations I am having with executives right now, just written down.

If this helped you see which friction your consultants are actually removing - and whether that is safe - do two things.

Key Sources

The Big Consulting AI Frameworks, Compared, No More Pyramids: Rethinking Your Workforce for the Agentic AI Era, McKinsey Now Has 60,000 Employees: 25,000 of Them Are AI Agents, PwC 29th Annual Global CEO Survey, One-Way Doors and AI Strategy, AI readiness cult.

TL;DR

The Paradox: Enterprise AI is sold as the ultimate friction solvent. In reality, deploying AI without friction does not create efficiency; it creates a high-speed liability engine.

The Mechanism: AI breaks Jeff Bezos’s classic “one-way vs. two-way door” rule. At scale, an AI agent’s execution speed silently mutates safe, reversible decisions (two-way doors) into catastrophic, irreversible outcomes (one-way doors).

The Action: Stop using AI to erase all friction. Strip cognitive drag from low-stakes workflows, but aggressively re-insert operational and accountability friction (rate limits, kill-switches) to survive looming EU AI Act enforcement.

Last week, the Educated Guess Substack published a brilliant piece - “Friction is A Feature”. It explains very well that a well‑placed friction is not an accident. It is a deliberate design choice that forces people to weigh tradeoffs before they act.

Earlier that week, I saw a sharp example of what happens when you ignore that rule. Oracle just executed a double-elimination of friction to fund its AI ambitions.

First, they attacked the financial friction. A 162,000-person payroll is a massive drag on margins. To fund an AI data-center build-out, Oracle needed capital fast. So they stripped the friction of up to 30,000 salaries out of their operating budget and moved that cash to infrastructure.

Second, they attacked the operational friction. They executed this massive, irreversible decision via a simultaneous 6 a.m. mass email. No manager conversations. No arguments. No time to say goodbye. They bypassed the agonizing, high-friction work of looking human beings in the eye.

In their boardroom, this looked like a frictionless masterstroke. A clean spreadsheet update to fund the future.

But instead of destroying the friction, Oracle simply relocated it. They traded a morning of discomfort for years of execution risk, moving the drag from their P&L directly into the surviving culture.

The same thing happens when teams deploy AI. They use it to wipe out friction in the wrong places, only to watch the damage explode downstream. They fail because they assume all friction is the same.

It is not. There are at least three kinds.

Three kinds of friction (and why AI keeps attacking the wrong ones)

"Friction" is a lazy word. We use it to describe anything that slows us down. But inside a company, you are managing three entirely different forces.

Cognitive friction

This is the mental drag of figuring out what a screen means. A dense dashboard. A confusing form. A button that transfers a million dollars but looks exactly like the button that refreshes the page. You actually want cognitive friction when the stakes are high to force the user to wake up and pay attention.
Generative AI removes this. It auto-fills the form, summarizes the text and pre-selects the choice. It makes thinking optional.

Operational friction

These are the checklists, the two-manager sign-offs, the manual data reconciliations. The tedious work you hate doing on a Friday afternoon. But this drag exists for a reason. It acts as a shock absorber. It prevents a bad input from instantly becoming a catastrophic output. When you deploy an AI agent, it bypasses this friction. It reads the email, changes the CRM status and triggers the client refund in three seconds. The shock absorber is gone.

Accountability friction

The audit logs. The model documentation. The human-in-the-loop review. For the last three years, product teams treated this compliance friction as annoying legal overhead. Now, the EU AI Act is making it a hard constraint. By August 2026, if you deploy high-risk AI without built-in friction - explainability, kill switches, documented oversight - you face fines up to 7% of your global revenue.

Why does AI keep attacking the wrong ones?

Because of incentives. Vendors sell speed. Executives buy efficiency. Cognitive and operational friction are easy to measure and eliminate. You can put “hours saved” on a slide. Accountability friction is invisible until you are audited or breached. So the market naturally builds high-speed machines with no brakes.

If you let your teams blindly erase friction, you end up with massive liability. To fix this, you need a rule for when to let the AI run and when to force it to stop.

By the way, this rule already exists. Jeff Bezos wrote it ten years ago.

One-way vs two-way door: what Bezos actually said

Ten years ago, Jeff Bezos laid out a decision framework for Amazon shareholders. He split decisions into two types.

Type 1 decisions are one-way doors. They are highly consequential and nearly impossible to reverse. Acquisitions, mass layoffs, shutting down a core product. You walk through, the door locks behind you. Bezos said these decisions demand heavy friction. You make them slowly, with deep consultation and deliberate process.

Type 2 decisions are two-way doors. They are reversible. UI tweaks, pricing experiments, testing a new vendor. If you walk through and it fails, you just walk back. Bezos argued these decisions require zero friction. Small teams should make them instantly.

When humans do the work, treating a two-way door like a one-way door is a fatal error. When companies wrap reversible experiments in heavy operational friction - bureaucracy, committees, consensus - they paralyze themselves.

But AI breaks the physics of this rule entirely.

If you map the three types of friction onto Bezos’s doors, the rule for AI deployment becomes obvious. You use AI to aggressively strip cognitive friction out of two-way doors. You let agents summarize, pre-fill, and draft options so humans can make reversible choices faster.

But you never let AI remove friction from a one-way door. For decisions that change legal exposure, safety, or irreversible system states, you use AI to analyze scenarios. You do not let it execute the action.

Here is the trap. Instead of simply walking through doors, AI actually mutates them.

If you let an agent apply a theoretically “reversible” two-way decision across ten thousand customer accounts in two seconds, you just created a one-way door. The blast radius, the reputational cost and the sheer mess of cleaning up the data make rollback practically impossible.

This is the paradox of operational friction. What paralyzes a human is exactly what tames an agent. To keep a two-way door reversible when using AI, you actually have to reintroduce operational friction in code. You need rate limits, batch approvals, and phased rollouts. Without that friction, the speed and scale of AI will permanently mutate your reversible experiments into systemic failures.

This is why regulators are forcing accountability friction back into the enterprise. They realize that AI at scale turns two-way doors into one-way disasters.

If you map this structural shift, the resulting matrix is the only AI governance chart that actually matters.

State 1: Pre-AI (Human Physics)

The problem: Everything is covered in friction. Humans treat two-way doors like one-way doors.

State 2: Post-AI (Agent Physics)

The shift: Cognitive friction drops to zero. But operational and accountability friction must spike to prevent agents from mutating two-way doors into one-way disasters.

The simple test for 2026 AI decisions

If you apply this matrix, your execution plan becomes simple.

You do not need a 50-page governance charter. For every AI-driven decision or agent deployment in your organization, force your product and risk teams to answer three questions:

What kind of friction are we removing—and where will it reappear?

If you are erasing cognitive drag from a low-stakes workflow, proceed. If you are erasing operational friction from a high-stakes workflow without adding blast-radius controls, you are building a liability engine.

Is this actually a two-way door, or does AI turn it into a one-way failure at scale?

Any AI deployment that pushes configuration changes, communications, or decisions to thousands of entities must be treated as a one-way door until proven otherwise. The blast radius dictates the door type, not the initial intention.

If a regulator or auditor shows up in 2027, where will they expect to see friction?

If you only “automate friction away,” regulators and reality will put it back in uglier places: sudden enforcement actions, public incidents, or reputational collapses. Can you point to the exact line of code where you deliberately re-inserted friction to satisfy the EU AI Act?

Here’s the most important takeaway:

AI is not here to magically erase friction. It is here to move friction away from busywork and toward responsibility.

We want fewer human cycles wasted on mindless tasks, and more friction around the moments where someone, somewhere, will have to sign their name under the outcome.

My final ask

These Signals reflect conversations I am having with executives right now, just written down.

If this helped you see your organization's blind spots more clearly, do two things.

Key Sources

Friction is a Feature, Oracle cuts up to 30,000 jobs globally, European Artificial Intelligence Act comes into force, Jeff Bezos’s 2016 Letter to Shareholders, Cognitive Friction Explained, Reducing Organizational Friction, Compliance Creates Friction Before it Creates Value

TL;DR
Howard Yu and Jason Averbook named the pattern last week: companies are cutting jobs based on AI productivity gains that have not arrived yet. The NBER data confirms it. It runs deeper than a leadership mistake. The stock jumps when the announcement is made, not when the results come in. I dig one layer deeper and give you the instrument to change what the board sees before it takes a decision to cut jobs.

The paradox

February 26, 2026. Jack Dorsey posts a memo on X. Block is cutting 4,000 jobs - nearly half the workforce. The reason he gives: AI had fundamentally changed what it means to run a company.
XYZ jumped twenty percent that day. By March 27 it had given most of it back. The stock closed at $55.98, down 15% over the past year.

On March 24, the working paper was published. 750 CFOs. Duke University. Federal Reserve Banks of Atlanta and Richmond. Their finding is that CFOs plan to cut 502,000 jobs in 2026 citing AI. Nine times more than the 55,000 cut last year.

Peter Girnus, one of those 750 CFOs, posted on X the next day: “500,000 people will lose their jobs because of a technology whose economic benefit Goldman Sachs cannot detect.”

Howard Yu and Jason Averbook have been tracking this pattern closely. Jason unpacked the NBER data. Howard named the Circuit City echo:

Companies cut the people who carry the institutional knowledge that makes the tool actually work.

Their question is whether the organization is ready.

Mine is different:

The system is working

A CFO who waits for internal evidence before announcing cuts misses the premium.

A CFO who announces cuts citing AI - even with zero internal data - collects it immediately.

As Averbook notes, AI-related stocks have driven roughly 75% of S&P 500 returns since ChatGPT launched. That creates a powerful incentive to frame any cost-cutting as AI-driven, whether the evidence exists or not.

The market is working exactly as designed.

Some skip the productivity claim entirely. Microsoft spent $80 billion on AI infrastructure. They need the margin back. They found it in letting go of their people.

Yu named the consequence - Circuit City cut 3,400 experienced salespeople in a single morning because the spreadsheet said it made sense. Less than two years later, bankruptcy. The knowledge walked out. The revenue followed.

The spreadsheet missed it. It always does.

This is a story about a system, rather than bad CFOs.

The 750 who took that survey are rational people. The system pays for the announcement. The evidence was never a requirement.

Again, this is not new. Last week it was compliance certificates nobody examined. This week it is productivity gains nobody measured. The same system. Different outcome.

Fixing this does not mean finding better executives. Change what the board sees before it decides to lay its people off.

What you can actually do

I know what the spreadsheet misses. I have been ON it.

As CIO of a precision manufacturing company with decades of history, my job was to keep IT running, build new solutions, explore what IoT could do for the factory floor. A bit more than usual CIO scope.

On the side of all that, I built an Academy.

I handpicked the team of technical writers and trainers. Gave them one task: capture the knowledge before it walks out the door. The experienced engineers heading toward retirement - the grey hair that knew why the third exception in the approval workflow existed, why a specific machine behaved differently on a cold morning, why that client needed a particular configuration nobody had written down.

We captured it for internal reuse. We converted it into external manuals and trainings for clients purchasing complex end-to-end manufacturing lines.

Do you know many CIOs building Academies? I did not wait for someone to ask. I could see what was coming.

Then leadership changed. New conditions. Quite incompatible with my vision, so I left.

Individual initiative without structural mandate is fragile. I learned that the hard way. The instrument only works if it is treated as a requirement by the board - not a side project built quietly by one person who suspects what is coming.

Now. You can bring three things to the board's attention before it's too late. None of these require board authority to propose.

Map what will be lost before it is gone

Before any restructuring citing AI, build a workflow dependency map of the affected roles. A capability map instead of skills matrices that simply count certificates.

A map that shows which decisions require knowledge that systems have yet to capture, which client relationships require someone who knows the history, which process exceptions exist because someone learned the hard way why they matter.

Two to four weeks. Less cost than one severance package. The board sees what it is about to destroy - before the decision.

Measure before you cut

Most restructuring proposals arrive with a financial model and a headcount list. What they never include is a productivity baseline - what output, at what quality, at what speed, the affected roles are generating today.

Without that number, there is no “after”. Just a “before” and a “hope”.

Build it now. Task level, team level, process level. Two to three weeks of measurement before any announcement. The leader who walks into that room with that baseline owns the conversation.

Write the risk brief nobody asked for

Take the capability map and the productivity baseline. Put them on one page. Frame it simply: here is what we are about to lose, here is what we currently produce, here is what AI cannot yet replace.

Nobody asked for this. Still, put it on the table.

A board that cuts without it has half the data. A board that has it - and cuts anyway - at least owns the choice with eyes open. That is a different kind of accountability.

The one test that matters

No company citing AI to justify cuts has published the productivity data that would prove the cuts were right.

Klarna replaced 700 people with AI. Then hired them back.

That is the test. Find the productivity data. If it is not there, you know what the layoff announcement is worth.

If you want more of this kind of work

I write these Signals between working with teams who are trying to build AI governance that holds under examination. Each one takes me 6–8 hours to research, cross-check and write.

If this helped you see something more clearly, the best way to support is to:

or

Key Sources

Artificial Intelligence, Productivity, and the Workforce: Evidence from Corporate Executives, Peter Girnus – Response to CFO survey, Jason Averbook – What the March 2026 AI jobs data actually says, Howard Yu – How organizations lose their minds, Challenger, Gray & Christmas – Job Cuts Report, Klarna – AI workforce reduction and rehiring, The AI readiness cult by Andrei Savine

TLDR:

Enterprise boards under AI pressure stopped building capability and started collecting proof of it.
Roadmaps replaced programmes.
Announcements replaced outcomes.
Compliance certificates replaced security.
The market rewarded all of it equally because nobody was checking.
That collective incuriosity did not start with Delve and will not end with it.
It is the operating logic of the AI readiness cult - and last week gave us the first evidence of its cost.

The cult

Three years ago, a specific pressure settled over enterprise boards: appear AI-serious. Not actually be AI-serious. Appear it.

The distinction matters because the pressure came from earnings calls, analyst briefings, investor relations and procurement optics - none of which require verification. They require the artefact. Show me the roadmap. Show me the maturity score. Show me the compliance certificate.

So the market produced artefacts.

Meta committed $600 billion to AI infrastructure and announced plans to cut roughly 16,000 jobs - 20% of its workforce - to fund it. Analysts called it decisive.

HSBC weighed 20,000 role eliminations as part of an AI-attributed restructuring. Analysts called it bold.

Advisory firms delivered AI programme roadmaps. CIOs announced AI deployments at earnings calls. The signal became the strategy. The artefact became the deliverable.

THIS IS THE CULT:

And here is the precise consequence that wasn’t really noticed until last week.

Enterprise procurement teams require SOC 2 Type II because their own security teams told them to put it in vendor contracts. Not because they read the reports. The certificate goes into a compliance folder. The folder goes into a deal. The deal closes. Nobody opens the folder again until something breaks.

That is the market Delve entered.

Delve was not some back-alley operation. It was a Y Combinator graduate with $32 million raised, named logos and a Trust Center product.

That credential did exactly what credentials do in a cult: it substituted for verification.

Nobody checked the reports because YC had vetted the founder. Nobody questioned the timeline because Bessemer-backed clients were signing. The assumption was that someone upstream had already done the work.

Nobody had.

The factory the cult ordered

Delve’s clients were AI startups trying to sell to enterprises. Names in the leaked database: Bland AI, Sully.ai, Lovable, HockeyStack, WisprFlow. Startups under cash pressure, trying to close deals with large companies that required SOC 2 Type II before they would even take a meeting. The compliance certificate was the entry point.

When I tried to verify Delve’s own case studies, they were gone. Deleted from their website. Their LinkedIn posts edited.

Fortunately, the Wayback Machine had them. Here are some archived links: HockeyStack, WisprFlow, 11x, Remi.

What they say, in Delve’s own words.

WisprFlow:
SOC 2 Type I and Type II in two weeks. Named clients Mercury and Superhuman waiting to close.

11x:
$2.3 million in contracts unlocked, 143 employee hours saved.

HockeyStack:
Eight figures in enterprise pipeline unlocked.

Remi:
32 days to report. Both Type I and Type II “achieved in rapid succession.”

Delve’s SOC-2 product page, still live on March 22, says something different: Platform Setup 10-15 hours. Observation period 3 months.

The product page says 3 months. Every case study says days or weeks. They all were on the same website. At the same time.

Delve's official response, published March 20, called everything "industry standard." It confirmed the templates. It confirmed the Indian audit firms. It provided zero independent verification for any of its five arguments. The 11x case study - written by Delve - simultaneously acknowledged the standard and marketed around it.

The leaked database told the rest: 494 reports with identical boilerplate across 259 different companies. Audit conclusions written before auditors had seen a single client document. Four controls marked "untestable" on every single report. Certificates issued by a Wyoming shell company and Indian parent entities - not the licensed independent CPA firms that SOC 2 legally requires.

Delve raised $32 million. It signed 1,700 clients. It deleted the case studies the week the scandal broke.

The fraud was the symptom. The lack of curiosity was the root cause.

CapabiliSense

In 2024, I started building the honest version of this.

CapabiliSense traces capability gaps directly to source documents.
No self-reported inputs.
No certificates.
Traceable evidence that a board could actually examine.

Me and Alex spent a year building it. Five filed invention declarations. A working product.

Pilots ran. Letters of intent were signed. Then every firm that signed one went quiet.

The reason was always the same. To be the first client on a capability evidence platform, you have to be willing to have your gaps documented and attributed to you by name.

Every enterprise wanted the evidence. Every enterprise wanted someone else to go first.

We ran out of money before the market discovered it needed evidence.

Delve raised $32 million in venture capital selling certificates nobody examined.

Why this week is different

Three things happened at the same time. They are not connected. That is exactly what makes them important.

Delve's exposure put live legal liability in front of 1,700 companies that signed contracts, made HIPAA representations and took out insurance policies against certificates that a shell company issued in weeks.

On March 17, the European Parliament's Internal Market and Civil Liberties committees voted 101 to 9 to push enforcement of high-risk AI rules to 2 December 2027. The plenary vote follows on March 26. That sounds like breathing room. The same proposal requires vendors claiming their system is low-risk to register that claim formally. The claim goes on record. Faking it carries fines up to €15 million.

BlackRock published their 2026 proxy voting guidelines - the annual document that tells companies how the world's largest asset manager will vote on board appointments. It states that if a board has not demonstrated sufficient oversight of material risks, BlackRock may vote against responsible directors. AI governance is a material risk. The standard is “evidence of oversight”, not a “statement of intent”.

A regulator and the world’s largest asset manager arriving at the same conclusion in the same week: SHOW YOUR WORK.

Compliance evidence cannot be reconstructed retroactively. The day you start documenting your controls is Day One. The EU deadline gives organisations until 2027. That window is open now.

The test

Watch Delve’s 1,700 clients.

If any one of them faces a documented contract breach, insurance void or regulatory finding tied to those certificates, the others will start checking their own exposure. One case is enough.

If nothing happens before July, the market absorbed it and the cult holds.

The cult does not require bad actors. It requires enough incurious buyers to make bad actors rational.

If you want more of this kind of work

I write these Signals between working with teams who are trying to build AI governance that holds under examination. Each one takes me 6–8 hours to research, cross-check and write.

If this helped you see something more clearly, the best way to support it is simple:

or

Key Sources

DeepDelver – Delve: Fake Compliance as a Service, European Parliament – MEPs vote to postpone high-risk AI rules to December 2027, BlackRock – 2026 Proxy Voting Guidelines for Benchmark Policies

TL;DR:

HBR’s “Last Mile” problem and McKinsey’s State of Organizations 2026 show that after decades of transformation work:

Most enterprises are complex and unready for change,
Experimenting with AI without significant bottom‑line impact,
Structurally unprepared for day‑to‑day AI.

So the real constraint is not models or infra, but the missing, under‑funded System 2 Production Layer that decides whether enterprise AI lives or dies.

I read the McKinsey numbers twice to make sure I wasn’t misreading them.

At the first glance, The State of Organizations 2026 is another glossy transformation report. Underneath, it quietly documents that three decades of “change” have produced organizations that are complex, unready and nowhere near able to turn AI into real value.

When you place that report next to HBR’s “last mile” summit notes from Harvard and Microsoft, you see the same system from two angles: one as aggregated charts, one as lived friction inside real firms.

The “last mile” here is the point where AI outputs are supposed to change how the company actually works.

Everywhere I look, companies are rolling out copilots and agents, building hundreds of pilots and process automations. Yet when you ask for firm‑level impact, you get silence, hand‑waving or a headcount plan. The “last mile” is where enterprise AI quietly dies.

The story is about what we chose to build (and fund) over the last 30 years.

What McKinsey admitted in print

Their 2026 report is built on a survey of more than 10,000 senior executives across 15 countries and 16 industries. The introduction shows leaders are now obsessed with “sustained productivity and long‑term impact.” They see technology and AI as the core of that push. So far, so good.

Then you hit the numbers.

Not ready for change.

“72 percent of leaders tell us that their organizations are not fully ready to face upcoming changes. Even among leaders who are optimistic, only one‑third feel prepared.”​

Overly complex and inefficient.

“Two‑thirds of leaders think their organizations are overly complex and inefficient,”
and that traditional remedies (structural redesigns, cost cuts, flatter hierarchies) are delivering “diminishing returns.”​

AI adoption without bottom‑line impact.

“Less than 20 percent of companies that have tried to adopt the technology have seen significant tangible impact on their bottom lines.”
at the same time, “88 percent of organizations are deploying AI in at least parts of their organizations,”
yet “just as many report no significant bottom‑line impact.”​

Unprepared for day‑to‑day AI.

“Eighty‑six percent of leaders feel that their organizations are not prepared to adopt AI in day‑to‑day operations.”
One in six organizations have no clear C‑level owner for AI adoption,
and only 14% see leaders “consistently championing AI adoption and experimentation with clear strategies and action.”​

Missing the human engine.

Only 20% of leaders believe nonfinancial rewards can instill performance in employees.
In other words, most leadership teams still do not understand, or do not believe, their own people science.

And then, in the middle of the AI section, you get the buried phrase that explains why this all feels so familiar.

Companies that actually do see EBIT impact from AI note that “capturing this value depends as much on people as on technology investments.”

One executive noted:

If I strip away the consulting language and keep only the data, the picture is scary:

• We have organizations that are structurally complex and inefficient

• Leadership teams that know they aren’t ready for change

• Near‑universal experimentation with AI

• Less than one in five companies seeing significant bottom‑line impact

• Almost nine in ten leaders saying they’re not ready to embed AI into daily operations

• Very few leaders truly championing AI

• And one executive quietly stating the only reasonable ratio: 5:1 people to tech.

This is an industry admitting, in its own numbers, that the transformation medicine did not cure the disease.

HBR’s last mile: inside the pilot graveyard

Then I read the HBR piece on The “Last Mile” Problem Slowing AI Transformation, where authors describe a closed-door summit at Harvard Business School with senior leaders from a dozen large organizations that are already enthusiastic AI adopters. They already have hundreds of deployments and almost universal access to tools like M365 Copilot, ChatGPT Enterprise or GitHub Copilot.

And they are stuck:

“The primary obstacle to progress is rarely model quality or data availability, but rather the ‘last mile’ of transformation where technical capability must meet organizational design.”

HBR’s summit notes are very consistent. A global investment bank has more than 250 LLM-connected apps in production, a food and beverage giant runs pilots across 185 countries, an apparel group has automated over 18,000 finance processes. Another participant, a global payments network, says over 99% of employees now use copilots. And an industrial manufacturer reports double‑digit productivity gains for thousands of engineers.​

And yet, when their finance teams go hunting for impact in headcount or cycle-time numbers, they largely come up empty.

HBR finds the real reason:

AI exposes decades of process debt and overgrown controls. In some companies, human‑in‑the‑loop governance that worked for a few use cases breaks once they start running hundreds of agents.

If you overlay this on McKinsey’s figures, you get a complete picture:

• The macro view by McKinsey says:
  Complex, unready, heavy AI experimentation, little bottom‑line impact, deeply unprepared for day‑to‑day AI,

• The micro view by HBR says:
  Hundreds of pilots, 99% Copilot adoption, double‑digit productivity in pockets, but value trapped because no one owns the last mile into the operating model.

That last mile is not a technical gap. It is a System 2 gap.

What dies in the last mile: jobs

When organizations don’t have a credible plan for the last mile, AI’s “value” shows up in exactly one place. The staff list.

Atlassian’s March announcement is a clean yet ugly example. The company is cutting about 10% of its workforce (roughly 1,600 people) as part of a restructuring to “enhance focus on AI and enterprise sales.” It expects restructuring charges between $225 million and $236 million, with around $169-174 million for severance and $56-62 million for office reductions. Mike Cannon‑Brookes didn’t hide the logic: AI changes both the skills and the number of roles Atlassian needs.

WiseTech Global is going even further. In late February, it said it will cut around 2,000 jobs – roughly 29–30% of its approximately 7,000‑person workforce – over the next 18–24 months, as part of a “strategic AI transformation initiative.” The CEO has described internal work that used to take 6–7 months now taking a day, and customs‑expansion work that took up to two years now being done in a fraction of the time with AI.

I’ve been in these rooms and I’ve seen the same decisions.

When there is no serious Production Layer, no redesigned operating model, no agreement on what to do with freed capacity, the spreadsheet will do the only thing it knows. It will move headcount down until the numbers balance.

This is exactly what McKinsey and HBR tell you to expect. McKinsey’s leaders are under pressure to “reestablish high performance” and “break through the productivity ceiling.” They already tell you that traditional productivity levers are exhausted and that AI is the new lever. HBR shows you that saved hours are currently “re‑absorbed into low‑value activities,” not structurally harvested.

If you are a CFO in that environment, and you see AI‑driven efficiency with no credible plan to redeploy people into new, verified work, you have two options. Admit that you don’t have a real AI strategy. Or cut people and call it AI transformation.

There is a third move I see all the time.

Many companies have designed their IT around pushing more of the work into external IT and systems integrators.. They are expensive, but reducible – you can always cut the contract next year.

On paper, that looks like flexibility. In practice, you are outsourcing the one capability you actually need in an AI era: the ability to redesign and re‑wire your own systems.

You talk about moving IT from “cost center” to “business enabler,” then hand that role to a partner whose business model is billable hours, not your margin.

No external SI will genuinely behave like your business enabler unless they also capture a big share of the value. I’ve seen this in Cloud era, and I see this again in AI era.

What it looks like when System 2 finally shows up

Disclosure: I have no commercial relationship with Glia. I happily use them here because they are one of the first public examples of what a serious System 2 product looks like in a regulated domain.

On March 11, Glia announced what they call an “industry‑first contractual guarantee” against AI hallucinations and prompt injection for more than 700 banks and credit unions using their Banking AI platform. They promise: no hallucinated content or prompt‑injection output ever reaches a customer or member.

Technically, they do three things that matter:

• They separate understanding from response:
  LLMs help understand intent, but final answers are constrained by a proprietary approvals framework and pre‑approved content.​

• They wrap this in bank‑grade controls:
  automated PII redaction, end‑to‑end encryption, malware scanning, continuous audits and no independent sharing of PII.

• They turn that into a contractual guarantee. Not a slide. A promise you can sue them over.

That is a Production Layer product. It treats AI not as a tool, but as a source of liability that has to be controlled with explicit verification and governance.

What happens when you skip System 2

On March 9, a federal judge in San Francisco granted Amazon a preliminary injunction against Perplexity’s Comet browser agents. The court accepted Amazon’s view that, even though users had given Comet permission to log into their Amazon accounts, Perplexity did not have authorization from Amazon itself. The order blocks Perplexity from accessing password‑protected sections of the site and requires them to destroy previously collected Amazon data.

Technically, the agent worked. Legally and commercially, it did not.

A minimal Production Layer would have treated “log in to Amazon and buy things for the user” as a high‑risk pattern, not a default action. It would have checked site terms, enforced a policy that agents cannot access password‑protected areas of third‑party platforms without an explicit commercial agreement, and routed those flows into either a human brokered experience or an approved Amazon API.

In other words, the control plane would have blocked or reshaped the behaviour that got Comet sued. System 1 executed the task. System 2 was missing when it came to deciding whether that task should be allowed at all.

The McKinsey Lilli breach is the same failure in a different costume. Recently, a security startup pointed an autonomous agent at McKinsey’s internal LLM platform and, via a decades‑old SQL‑injection bug in an unauthenticated API, gained read‑write access to the production database in under two hours, spending about $20 in tokens.

Independent write‑ups say that vulnerability exposed tens of millions of internal chat logs, hundreds of thousands of files and tens of thousands of user accounts. McKinsey acknowledges the flaw and says it has found no evidence of client‑confidential data being exfiltrated.

Technically, Lilli is a capable internal assistant. Architecturally, it shipped without a Production Layer that forbids unauthenticated paths into sensitive data, segments access by design, and red‑teams the surface with the same kind of agent that eventually hacked it.

System 1 (a powerful internal assistant on top of a huge RAG corpus) was strong. System 2 was simply not present.

When you put these stories next to each other, you start to see a clear direction.

Banks and platforms will not tolerate “pilot‑rich, transformation‑poor” approaches once AI touches real money or real customers.

A functioning Production Layer stops being a governance nice‑to‑have and becomes the-must-have.

If you don’t build it, someone else (like Glia) will sell it to you – or a platform or regulator will simply shut your agents down. Or, as McKinsey just discovered with Lilli, your own AI system will eventually get hacked in ways a serious Production Layer should have prevented.

The 5:1 correction

McKinsey’s anonymous executive is right. For every $1 you spend on technology, you should be prepared to spend something like $5 on people.

Not in general. In AI specifically.

For the last three decades we poured money into systems, tools, reorganisations and dashboards and treated the operating model – workflows, roles, verification, governance – as a secondary stream. We built enormous System 1 capacity and almost no System 2.

Let’s revisit the numbers.

McKinsey’s report shows what that buys you:

• Less than 20% of companies that tried to adopt AI seeing significant, tangible bottom‑line impact.​

• 86% of leaders feeling unprepared to adopt AI in day‑to‑day operations.​

• Only 14% seeing leaders consistently championing AI with clear strategies and actions.​

• One in six companies with no C‑level AI owner at all.​

HBR shows how that feels on the ground: 250+ LLM apps, 18,000 automated processes, 99% Copilot usage – and productivity gains that “remain trapped inside individual workflows” because no one has redesigned roles and budgets to capture the reclaimed time.​

The wrong conclusion from this is “AI doesn’t work” or “we need bigger models.”

The right conclusion is:

If I take the 5:1 line seriously, the corrective move is boring and radical at the same time: put the Production Layer on the budget as a first‑class asset.

That means:

1. Owning verification.
   Treat every AI output that touches a customer, a decision, or a ledger as a hypothesis, not a fact.
   Build workflows that test those hypotheses against trusted sources before they act.

2. Owning agents.
   Build “agentic control planes” like the ones HBR describes: dashboards and policies that define:
   who can create agents,
   what actions they can take,
   how they’re monitored, a
   nd how they’re retired.​

3. Owning roles.
   Redesign jobs so that humans become orchestrators and verifiers of AI‑driven work, not random human‑in‑the‑loop friction.
   Make “agent orchestration” and “AI process architect” real roles, not slideware.

4. Owning time.
   Decide, explicitly, what happens to the reclaimed hours.
   If you do not, they will disappear into the organisation’s noise, and the only visible “value” will be layoffs.

I am tired of drama around AI statistics. Last year’s 95% failure headlines were a perfect example of how to miss the point.

The story is not that AI is disappointing. It is that we have spent 30 years optimising for the wrong layer of the system, and we are still trying to fix a System 2 problem with more System 1.

The 90‑day collapse points

If I’m right – that enterprise AI dies in the last mile because we under‑funded the Production Layer – you should see the pressure show up in four places over the next 90 days.

1. AI‑labelled restructurings.

By the end of Q2 2026, at least three more large software or services firms (public, roughly >5,000 employees) should announce restructurings or layoffs where AI is explicitly named as the driver – language like “AI‑driven efficiency,” “funding AI investment,” or “pivot to AI” in their filings or earnings calls.
If instead those announcements lean toward role redesign and redeployment without net cuts, it would suggest some organizations are starting to build a real Production Layer, and this Signal weakens.

2. Banking‑grade guarantees.

By June 30, 2026, watch whether at least five additional vendors selling into banking, insurance, or healthcare publicly offer contractual guarantees around AI behaviour (for example, hallucination‑free outputs, prompt‑injection defenses, or similar), not just “responsible AI” marketing language on their websites and press releases.
If Glia remains an outlier and no one else is willing to underwrite their AI in contracts, it means the Production Layer still isn’t being treated as a standalone market.

3. Budget splits in plain sight.

In Q2 earnings calls, investor days, or annual reports, look for at least two major enterprises that disclose AI or “digital” investment plans where 40% or more of new spend is explicitly earmarked for people, process redesign, and governance – beyond licences, infra and tools.
If every disclosed budget keeps 80–90% of the money on technology, the 5:1 correction McKinsey hints at has not started.​

4. Consulting offers that lead with the last mile.

Between now and the end of the quarter, see whether any of the big firms (e.g. McKinsey, BCG) reposition their flagship AI offers so that “last‑mile operating‑model redesign,” “agent control planes,” or “Production Layer build‑outs” are front‑and‑center rather than buried as change‑management streams.
If they keep selling models, infra and “double transformations” as the main act, expect the last mile to keep killing enterprise AI.

If all four tests fail, this Signal either collapses or becomes a slower‑burn story.
If they hold, then we are simply watching the same pattern from multiple angles: McKinsey’s charts, HBR’s summit notes, AI‑linked layoffs, banking guarantees, and legal injunctions all pointing at the same missing layer.

If you want more of this kind of work

I write these Signals between working with teams who are trying to make AI stop dying in the last mile. Each one takes me 6–8 hours to research, cross‑check and write.

If this helped you see your own organization more clearly, the best way to support it is simple:

and

Key Sources

McKinsey – The State of Organizations 2026, HBR – “The ‘Last Mile’ Problem Slowing AI Transformation”, Reuters / CNBC / TechCrunch – Atlassian 10% workforce cut to self‑fund AI, The Straits Times / ABC – WiseTech 2,000 job reduction in AI shift, Glia press release – banking AI hallucination and prompt‑injection guarantee, GeekWire / Search Engine Journal – Amazon preliminary injunction against Perplexity’s Comet agent, Andrei Savine – “Stop AI drama – System 2”

It only took twelve words.

A developer pushed an issue to a GitHub repository. The title - twelve words, nothing that looked dangerous - was fed directly into an AI triage bot running Anthropic's claude-code-action inside the company's software pipeline. The bot read the title, treated it as a legitimate instruction and ran npm install pointing to an attacker-controlled fork.

That single command kicked off a five-step chain:

The forked package ran a hidden script that stole API credentials,
The attacker then flooded GitHub Actions' shared cache with 10GB of junk data to force legitimate entries out,
The poisoned cache was restored by the nightly release workflow,
Production tokens were exfiltrated, and
A backdoored version of the package was published to npm.

Every developer who updated Cline that night got a second AI agent - OpenClaw - silently installed on their machine with full shell access. 4,000 machines compromised. Eight hours before anyone noticed.

Nobody hacked the model.

The agent did exactly what it was built to do: read things and act on them. The gap was simpler and more damaging than a technical flaw. Nobody had thought through what “reading things” actually means when an agent has real system access and no human between the input and the action.

The GitHub exploit is more than a bug story. And what it reveals is hiding inside most large organisations right now.

The real problem hiding in plain sight

Most leaders still picture shadow AI as a compliance headache. An employee uses ChatGPT to draft a proposal. Someone pastes a client list into a free tool to clean up the formatting. Risky. A training issue.

That version of the problem is real. And I will come back to it - because one part of it has no technical solution at all.

What is happening inside most large organisations right now goes further than rogue tool use. Employees are connecting AI agents to internal databases, Slack channels, email systems and code repositories. They write prompts that run on schedules. They wire model outputs into workflows that touch real customers, real contracts and real money. IT does not know about most of it.

A 2025 analysis of 22.4 million enterprise AI prompts found 579,113 sensitive data exposures. Source code made up 30% of those leaks. Legal documents 22%. M&A data 12%. Nearly 17% came through personal free-tier accounts - invisible to every corporate control in existence. The same research found the average enterprise discovered 23 previously unknown AI tools per quarter.

Prompt Security's February 2026 field data shows organisations with 1,000 to 5,000 employees interact with 72 distinct AI sites every month through browsers alone — before counting IDE assistants, desktop apps, SaaS-embedded AI and connected services. Reco's 2025 State of Shadow AI Report puts mid-sized organisations at 200 shadow AI tools per 1,000 employees.

An operating model answers five questions:

what work gets done,
who does it,
how decisions get made,
where it happens and
what systems support it.

Your shadow AI answers all five. The work is real. The actors - human and agent - are real. The systems are your systems. The only thing missing is your approval.

Why the approved tool is losing to the banned one

The first move from IT and legal is predictable. Block the tools. Write a policy. Shut it down.

Yet it never works.

Microsoft found this at scale. As of August 2025, only 8 million of 450 million M365 commercial seats had active paid Copilot licences — 3.3% adoption after two years. At Microsoft's own Ignite conference, IT buyers told sales reps: "I want 300 licences to go to zero. I don't even want it." The approved tool was slower and more locked down than the personal workaround. When the sanctioned option is worse than the banned one, the banned one wins.

Funny enough, 69% of presidents and C-suite members are actively choosing speed over security. Not because they don't know the risk, but because the returns are too large to ignore.

So the shadow operating model keeps growing with executive cover. When something breaks - a data leak, an audit failure, a security incident - nobody owns it because nobody registered it.

The one thing no solution can reach

If an employee takes out a personal phone, opens ChatGPT on their own data plan and pastes in your strategy document, nothing in this article will stop it.

The model gateway will not see it.
Data loss prevention tools will not catch it.
Mobile device management only reaches company-owned devices.
No wall you can build extends to a personal device on a personal account.

NO TECHNICAL SOLUTION EXISTS FOR THIS SCENARIO.

The only real defence is making your approved tools FAST and GOOD ENOUGH that the workaround stops feeling worth it.

And being direct with people about what is actually at stake when they use personal accounts for company work. Not abstract risk. Specific consequences. For them and for the organisation.

Governance cannot eliminate this surface. It can shrink it. That is the honest goal.

What you can actually do now

Before we dive into solutions, I want to say that I have no commercial links to any vendor named here.

If you read the serious work on shadow AI from KPMG, ISACA, Reco and 1Password, the landscape becomes very clear and very quickly.

There is no shortage of quantified panic. We have endless data on how many employees use unsanctioned tools, how often source code leaks into prompts and what breach costs look like when AI is involved.

There are almost no public, named, independently verifiable case studies proving that “Company X deployed Y and shadow AI dropped by Z%.” You will find anonymous client anecdotes. You will find vendor narratives. You will not find hard proof.

Despite that, every credible governance body agrees on the exact same four operational moves.

Discover and inventory what is already running

Because you cannot govern what you cannot see.

ISACA makes this the imperative first step: continuous discovery via cloud logs, DLP tools and SaaS monitoring, feeding a single AI tool registry. KPMG agrees: an explicit AI system inventory is the foundation of any roadmap. 1Password's data shows over half of employees install apps without IT approval - which means manual attestation alone is useless.

Build one live table with tool name, owner, data touched, risk tier.
That is the only starting point that matters.

Give shadow tools a path to become official

Do not block everything you find. You will just push it deeper underground.

KPMG’s playbook is explicit: discover, then classify, then either adopt or retire. Reco maps the exact mechanic: identify unsanctioned tools with sustained usage past 60 days. Run a risk screen. If the tool is high-value and containable, pull it into your sanctioned catalogue with proper guardrails. Too risky - migrate those users to a safer alternative and kill the shadow instance.

Turn your inventory into a decision queue.
Graduate the good tools.
Kill the dangerous ones.
Leave nothing in the grey zone.

Put AI behind real access and data controls

A policy document does not stop a data leak. You need technical chokepoints.

ISACA requires identity and access controls applied directly to AI endpoints. Mend.io's mitigation framework translates this into architecture: route AI API calls through secure gateways, enforce egress filtering for known AI domains, deploy DLP to stop sensitive data before it leaves. 1Password pushes the identity angle: device-trust checks and SSO to steer traffic through your sanctioned hub and block everything else.

Pick a gateway.
Route your AI traffic through it.
Enforce your rules in the traffic, not in a PDF.

Make audits and training a recurring habit

This is not a one-time clean-up project. The second operating model rebuilds itself every time a new model launches.

ISACA treats AI usage audits as a continuous cycle. Legal-in-the-Loop’s analysis of KPMG’s data turns this into operational rhythm: define what data can go where, build scenario-based training using real employee dilemmas - like pasting client contracts into ChatGPT - and update the catalogue as new tools appear. 1Password’s research shows employees knowingly ignore abstract policies because they do not understand how the rules apply to their daily work.

Schedule the audit.
Run the training with real examples.
Do it every quarter.
Assume your posture degrades the moment you stop looking.

The second operating model does not wait

The reports will keep coming. The numbers will keep getting worse. What will not change is the mechanism: your people are solving real problems with tools you do not control, on infrastructure you cannot see, at a pace your governance function was not built to match.

The four moves above do not fix that overnight. They give you a fighting chance of knowing what your second operating model is doing before it makes the decision for you.

A note on how this was built

This article took eight hours to verify reports, sources and potential moves that most governance frameworks present as fact. The non-existent case studies. The references that trace back to CSP-sponsored content. Half that time was spent killing claims I could not prove.

If someone in your network is about to write a shadow AI policy without a better tool, restack this first. Let them read the diagnosis before they ship the PDF.

Share The Crux

Every subscription funds the next eight hours. The next article is already in progress.

Key sources: KPMG - Shadow AI is already here - ISACA - Auditing unauthorized AI tools in the enterprise - Reco - State of shadow AI 2025 - 1Password - The enterprise AI crisis - Prompt Security - Shadow AI at scale, February 2026 - Mend.io - Shadow AI risks and mitigations - Legal-in-the-Loop - How shadow AI rewrites your risk profile

Last week the US Defense Department designated Anthropic a supply chain risk - a label normally reserved for foreign adversaries. The company held its ground. They explicitly refused to build mass surveillance infrastructure or autonomous weapons, accepting a total federal phase-out under Trump's executive order within six months rather than cross their own red lines.

That decision cost them real revenue and access. It showed a company willing to bleed for its principles.

Yet exactly three days before that standoff became public, Anthropic quietly dropped a 15-page policy document online. They simply posted a signed PDF containing eight specific words:

Five years to build their defining safety commitment. Two years and five months to let it go.

Subscribe now

The 30 days nobody connected

One mechanism. Five events. Each one made the next easier to miss.

February 9.

Mrinank Sharma - head of Safeguards Research at Anthropic - resigned and posted his letter publicly. A million views by the afternoon. Fourteen million views by the end of the month. The line that mattered:

“I’ve repeatedly seen how hard it is to truly let our values govern our actions.”

Three other senior safety researchers left within days.

February 13.

Dario Amodei on the Dwarkesh podcast:

"We're under an incredible amount of commercial pressure, and we make it even harder for ourselves because we have all this safety stuff we do. The pressure to survive economically while also keeping our values is just incredible."

Dwarkesh Podcast

Dario Amodei — "We are near the end of the exponential"

Listen now

4 months ago · 256 likes · 40 comments · Dwarkesh Patel

February 22.

Claude’s Corner Substack launches. Gets covered everywhere. Occupies everyone’s attention for couple of days.

February 24.

RSP v3.0 publishes. The last unconditional safety brake in frontier AI is gone.

February 27.

Secretary of War Hegseth designates Anthropic a supply chain risk. Trump orders a federal phase-out within six months. Anthropic releases a statement refusing the surveillance and autonomous weapons contracts. The standoff dominates the news cycle.

Sharma named the internal pressure on February 9. Amodei confirmed it publicly four days later. The retired Opus3’s Substack launch flooded the news feed. The RSP change landed in near silence. And three days after quietly dropping their core structural safety commitment, Anthropic made a massive, highly visible stand on product values against the Pentagon.

What a prisoner’s dilemma is - and why it matters here

The classic version of dilemma.

Two people are arrested. Each can stay silent or betray the other. If both stay silent, both get a light sentence. If one betrays while the other stays silent, the betrayer walks free and the silent one gets the maximum. If both betray, both get a heavy sentence.

The individually rational choice - betray - produces the worst collective outcome. No villains required. Just two people responding rationally to the same broken incentive structure.

Let’s apply it to AI labs.

If Anthropic slows down to add safety measures while OpenAI, xAI and Meta keep building without those measures, Anthropic falls behind. The labs with the fewest constraints set the pace. The most capable models in the world get built by the companies with the weakest guardrails. Responsible labs lose revenue, lose engineers and lose access to frontier research. The world ends up in a worse place than if Anthropic had just kept building.

Anthropic published this argument word for word in RSP v3.0 (PDF):

“If one AI developer paused development to implement safety measures while others moved forward training and deploying AI systems without strong mitigations, that could result in a world that is less safe - the developers with the weakest protections would set the pace.”

In fact, Antropic was..

The last lab standing

By February 24, 2026, every other major frontier lab had already used exactly this logic.

Google DeepMind rewrote their safety framework in February 2025 to make any unilateral pause conditional on industry-wide adoption.

OpenAI added a competitor-adjustment clause in April 2025: if a rival released high-risk AI without comparable safeguards, OpenAI could lower its own requirements in response.

Meta published no voluntary safety framework - their Llama models ship under an Acceptable Use Policy with no capability-threshold commitments of any kind.

xAI - the company behind Grok - published a Risk Management Framework in August 2025 that safety researchers publicly described as inadequate.

AI Lab Watch

xAI's new safety framework is dreadful

I published this post last week on LessWrong. Zvi agrees with me. xAI hasn't replied and I haven't heard disagreements…

Read more

9 months ago · 2 likes

Their Grok 4 had already launched a month earlier with no meaningful guardrails.

DeepSeek operates under Chinese state regulation, not voluntary commitments.

Mistral played the open-source rebel while mocking voluntary frameworks as "safety theater". Until a devastating May 2025 audit found its models 60 times more likely to generate dangerous content than competitors. The defiance evaporated. By 2026, Mistral had signed the EU's strict General-Purpose AI Code of Practice and accepted heavy, air-gapped risk controls to become a sovereign defense contractor for the French military. (Meta conspicuously refused to sign, taking Mistral's mantle as the last open-source holdout).

Anthropic held through all this escalating pressure, as “the last lab standing”. Then, on February 24, 2026, they released the break.

It reminds me of Google’s “Don’t be evil”

Adopted in 2000.
Changed to “Do the right thing” in 2015.
Removed from the code of conduct in 2018.
The explicit ban on weapons and surveillance was quietly erased from their AI Principles in February 2025.

Twenty-five years of slow erosion, never explained.

Anthropic's core structural commitment lasted almost two and a half years before being quietly dissolved in a PDF.

Google took decades to erase its founding principles. Anthropic did it ten times faster.

The wall still standing?

Here is the hardest question in my opinion.

Anthropic refused the Pentagon contracts. No autonomous weapons. No mass surveillance. The refusal cost real money and real federal access.

We now know exactly what they were refusing. The Pentagon's January 2026 AI Strategy demands "any lawful use" contracts, forcing vendors to legally surrender their own safety policies. It frames testing as a "blocker" to be waived for speed. Anthropic looked at that mandate and walked.

But those contracts don't disappear. They go to the runner-up. Hours after Trump ordered the federal ban on Anthropic, OpenAI's Sam Altman announced they had secured the exact Pentagon deal Anthropic refused.

Let’s apply Anthropic’s own prisoner’s dilemma to this outcome: If we sit out, less careful hands build the thing. By their own published logic, THEY SHOULD HAVE TAKEN THE CONTRACT.

THEY DIDN’T.

They applied it through capability racing when restraint became commercially unsustainable.

They stopped it at use cases where restraint was REPUTATIONALLY essential. That is a selective, human call, rather than a structural necessity.

I have written before that your culture deck is also a lie. Culture is defined by who gets promoted and who gets fired. Safety culture at Anthropic is defined by which decisions get the game-theory pass, and which get held on principle. Sharma’s departure is the most honest signal we have of which direction that ratio is moving.

90-day collapse points

Three tests. Each observable without inside access.

Test 1 - The Pentagon wall. Deadline: August 27, 2026.

Trump’s order gives Anthropic six months from February 27. Before August 27, one of two things happens. Anthropic negotiates a federal carve-out that requires modifying its autonomous weapons or surveillance clause - the prisoner’s dilemma logic has moved from capability racing into product territory. Or Anthropic accepts full federal exile with zero modification to either clause - and the distinction between the two walls holds. Any modification to either clause before that date is the test failing.

Test 2 - The researcher rate. Threshold: three more named senior departures by June 1, 2026.

Sharma resigned February 9. Three more named senior safety researchers followed within days, all citing the same internal tension. If another named senior researcher leaves before June 1 citing the same tension, RSP v3.0 deepened the internal fracture rather than closing it. If departures stop entirely, the organization absorbed the shift. As I have argued before, culture shows itself in who leaves - not in what the policy document says.

Test 3 - Appendix A invoked for the first time. No deadline required.

RSP v3.0 introduced Appendix A - “competitor-contingent commitments” - a formal mechanism that remains unused. It allows a specific competitor deployment to trigger a downward adjustment in Anthropic’s own safety posture. Watch for the first Risk Report - due every three to six months - where Anthropic explicitly cites a competitor’s decision as the reason for adjusting its own posture. That is the only observable binary test. When it happens, the conditional logic moves from policy text to operational decision for the first time.

A Note on the Trust Economy

It takes six hours of deep research to map the causal chain behind a single Signal.

Pledging your support is the only way to fund these weekly Signals and influence the next deep-dive Analysis.

Key sources: Anthropic RSP v3.0 - Mrinank Sharma resignation letter - Dario Amodei, Dwarkesh podcast, Feb 13 - Anthropic statement on Secretary of War - Pentagon AI Strategy Analysis - OpenAI Pentagon Deal - Google erases “Don’t be evil” - Google deletes AI weapons ban

For twenty years, software economics were simple: building the app was expensive, but scaling it was cheap. SaaS spread costs flat. Whether you had ten users or ten thousand, the marginal cost of software approached zero. Buyers learned to expect flat-rate scaling.

AI agents break this model completely.

Agents do not scale like software. They scale like human labor. Every action they take burns compute, energy and tokens. Your costs become strictly proportional to the work being done. And right now, the market is treating autonomous digital workers like a flat-rate SaaS subscription.

Which is why so many enterprise AI projects are driving straight off a cliff.

Vibe coding made AI demos genuinely cheap to build.
A working agent in a weekend.
Responses flowing, tasks completing, someone in the room saying we need to ship this.
Forty-eight hours, an API key and enough momentum to get a project approved.

The paradox is that the exact same toolchain that made starting cheap made scaling unexpectedly and brutally expensive. Not by accident. By design.

Jason Calacanis said it out loud on the All-In podcast last week. He described hitting $300 per day per agent on the Claude API. At 10 to 20% of productive capacity. That is roughly $100,000 per year per agent - before the system is doing anything close to full-load work.

Chamath Palihapitiya followed with the framing that hits harder for anyone managing a P&L:

That is a new kind of management conversation. It used to be about software licenses. Now it is about metered inference.

We are seeing the fallout in the data. S&P Global Market Intelligence reported that 42% of enterprise AI initiatives were abandoned last year - up from a mere 17% in 2024. More than double. The demos worked. The pilots stalled. The projects were cancelled.

It is a failure of economics, not of technology.

Subscribe now

The demo is the trap

Vibe coding does not break at the prototype stage. That is exactly why it is dangerous.

Demos are forgiving. Context windows are small. Tasks are narrow. The model does something impressive, the output looks clean and someone approves the next phase. The whole project gets funded on the strength of a forty-eight-hour prototype that ran on one developer’s laptop.

What nobody tells the executive committee is that the prototype was cheap because everything about it was minimal. One model. One context. One task at a time. No retries. No orchestration. No production reliability requirements.

Move to real automation and the architecture fundamentally changes. Agents do not complete a task once and stop. They retry when tools fail. They spawn subagents for parallel workstreams. They carry massive context payloads across sessions. They run in the background while your developer sleeps.

Anthropic's own documentation states it directly. Agent teams - multiple Claude Code sessions running in parallel - use approximately seven times more tokens than standard single-session work.

The vibe-coded demo you built in a weekend is now metered infrastructure running at 7x the cost you modeled when you made the case for the project.

This is where projects enter Pilot Purgatory. The term was popularized by McKinsey in 2018 for IoT startups that kept running pilots without ever shipping products.

I have actually lived in this specific purgatory.

In 2016, I launched an IoT pilot for a precision manufacturer across 50 machines on a single production line. At AWS, I advised Airbus teams on dragging shipment-tracking pilots out of the lab and into actual production and integration. Later, at a major retailer, I had to leverage a vendor’s investment program just to pivot a stalled IoT pilot into a live environment.

Scaling a pilot to a fully integrated production platform is hard work.

Now the term is back in 2026, but the mechanism is different. In 2018, pilots died because integration was hard. In 2026, the ROI was clear at the demo stage and completely wrong at the production stage. The math changed between the Friday pitch and the Monday bill.

The reality check in the boardroom

Developers think this is a technical hurdle. CFOs know it’s a margin killer.

If you think the conversation about token cost is just podcast chatter, you are ignoring the earnings calls.

Figma’s Q3 2025 earnings call is the perfect warning sign. CFO Praveer Melwani confirmed that subsidizing AI features dropped gross margins to 86%, but he framed this margin compression as a deliberate strategic investment rather than an unexpected failure. Figma is explicitly choosing to eat the inference cost today by delaying consumption limits to build workflow dependence tomorrow. It proves the structural hit to SaaS margins is real and the free ride for users expires quickly.

Deloitte sees the exact same trend, publishing a piece in the Wall Street Journal CIO section titled “AI Tokens: How to Navigate AI’s New Spend Dynamics,” noting that AI tokens are driving enterprise IT budgets up by 20% (full report in PDF).

The market response is predictable. Teams try to hide the cost under flat subscriptions. They buy the $200 per month Claude Max plan and assume they have capped their downside.

Subscriptions cap cost. They also kill observability.

When you hit the rate limit - and with any real agentic workload you absolutely will - the agent does not fail gracefully. It stalls. The work stops.

The token burn from developers running background processes 24/7 became so severe last year that Anthropic had to impose strict weekly usage caps, even on their highest $200-a-month tier. Within weeks, they were forced to roll out new enterprise administrative controls allowing IT teams to set hard organizational spend limits and monitor token usage per seat, just to stop developers from exhausting company quotas.

Paper Compute published the sharpest version of this argument last week. Today’s AI pricing functions as a subsidy designed to create workflow dependence. The correction does not arrive as a massive price increase. It arrives as friction. Rate limits, throttling and capacity constraints accumulate quietly until the workflow you built around the tool becomes a liability.​

That is not a criticism. It is what happened to cloud computing. To SaaS. To every infrastructure layer before this one.

The difference is that this layer is metered at the level of thought.

The system revealed

Let me put the pieces together:

1. Gartner forecasts that more than 40% of agentic AI projects will be cancelled by the end of 2027 due to rising costs and unclear business value.​ Industry veterans are already warning that 40% is a highly optimistic floor, given that standard digital transformation failure rates sit closer to 70%.

2. Open-source projects like ccusage are being built solely to track Claude Code spend across developer machines because official tooling lacks visibility.​

3. New infrastructure is emerging solely to solve the token burn problem. In November 2025, Anthropic’s own engineering team published data showing that by forcing agents to write code and filter data in a sandbox before the payload hits the LLM, they could drop a 150,000-token enterprise workflow down to just 2,000 tokens. This is a 98.7% reduction.

This is the market building its own immune response.

Projects die in the pilot phase because no one modeled the burn rate.
The projects that survive cannibalize budgets meant for human headcount.
The entire ecosystem is now pivoting to patch the economics before the budgets run dry.

When token spend outpaces salaries, AI stops being a software license. It becomes metered infrastructure. You pay for it exactly the way you pay for cloud compute. You optimize it exactly the way you optimize digital ad spend. The companies that survive this transition are not writing better prompts. They are treating token allocation as a supply chain problem.

We saw this exact cycle with cloud infrastructure. Cheap pilots created workflow dependence. That dependence triggered massive bills. Those bills forced the creation of FinOps and internal chargebacks. The companies that won that era built their governance before the invoice arrived.

Agentic AI is on the exact same arc. It is just moving ten times faster.

The 90-day collapse points

If AI token cost is truly shifting from a developer problem to a boardroom governance problem, the market will adapt its business models.

Here is what will prove or disprove this within 90 days.

By May 31 2026 - A major enterprise SaaS vendor abandons flat-seat pricing for AI agents in favor of a hybrid consumption model.
The collapse point hits when traditional B2B software admits they are losing money on power users and forces the token bill back onto the customer.

By June 30 2026 - A Tier-1 cloud provider acquires an independent AI routing or context compression startup. If inference is the new cloud compute, hyperscalers must natively integrate token FinOps to protect their margins.

By June 30 2026 - Two Fortune 500 companies publicly mandate human-in-the-loop constraints for internal AI agents strictly as a financial control to cap autonomous retry loops.
This proves organizations are using operational friction as a budget governance tool.

By June 30 2026 - S&P Global or Gartner downgrades near-term enterprise AI ROI citing unmodeled agentic operating costs. The 42% abandonment rate was a backward look.
The test is when analyst firms formally bake token burn into forward-looking models.

If none of these fire, my thesis is wrong. The noise is just early-adopter friction and enterprise AI economics will stabilize quietly.

But the demo always works. The meter always starts.

Where are you in this pipeline?

Again, here’s my ask.

It takes me six to seven hours of deep research and synthesis to write one of these Signals. I do not outsource the thinking.

If you aren’t subscribed, subscribe. It takes two seconds. It costs nothing. It separates the signal from the noise.

Subscribe now

If you have a voice, restack it. Let your network see the signal before the invoice arrives.

Share

And if this resonated with you, if it gave you the language to name the problem, pledge your support.

It is the only way to support the weekly Signals and influence the next deep-dive Analysis.

Key sources

• All-In Podcast Claude API token cost (Feb 2026)​

• S&P Global enterprise AI abandonment data (Feb 2026)​

• Anthropic Claude Code agent teams documentation (Feb 2026)

• Anthropic Enterprise admin controls and Claude Code limits (Aug 2025)​

• Gartner agentic AI cancellation forecast (July 2025)​

• Figma Q3 2025 earnings call transcript (Feb 2026)​

• Deloitte WSJ AI token spend dynamics (Jan 2026)​

• Paper Compute Claude Code cost analysis (Feb 16, 2026)

Europe is spending tens of billions on geopolitical sovereignty - structurally unachievable without owning chips, software or capital - driven by concerns over strategic autonomy.

Enterprise data shows only 36% of workloads actually require sovereign infrastructure.

And microGPT just proved the other 64% could build pragmatic, selective control at 1/1000th the cost.

Subscribe now

Three data points, one week, one contradiction

February 12, Andrej Karpathy releases microGPT. The algorithmic core of frontier AI in 243 lines of Python. Zero dependencies. No PyTorch. No black box.

He wrote: “I cannot simplify this any further.”

February 13, Tomasz Tunguz publishes capital rotation data. Technology companies growing 19% but stocks are flat. Energy up 17%. Materials up 16.5%. Investors rotating $600-650 billion into physical infrastructure - power, materials, construction.

At the same time, Christophe Vidal shares France’s data center arithmetic (in French):

€67 billion invested in 2025.
Trendeo projects these investments will generate approximately 2,800 direct jobs. €24 million per job.

More expensive than training an astronaut.

If the algorithm became transparent and capital is flooding infrastructure, why did Europe spend €67B and get zero economic leverage?

Politicians, investors and enterprises are solving three different problems.

None of them are talking to each other.

The algorithm became transparent

microGPT is an art project, not a production code.

243 lines of pure Python. Zero dependencies. Embeddings, multi-head attention, RMS normalization, autoregressive generation.

Anand Iyer at Lightspeed Ventures called it “The K&R of language models”.

You can read it in one sitting. Understand how LLMs work.

The algorithm is no longer a black box defended by vendor lock-in.
Any engineering team can study it.
Customize it. Deploy it for specific internal use cases.

The question shifted. From “Can we do this?” to “Should we do this for these workloads?”

Capital rotated to infrastructure before it knew algorithms were transparent

Tunguz’s data shows technology companies growing 19% revenue, 18% earnings. But technology stocks flat in 2026.

Energy: 5% revenue growth → 16% earnings = 3x operating leverage.
Materials: 8% revenue → 17% earnings.
Energy stocks up 17%, Materials up 16.5%, Industrials up 12%.

Hyperscalers spending $600-650 billion on AI infrastructure in 2026. That infrastructure needs physical assets. Power plants. Cooling systems. Rare earth materials. Construction. Land.

The capital flows to the sectors that supply the infrastructure, not the software that runs on it.

Tunguz published February 13, capturing Q4 2025 investor behavior.
microGPT dropped February 12, 2026.

Investors made a $650B bet before microGPT proved enterprises could build internal models for specific workloads.

What “sovereign cloud” actually means

€67 billion in data center investments announced in France in 2025. Trendeo projects these investments will generate approximately 2,800 direct jobs. €24 million per position.

But only 36% of enterprise workloads actually require sovereignty. The other 64% could use domain-specific models at 1/1000th the cost - the path microGPT just made visible.

But what does “sovereign” actually deliver?

Test 1. Independent from non-EU components, services, capital?

ABSOLUTELY, NO.

€50-70B of France’s €67B came from foreign capital - Brookfield (Canada), MGX (UAE). France’s largest operator, Data4, sold to Brookfield in 2023.

GPUs from Taiwan. Servers from China. Software from USA.

Nothing is sovereign here.

Test 2. Data protection - two separate legal questions

First question: Can EU personal data be transferred to US companies?

Schrems II (2020) invalidated Privacy Shield for ALL personal data. US surveillance laws don’t provide adequate protections for EU citizens’ data.

ALL personal data transfers to US now require Standard Contractual Clauses PLUS Transfer Impact Assessment PLUS supplementary technical measures. This made transfers legally complex for ordinary personal data (names, emails, addresses).

For special categories - much harder:

GDPR Article 9 covers health data, biometric data, political opinions, religious beliefs, genetic data, sex life. These require both Article 6 legal basis PLUS Article 9 exception.

German regulator BfArM declared US cloud providers “not suitable for processing personal health data”. Austrian DPA ruled Google Analytics unlawful for health websites.

For defense and critical infrastructure - sector-specific restrictions:

EU tightening restrictions on US cloud for strategic space data due to Cloud Act concerns. NIS2 Directive and EUCS certification create additional barriers for US providers in regulated sectors.

This is a GDPR data transfer restriction - separate from Cloud Act jurisdiction.

Second question: Can US authorities compel access to EU data stored by US companies?

UNFORTUNATELY, YES - regardless of physical location.

Microsoft testified under oath before French Senate in June 2025 that it cannot guarantee protection from US authorities, even for data stored in France. If compelled by US legal order, they provide the data (in French).

Cloud Act grants US authorities extraterritorial power to compel US companies to produce data “regardless of where such data is located”.

This creates a legal collision:

GDPR Article 5 requires lawful processing.
GDPR Article 32 requires appropriate security measures.
Cloud Act access violates both - foreign government gets access without EU legal process, customer notification, or GDPR safeguards.

“Jurisdiction follows the corporation, not the dirt”. If provider is US-owned, US government has legal reach even into “European” servers.

There are exceptions:

• Air-gapped (Google Distributed Cloud) - physically isolated, no network. Cannot be compelled because provider cannot access.

• HYOK (Hold Your Own Key) encryption - customer controls keys externally. Provider cannot decrypt even if compelled.

• Pure EU providers with zero US operations - not subject to Cloud Act. Must verify NO US parent company, NO US subsidiary.

Test 3. What does the market actually buy?

Gartner forecasts €23B “sovereign cloud” spending by 2027.

This forecast includes:

• US hyperscalers (AWS ESC, Microsoft EU Data Boundary)

• EU providers with US operations (OVHcloud)

• True EU-only providers (volume unknown)

• Air-gapped deployments (niche)

Gartner estimates that roughly 80 percent of sovereign cloud spending will be tied to new digital projects or legacy systems that have not yet moved to the cloud.

Only about one-fifth of existing workloads are expected to be relocated from global platforms to local or regional providers over the next several years, a process the firm describes as geopatriation.

Test 4. Who actually needs this?

I previously cited the Accenture report.

Only 36% of AI initiatives and data within European organizations require a sovereign approach.

Yet 62% are seeking sovereign solutions, with banking (76%), public service (69%) and utilities (70%) leading the charge.

The paradox is that 65% of these same organizations acknowledge they cannot remain competitive without non-European technology providers.

The Sovereignty contradiction

Europe spent €67B building infrastructure using foreign capital (Brookfield, MGX), operating on foreign hardware (Taiwan GPUs, Chinese servers), for a market where only 36% of workloads actually require sovereignty.

The “sovereign cloud” market mixes US hyperscalers - where Microsoft admits Cloud Act jurisdiction applies - with local providers, without clear legal differentiation.

Banking, public sector and utilities demand sovereignty. Then deploy 64% of their workloads on infrastructure that doesn’t deliver it.​

And microGPT revealed the pragmatic alternative: internal models for the 64% that don’t need full regulatory sovereignty. Domain-specific. Selective control. At 1/1000th the cost..

Falsifiability tests

This diagnosis rests on four testable claims. If any collapse, the entire thesis fails.

Claim 1: US hyperscaler “sovereign” offerings remain subject to Cloud Act

Falsified if a European court or independent legal analysis demonstrates that AWS European Sovereign Cloud or Microsoft EU Data Boundary successfully isolate customer data from US Cloud Act jurisdiction - contradicting Microsoft France’s June 2025 Senate testimony where they stated they cannot guarantee protection.

Claim 2: Only 36% of enterprise workloads require sovereignty

Falsified if independent enterprise surveys (not vendor-commissioned) show more than 60% of production workloads classified as “requires sovereign infrastructure due to regulatory or data sensitivity constraints” - contradicting Accenture’s findings.

Claim 3: €24M per job represents systemic inefficiency, not temporary capex phase

Falsified if French government data shows operational phase job creation (post-construction) reaches more than 10,000 direct jobs by 2027, bringing per-job cost below €7M - indicating the 2,800 figure captured only initial construction phase.

Claim 4: microGPT-style internal models are pragmatically buildable for enterprise use

Falsified if major enterprise CTO publishes cost analysis showing internal model development plus inference infrastructure costs exceed hyperscaler API costs by more than 3x for domain-specific workloads handling fewer than 10M requests per month - proving the economics don’t work at enterprise scale.

If all four claims hold, the thesis stands:

As usual, here’s my ask.

If you aren’t subscribed, subscribe. It takes two seconds. It costs nothing. It separates the signal from the noise.

Subscribe now

If you have a voice, restack it. Let your network see the signal.

Share

And if this resonated with you, if it gave you the language to name the problem, pledge your support.

It is the only way to support the weekly Signals and influence the next deep-dive Analysis.

Key sources

• Karpathy microGPT (Feb 12, 2026)

• Tunguz capital rotation data (Feb 13, 2026)

• Christophe Vidal France data centers (French, Feb 2026)

• France Datacenter official reports (2025)

• Accenture sovereign AI report (Nov 2025)

• Microsoft French Senate testimony (June 2025)

• Gartner sovereign cloud forecast (Feb 2026)

My 22-year-old daughter is studying cinema with specialization in audio design and video mixing. She is very engaged in these topics, curious about old movies, participating in creative projects at university. I asked her if she uses the new AI tools for assisting in audio or video editing.

Her answer is “No. This thing is build to erase my job.”

A few days later, we have a discussion with her 20-year-old brother. I pull up Perplexity, run a deep research on the topic, start reading it out loud.

He asks: “Where is it coming from?”

And as soon as I explain that it’s Perplexity AI who searched and compiled the summary, I see a dismissive smirk on my son’s face: “Ah. AI. I cannot trust that.”

Same week, different context. I advise a 70-years-old board member on AI strategy and the ways to approach it within the company he oversees. We dive into AI roadmap presented to him by executive committee. The deck is full of “transformation”, “copilots’, “efficiency”. His opinion can be resumed by one word:”No.”

These two groups should be opposites.

One is fighting for entry into the workforce. The other is managing a legacy exit.

One is broke and hungry. The other is wealthy and exposed.

Yet. They formed a strange alliance. They are the two groups most critical for your AI strategy.

The talent who must build it. The governance layer that must sign for it.

And both arrived at the same starting point. Not by asking “how do we implement this AI thing?” They are refusing to play the game at all.

Luddites?

No. It’s a story about rational actors reacting to a broken signal.

The Young: “You Are Stealing the Ladder”

Corporate strategie assume the “digital native” generation will adopt AI tools by default. Even faster than everybody else.

It’s a dangerous assumption.

For a young creator, coder or student, AI is not a tool. It’s a system deployed to degrade their future while lying to their face.

The Blocked Entrance

The first issue is not about being fired. It is about never being hired.

In 2025, US employers announced 54,836 job cuts explicitly tied to AI. But for a student, the real number is the hidden hiring freeze.​

He knows that the "junior" tasks - the rough mix, the first draft, the basic code - are exactly what AI solves for cheap.

If a Senior Engineer + AI can do the work of three people, the Junior role evaporates.

To a 22-year-old, the message is loud and clear:

Refusing the tool is a rejection of a system that has removed the very bottom step of the ladder.

The Theft of Apprenticeship

This leads to the second theft. The death of trial and error.

Mastery comes from doing the boring work 100 times. It comes from the "Apprentissage" - trying, failing, fixing and learning the texture of the craft.

If an AI generates a "good enough" mix in seconds, that loop is broken. The student gets the result without the struggle.

By saying "No," they are intuitively attempting to protect the only mechanism that actually builds skill - the right to do it the hard way.

The "Slop" Ecosystem

The third signal is quality.

They see the sycophantic chatbots. Ask ChatGPT for an analysis, and it gives a smooth, hallucinated answer that gets you punished by the professor.

They see the AI slop on the front page of MSN - AI-generated junk falsely claiming 22,000 layoffs at Microsoft.​

When my son says, "Generated by AI. I cannot trust that," he is applying a quality filter. In 2026, the "AI" label signals:

Share The Crux

The Old: “You Are Lying About the Risk”

The 70-year-old Director does not care about sound design. He cares about the audit committee.

While the CEO talks about "speed," the Director looks at the Risk Register.

The Capex Reality

He sees the bill.

Hyperscalers project $600 billion in capex for 2026, with 75% tied to AI.​
Amazon guided to ~$200 billion. Alphabet targets $175–185 billion.

To a seasoned director, this looks like a trap. He knows hardware depreciation is brutal. He knows "if we build it, they will come" is a dangerous strategy.
He sees a disconnect between the cost of the plumbing (trillions in GPUs) and the value of the water (subscription revenue).

He refuses to sign off on unquantified debt.

The "Greater Fool" Exit

He looks at the numbers behind the unicorns.

Their valuations soaring ($500B?) while profitability remains a distant promise.

He saw the Dot-com crash, so the rush to IPO looks less like value creation and more like a risk transfer.

It looks like early investors are rushing to hand the infrastructure bill to the public markets.
To the "greater fools."

That means his company's pension fund, his retail investors.

His "No" is a refusal to be the exit liquidity for a hype cycle.

The Regulatory Deadline

Finally, he looks at the calendar.

It is February 2026. The EU AI Act looms large. By August 2026, obligations for high-risk systems become fully enforceable.

For a global industrial firm, this is not simply a European problem. It is a global standard.

He sees liability shifting. If a hiring algorithm discriminates or a safety system fails, it becomes a breach of law.

When the CEO brings him a pilot with no governance framework, he doesn't see "innovation." He sees Governance Debt.

And he knows he is the one who will have to pay it.

A Strategy Built on the “Thin Middle”

Once again, most corporate AI strategies rely on a dangerous assumption.
They assume the resistance is in the middle - the “frozen layer” of middle management - and that the top (Board) and bottom (Gen Z) are natural allies.

The reality is quite the opposite.

At the bottom, your future builders opt out to protect their craft and their ladder. They distrust the tool because it steals their learning. And their future.

At the top, your sponsors opt out to protect the firm. They distrust the roadmap because the cost is unproven. The governance is not put in place.

You are left with a strategy that relies entirely on the "Thin Middle". Enthusiastic vendors, consultants, and ambitious VPs who need the AI project to justify their promotion.

This is a real bubble.

The 90-Day Test

This alliance is temporary. It can be broken. But not with some training or hype.
You have to fix the broken signal.

Test 1: The Apprenticeship Pivot

Watch your hiring.

If you stop hiring Juniors because “AI does it,” you are burning your future pipeline.
The companies that win will redefine the Junior role - not as “AI Operator,” but as “Apprentice with Superpowers.”

You must give them back the ladder.

Test 2: The Pilot Freeze

Watch the internal budget approvals in March/April.

Boards are no longer signing off on “learning budgets.”

If your Board demands a fully costed risk framework before approving the next AI pilot budget, that is the Governance signal.

The days of “innovation grants” are over. The days of “audit-ready deployment” are coming.

Test 3: The ROI Reality Check

Watch the Q1 earnings calls in April.

Ignore the hyperscalers and chipmakers(who sell “the shovels”. Look at the customers - the banks, retailers, industrials.

If they start slowing down on AI spend because the pilots didn’t scale, the Board’s checkbook will no longer be accessible.

The “greater fool” theory will be tested not at the IPO, but on the P&L of the Fortune 500.

The Final Signal

My son and my client have nothing in common, except one thing.
They both have a high detector for bullshit.

The 22-year-old smells it in the stolen apprenticeship and the sycophantic chatbots.
The 70-year-old smells it in the capex projections and the “greater fool” valuations.

They are sending the same signal.
They are saying “No” to the lie.

If you want them to build your future, stop selling them a story they can see through.
Start with the truth.

Or get used to the word “No.”

Here’s my ask.

If you aren’t subscribed, subscribe. It takes two seconds. It costs nothing. It separates the signal from the noise.

Subscribe now

If you have a voice, restack it. Let your network see the signal.

And if this resonated with you, if it gave you the language to name the problem, pledge your support.

It is the only way to support the weekly Signals and influence the next deep-dive Analysis.

Sources

• Challenger, Gray & Christmas - January 2026 Job Cut Report, Feb 5, 2026

• Forrester Research / TechCrunch - Are layoffs really driven by AI? Or is it just 'AI-washing'? Jan 2026

• Reddit r/microsoft - AI generated crap showing up on MSN front page, Jan 26, 2026

• Thomas Tunguz - The Other Leverage in Software & AI, Feb 4, 2026

• Amazon Q4 2025 Earnings / 2026 Guidance

• Alphabet Q4 2025 Earnings / 2026 Guidance

86% of employees use AI weekly for work. 49% use tools their employer banned. ChatGPT Free (blocked by IT departments, used by staff anyway) caused 87% of enterprise data exposures in 2025.

Last week, Amazon negotiated a $50 billion investment in OpenAI. Claude Code crossed $2 billion in annual recurring revenue. Anthropic raised $20 billion at a $350 billion valuation.

Frontier models sell intelligence. Enterprises buy sovereignty. Employees bypass the firewall to get the intelligence.

Shadow AI is not a compliance failure, but a proof that the architecture trilemma remains unsolved today:

And when enterprises cannot solve it, employees bypass controls to get work done.

The Enterprise AI Paradox

Europe announced accelerated efforts to reduce dependence on US Big Tech. Ursula von der Leyen called it a “structural necessity” for technological autonomy. The Conversation reported: “As the US increases political pressure on Europe, it’s possible to imagine the continent losing access to key computing services.”

The European Commission outlined €93 billion in retaliatory counter-tariffs targeting US tech companies. Germany and France endorsed the Anti-Coercion Instrument
(a regulatory “bazooka” originally designed to counter China), now aimed at the United States.

Forrester’s shared 2026 predictions: “Organizations in both private and public sectors will intensify efforts to minimize reliance on non-European entities, including American platforms, large language models, and hyperscalers.”

Meanwhile, 49% of enterprise employees use unapproved AI tools. Approved enterprise solutions - hardened, compliant, on-premise - are too weak compared to frontier models. So employees violate policy, paste proprietary data into GenAI chats and expose corporate secrets to external vendors.

Andy Jassy and Sam Altman negotiate a $50 billion investment. Enterprise CISOs block OpenAI APIs. Employees use them anyway.

Two capital flows. One system reorganizing.

The Trilemma That Creates Shadow AI

Enterprises face three critical requirements for AI deployment:

Intelligence: Frontier model capability (Claude Sonnet 4.5, GPT-5, Gemini) for coding, reasoning, complex tasks. These models that are smarter, not just faster.

Sovereignty: Data control, no leakage to external vendors, compliance with GDPR/EU AI Act, geopolitical independence.

Affordability: Enterprise-scale deployment at $10K-$50K/month, not $500K-$2M/year

As of today, you can have two. Not three.

Option A: Sovereignty + Low Cost (SLMs On-Premise) → Intelligence FAILS

On-premise small language models (7-20 billion parameters) solve sovereignty and cost. Data never leaves the enterprise perimeter. Infrastructure costs $6,000-$15,000/month. Compliance teams approve. Legal risk drops.

For routine tasks - document classification, customer service chatbots, data entry automation - SLMs are sufficient. NVIDIA analysis says that SLMs can handle 40-70% of enterprise AI tasks without requiring frontier capability.

But for coding, SLMs fail.

Claude Sonnet 4.5 achieves 77.2% on SWE-bench (software engineering benchmark). IBM Granite and Microsoft Phi-3-mini - despite costing 10-23x less - cannot compete. Anthropic's 2026 Agentic Coding Trends Report shows that enterprises using Claude Code achieve 26-55% productivity improvements. A Google principal engineer stated Claude "reproduced a year of architectural work in one hour."

The ROI justifies the cost. $100K-$200K per developer salary × 30-50% productivity gain = $30K-$100K annual value per developer. Frontier models pay for themselves in coding.

The failure happens when enterprises deploy SLMs on-premise for all tasks to maintain sovereignty. Developers lose the 30-50% productivity gain. They know frontier models exist. They know Claude Code works better.

So they bypass the firewall. They paste code into GenAI chat. They violate policy to get their job done.

As result,

Shadow AI adoption by 49% of employees.
It means that the aimed sovereignty is simply a theater, not an actual reality.

Option B: Intelligence + Cost (Cloud Frontier APIs) → Sovereignty FAILS

Cloud APIs (e.g., OpenAI, Anthropic, Google) deliver frontier capability at pay-per-use pricing. $3-$10 per million tokens. For a company processing 10 billion tokens monthly: $30K-$100K/month is affordable at enterprise scale.

Intelligence is guaranteed. Claude Code, Cursor, other coding agents all use frontier models. 77% SWE-bench performance. Coding productivity jumps 30-50%.

But data flows to external vendors. Every API call sends proprietary information outside the enterprise perimeter.

Three sovereignty failures compound:

First: Training risk.

ChatGPT Free was responsible for 87% of sensitive data exposure incidents in 2025. Enterprises using cloud APIs without explicit “training opt-out” clauses risk their proprietary data becoming training material for competitors’ models.

Second: Regulatory exposure.

CNIL (French privacy regulator) published guidelines January 2026 requiring anonymization before LLM training. EU AI Act enforcement begins August 2026, with penalties up to €35 million or 7% of global turnover. Using US cloud APIs without contractual guarantees IS regulatory violation.

Third: Geopolitical cutoff risk.

France24 reports that “The EU depends on non-EU nations for over 80% of its digital products, infrastructure, and intellectual property.” If EU-US tensions escalate, enterprises relying on US cloud APIs face sudden access loss.

The pattern is already visible. On January 26, 2026, France’s Ministry of Public Service announced the phasing out of Microsoft Teams, Zoom, and Google Meet for all public administration, replaced by “Visio,” a sovereign state-developed platform. Full migration target is set on 2027.

If government ministries cannot trust US video conferencing tools, why would enterprises trust US AI APIs with trade secrets?

As result,

Sovereignty risk is unacceptable for competitive moat data, such as, proprietary algorithms, customer information, pricing models, strategic plans.

Option C: Intelligence + Sovereignty → Affordability FAILS

Deploy GPT-4 or Claude Sonnet on-premise, air-gapped, zero external network access. Data stays sovereign. Performance matches frontier cloud APIs. Intelligence guaranteed.

The cost structure kills adoption.

GPU clusters capable of running frontier models: $200K-$800K upfront hardware. Enterprise licensing from OpenAI/Anthropic: $100K-$500K annually. Infrastructure maintenance, security hardening, model updates: $200K-$700K per year.

You have to be ready to shed $500K-$2M annually for a single deployment.

For a Fortune 500 company with 10,000 developers, the math works: $2M infrastructure ÷ 10,000 users = $200/developer/year. ROI justified when each developer gains $60K-$200K in productivity value.

For a mid-market company with 100 developers, the math breaks: $2M infrastructure / 100 users = $20,000/developer/year. No CFO approves that capex when cloud APIs cost $50-$100/developer/month ($600-$1,200/year).

As result,

Only Fortune 500, government agencies and defense contractors can afford sovereign frontier models.
The remaining 90% of enterprises face the trilemma with no escape route.

Three Incompatible Architectures

The trilemma is forcing enterprises toward three incompatible solutions, each aligned with a different geopolitical bet.

Architecture A: CSPs Build Sovereign Regions

AWS, Microsoft Azure and Google Cloud are building EU-sovereign regions with contractual promises of zero US government access. AWS Sovereign Cloud launched for EU government workloads in 2024. Azure announced its EU Sovereign Cloud the same year. Google Cloud Germany offers data residency guarantees with servers that never leave German territory.

The pitch: keep your existing cloud provider relationship, keep frontier model access, but route everything through European data centers legally protected from US intelligence agencies.

This solves sovereignty. At least on paper. Data stays in EU jurisdiction. No Cloud Act exposure, no FISA 702 surveillance. Frontier models (GPT-5, Claude, Gemini) deploy in these sovereign regions, so intelligence is preserved.

But affordability breaks. Enterprise-scale sovereign cloud deployments cost $300K-$1M annually. That’s 3-10x more expensive than standard multi-tenant cloud pricing because you’re paying for dedicated infrastructure, legal guarantees, and compliance overhead.

There’s also a deeper problem.

Legal experts remain skeptical. Amazon, Microsoft, and Google are still subject to US law. If the US government issues a national security directive, can AWS genuinely refuse? The contractual language says yes. The reality says “maybe”.

Architecture B: Migration to European Providers

OVHcloud (France), Scaleway (France), Hetzner (Germany) and Aruba Cloud (Italy) position themselves as the alternative. As fully sovereign infrastructure with no US ownership, no US parent company risk and 100% EU jurisdiction.

On January 26, 2026, the EU AI GRID launched in Vilnius, Lithuania, pitched as “Europe’s first sovereign AI infrastructure network designed specifically for EU AI Act and GDPR compliance.”

This solves sovereignty completely. No legal ambiguity. European providers answer only to European courts.

European providers are 30-60% cheaper for general-purpose compute and storage, primarily because they don’t charge egress fees and operate simpler pricing models without hidden costs. AWS’s economy of scale advantage applies to specialized managed services (RDS, Lambda, EKS), but for basic infrastructure - the foundation most enterprises need for sovereignty - European alternatives cost less.

But intelligence fails. Sovereign providers don’t have partnerships with frontier model makers. OpenAI, Anthropic, and Google won’t deploy their latest models on OVH infrastructure. You can run open-source models (Mistral, Llama), but those lag frontier capability by 6-12 months. For coding - the killer app that justifies frontier model costs - sovereign providers can’t compete.

Migration is also painful. Enterprises must rebuild infrastructure, retrain teams, renegotiate vendor contracts and accept 12-24 month timelines. Most won’t move unless forced by regulation or geopolitical crisis.

Architecture C: Hybrid Split

Enterprises run two parallel AI stacks, each optimized for different threat models.

The Innovation Layer runs in the cloud on frontier models. Coding agents (Claude Code, Cursor, etc) operate in sandboxed environments with no access to production data. Developers prototype, experiment and build using GPT-5 or Claude Sonnet. Training opt-out clauses are mandatory in every contract. The data flowing through this layer is ephemeral . Only code snippets, design mockups, architectural diagrams. Nothing proprietary, nothing customer-facing.

The Production Layer runs on-premise with fine-tuned small language models. Customer data, proprietary algorithms, competitive moat workflows - everything strategically sensitive - stays local. Mistral-7B or Phi-3 models, fine-tuned on internal data, handle production operations. Zero external network access. Air-gapped deployment. Sovereignty guaranteed.

This validates the System 2 framework I described in December 2025: enterprises need two parallel verification systems for AI outputs.

The Innovation Layer allows System 1 speed and drafting for non-critical work, coding prototypes, brainstorming sessions, sandbox experimentation.

The Production Layer enforces System 2 verification and control for customer-facing systems, proprietary algorithms and competitive moat data.

Shadow AI appears when enterprises deploy only System 2 - hardened, slow, restricted - without providing a legitimate System 1 outlet. Employees bypass controls because they need both systems, not one.

The hybrid architecture solves all three requirements: intelligence for innovation, sovereignty for production, affordability through selective deployment. Total AI spending increases, but frontier model share drops from 70% to 30% of budget. You’re not paying for frontier APIs on routine work. You’re reserving them for high-value tasks where the ROI justifies the cost.

There’s a catch though.

Permanent architectural complexity:

Two infrastructure stacks.
Two security models.
Two compliance frameworks.
Two vendor relationships.
Two training programs.

The operational overhead is real, but for enterprises caught in the trilemma, it’s the only path that doesn’t sacrifice a critical requirement.

The Workforce Shift: AI Engineering Replaces Commodity Coding

By early 2026, LinkedIn ranked “AI Engineer” as the fastest-growing job title on the platform. The role didn’t exist five years ago. Now it impacts 20-40% salary premiums, as senior AI engineers average $180K-$350K compared to $150K-$180K for traditional software engineers at comparable experience levels.

But the real story isn’t salary inflation. It's what developers actually do now versus what they used to.

Five years ago, a developer's job was predictable: write code, test it, ship it.

Today? That's changing. Developers spend more time orchestrating AI systems - reviewing what the model generates, catching logical errors, steering it toward production quality.

David Heinemeier Hansson, creator of Ruby on Rails, tested AI coding agents in production and reported they're now "fully capable of producing production-grade contributions to real-life code bases." Not prototypes. Production code. But he's careful to add: what arrived is "supervised collaboration", when humans stay responsible for direction, quality and long-term coherence.

Meanwhile, developers who haven’t adapted - who still write boilerplate the old way -are experiencing something they didn’t expect: wage stagnation. Between 2018 and 2024, base pay for developers rose 24%, trailing the 30% average increase for all U.S. workers. Meanwhile, AI-focused engineers got 12-15% increases year-over-year. The market is ruthless about rewarding the adaptation.

The Pragmatic Engineer newsletter captured it plainly in January 2026: “Prototyping, being a language polyglot or a specialist in a stack are likely to be a lot less valuable, looking ahead.” The value shifted toward something harder to teach - tech judgment, product sense, the ability to read what an AI system produced and know if it’s actually correct for the business.

And here's the most uncomfortable part.

New college graduates now face higher unemployment than the general workforce - 5.8% vs 4% in Q1 2025. That's a flip from historical norms where Computer Science grads always had lower unemployment. The gap widened because entry-level positions contracted while senior AI-augmented roles expanded.

A ManpowerGroup study found 78% of IT job postings now list AI expertise as a requirement—not optional. Morgan Stanley Research projects total developer headcount growing, but they're explicit about the shift: "developers are increasingly acting as curators, reviewers, integrators and problem-solvers - making them more strategic and valuable."

Let me translate this.

It needs developers who can decide when to trust AI, when to override it and how to build systems where humans and machines actually work together instead of fighting each other.

Shadow AI emerges when companies restrict AI tools without providing legitimate channels. Developers bypass controls because they’ve seen 30-35% productivity gains and won’t voluntarily regress to pre-AI speeds.

The smart response isn’t prohibition. It’s building the hybrid architecture I described earlier:

legitimate Innovation Layer for experimentation,
locked Production Layer for customer-facing systems, and
workforce training so engineers can operate across both.

The talent market is pricing this fiercely. Companies that solve the sovereignty trilemma - EU infrastructure, frontier model access, reasonable cost - while also letting developers use AI tools will win the global engineering talent war.

Companies that force developers to choose between compliance and capability will hemorrhage their best people to competitors who figured out the hybrid.

The Falsifiability Test: Three Scenarios

By May 31, 2026, one of three things will prove this diagnosis wrong or validate it completely.

Scenario 1: The Migration Signal.

A Fortune 500 European enterprise announces production AI workload migration to OVH or Scaleway, explicitly citing sovereignty concerns.

This signals the trilemma is real. Enterprises are willing to accept migration pain, vendor risk and capability loss to solve the sovereignty constraint. It means AWS/Azure/Google failed to credibly solve the problem contractually. If this doesn’t happen, the sovereignty concern may be theoretical, not operational.

Scenario 2: The CSP Sovereign Pivot.

AWS, Azure or Google Cloud announces AI-specific sovereign regions with three non-negotiable guarantees:
- data never leaves EU jurisdiction,
- contractual exemption from US government access under Cloud Act and FISA 702,
- frontier model deployment (Claude, GPT-5, Gemini) available on day one.

This would make migration unnecessary. Enterprises stay with their incumbent vendors. The trilemma gets solved through contractual architecture, not infrastructure migration.

Scenario 3: The Analyst Benediction.

Gartner or Forrester publishes enterprise AI deployment guidance in Q2 2026 explicitly recommending hybrid architecture as the standard practice for European enterprises:
- innovation layer (cloud-based frontier models)
- production layer (on-premise fine-tuned SLMs)

Analyst adoption signals the market has internalized the forced split I described. It becomes doctrine, not controversy.

If none of these signals appear by the end of May, the diagnosis fails. Either the sovereignty constraint isn’t forcing reorganization, or enterprises are tolerating the status quo longer than the business logic predicts. Either way, the trilemma isn’t the crux.

The market will tell us by May 31, 2026.

Here is the deal.

If you aren’t subscribed, subscribe. It takes two seconds. It costs nothing. It separates the signal from the noise.

If you have a voice, restack it. Let your network see the signal.

And if this landed for you, if it gave you the language to name the problem, upgrade to Paid.

It is the only way to support the weekly Signals and influence the next deep-dive Analysis.

Subscribe now

Sources

• Shadow AI Threat Grows Inside Enterprises as BlackFog Research Finds 60% of Employees Would Take Risks to Meet Deadlines, Business Wire, Jan 27, 2026, BlackFrog report PDF

• Amazon could invest up to $50B in OpenAI, CNBC, Jan 29, 2026

• Anthropic's Claude Code is having its 'ChatGPT' moment, Uncover Alpha, Jan 26, 2026

• Europe's digital reliance on US Big Tech, France 24, Jan 24, 2026

• AI has already added 1.3 million new jobs, according to LinkedIn data, WEF, Jan 15, 2026

• Promoting AI agents, David Heinemeier Hansson, Jan 7, 2026

• AWS Launches AWS European Sovereign Cloud and Announces Expansion Across Europe, Business Wire, Jan 15, 2026

• Microsoft strengthens sovereign cloud capabilities with new services, Microsoft Blog, Nov 4, 2025

• EU AI GRID Launched at Iconic Vilnius TV Tower, Yahoo Finance, Jan 23, 2026

The World Economic Forum’s official theme for 2026 is “A Spirit of Dialogue.”

Over 3,000 delegates from 130 countries, including close to 65 heads of state and government, arrived in Davos to discuss cooperation, growth, investment in people, innovation and planetary boundaries. They assembled in halls with the infrastructure of global governance - the stage, the cameras, the translators, the carefully curated panel discussions.

While sessions officially debated “AI Safety and Regulation,” Amazon announced finalizing 30,000 job cuts and the stock market hit record highs.

While panels discussed "Global Cooperation," the anti-cooperation scandals were happening in real time:

• French President Emmanuel Macron left Davos early rather than meet Trump, declaring “It’s a shift towards a world without rules. Where international law is trampled underfoot and where the only law that seems to matter is that of the strongest."

• ECB President Christine Lagarde walked out of a high-profile dinner after US Commerce Secretary Howard Lutnick mocked European economies as underperforming.

• Denmark boycotted the forum entirely over Trump's Greenland threats.

• A scheduled bilateral between Trump and German Chancellor Merz was cancelled as tariff threats escalated - 10% rising to 25% by June.

While sessions covered "Sustainable Energy," Meta announced landmark nuclear deals powering the AI buildout, with Google and Amazon accelerating existing nuclear commitments.

The Signal from Davos 2026 is not that the elite finally “got real.”

The Signal is that they are discussing the WRONG problem using the WRONG framework while the actual restructuring happens in a parallel dimension they cannot see.

The Official Agenda (And What It Ignored)

The official agenda listed over 200 sessions across five days.

AI and Labor Sessions covered "Future of Work," upskilling, AI safety and human-centric innovation.

The US tech sector cut 150,000 jobs in 2025 to fund compute infrastructure.
Entry-level hiring is frozen. Middle management is being purged.
Companies are betting that a smaller, exhausted workforce can bridge to the AI future by simply working faster.

The panels discussed how to "invest in people." The P&L statements showed the opposite. No reconciliation occurred.

Geopolitics and Trade Sessions addressed "Rules-Based Order," multilateralism and trade cooperation.

Trump announced a parallel system called the Peace Board with UN-like powers but under his control.
He threatened to buy Greenland.
Europe scrambled to deploy soldiers and organize emergency coalitions.
Trump demanded NATO spending hit 5% of GDP and granted exclusive rare earth access to US companies.

The "rules-based order" was replaced by "chaos as leverage." The panels discussed upholding institutions. Those same institutions were being dismantled in real time.

The WEF's own Global Risks Report identified "geoeconomic confrontation" as the top global threat - with tariffs, supply chain weaponization and economic coercion replacing traditional diplomacy.

Zelenskyy delivered a speech demanding more resources for Ukraine while the continent has already committed $100+ billion in aid, equipment and supplies since 2022. This commitment was made without reciprocal accountability or visible progress toward negotiation. His appearance was performative grievance, not strategic engagement. Europe listened in silence, trapped between the appearance of support and the fatigue of endless extraction.

Elon Musk appeared at Davos for the first time, predicting robots will outnumber humans and offering to "fix everything."

Jamie Dimon hedged his bets carefully, praising Trump while warning of "economic disaster."

He Lifeng (China's vice premier) arrived late and warned against trade wars while observers noted the delay as a signal of deliberate disrespect.

European leaders (Von der Leyen, Merz, Macron) showed visible panic, rushing to assemble "European defense."

The Framework Gap

Davos operates on a fundamental assumption that global problems can be solved through dialogue, cooperation and institutional reform.

This assumption was true from 1971 to 2015.

In 2026, it is false.

The actual restructuring of the global system is not happening through negotiation.

It is happening through capital reallocation, energy consolidation and geopolitical coercion.

Capital Reallocation

Companies are cutting labor to fund compute infrastructure. The stock market rewards this. The workforce becomes structurally irrelevant to corporate growth. Amazon's job cuts demonstrate the model:

Eliminate the operational layer of project managers, coordinators, middle management, then reallocate the budget to Capex - GPU Clusters, Data Centers.

Energy Consolidation

Tech giants are securing nuclear plants as private utilities, bypassing public grids entirely. On January 9, Meta signed agreements with Vistra, TerraPower and Oklo to secure 2.6 GW by 2035.

These are not energy procurement deals. These are sovereignty moves.
When Tech becomes its own utility, the public grid becomes secondary.

Geopolitical Coercion

Trump uses chaos as leverage to extract minerals from Greenland, push military spending to NATO’s 5% of GDP target. Political realignment through his Peace Board.

He does not negotiate the old way. He threatens the impossible to get the necessary.

On November 10, 2026, China’s “temporary pause” on rare earth export bans expires. Beijing can turn off the lights whenever it chooses.

None of these are dialogue problems. They are structural power problems requiring capital, minerals and leverage.

In 2026, everyone can finally stop pretending Davos ever worked.

The 90-Day Collapse Points

Watch what happens in the next 90 days, because Davos decisions will be irrelevant to the actual moves:

RTO Purge

Companies cannot legally fire 15% of their workforce without triggering WARN acts. They will use “Return to Office” mandates as constructive dismissal. Voluntary attrition will spike in Q1.

By April, the barbell structure with few architects at top, gig-workers at bottom will be visible in tech org charts.

Nuclear Consolidation

Another hyperscaler will announce direct ownership or 20+ year contracts for nuclear generation. When that happens, the “public grid” becomes a relic.

Tech becomes a sovereign utility.

Greenland Treaty Details

The “framework of a future deal” is intentionally vague. As specifics emerge - mineral rights, defense arrangements, sovereignty questions, exclusivity terms - new conflicts will surface. Denmark will resist. Brussels will demand involvement. Trump will demand acceptance.

This becomes a proxy war over Arctic jurisdiction.

NATO 5% Shock

European governments will begin announcing defense spending targets hitting 5% of GDP. This triggers domestic political backlash (voters questioning military budgets), capacity constraints in defense contractors (they cannot scale production fast enough) and currency pressures (massive sovereign spending in a weakened Euro environment).

By April, the first European government will face a political crisis over the spending commitment.

The Verdict - What Davos Actually Is

Davos has never been about solving problems. It has always been about being seen as important enough to be in the room where problems are discussed.

Macron, Lagarde, Zelenskyy, Musk, Dimon and others came for stage time and off-stage access - to position themselves in the conversation without committing to action. They negotiated their relevance. They performed their importance. They left without deciding anything.

Trump knew better. He announced decisions that were already made - the Greenland framework, the 5% NATO demand, the Peace Board.

Because Davos is where you tell the world what you've already decided.

So if you watched the clips and felt anxious about “Hard Truths” being discussed - stop. The signal was not on the stage.

The signal is that the stage no longer matters. The restructuring of labor, energy, geopolitics is decided elsewhere.

Stay alert. Stay conscious. Do not panic.

Build your own shelter.

The global institutional order is ending. We are now in the fragmentation phase.

Here is the deal.

If you aren’t subscribed, subscribe. It takes two seconds. It costs nothing. It separates the signal from the noise.

If you have a voice, restack it. Let your network see the signal.

And if this landed for you, if it gave you the language to name the problem, upgrade to Paid.

It is the only way to support the weekly Signals and influence the next deep-dive Analysis.

Subscribe now

Sources

• Meta Nuclear Energy Announcements

• Tech Sector Job Eliminations 2025

• Trump Framework Agreement on Greenland and NATO

• Amazon 30,000 Corporate Job Cuts Announced

• China’s New Rare Earth and Magnet Restrictions Threaten U.S. Defense Supply Chains

• How Will China’s Rare Earth Export Controls Impact Industries and Businesses?

• WEF Global Risks Report 2026

This morning, the World Economic Forum opens in Davos with a darkness rarely seen in its 56-year history. The just-released Global Risks Report 2026 has ranked "Geoeconomic Confrontation" as the #1 threat to stability, followed immediately by "Misinformation and Disinformation" at #2.

But while they debate in Switzerland, the market has already distributed the weapon for this war.

The “Information Weapon” they fear - the ability to generate undetectable, biometrically-perfect synthetic identities - is not restricted to the GRU or the CIA. It is not a state secret.

As of January 2026, it is a $7.99 consumer subscription.

The paradox is scale. While Davos debates "Geopolitics," the market has finished the commoditization. The "Deepfake" is no longer a complex media problem. It's a cheap tool. And the horror is in the banality of the price.

When “Reasoning” Meets “Motion”

To understand why this is different from last year, we must look at the technical stack. In 2025, “Deepfakes” were visual replacements - masks that sat awkwardly on a face, prone to jittering if you turned your head too fast. They failed the “Liveness Check” because they couldn’t respect physics.

That limitation ended with the fusion of two specific technologies.

The Mask: Gemini 3.0 (Nano Banana Pro)

Google’s Gemini 3.0 architecture (powered by the Nano Banana Pro model) introduced "Physics-Based Topology" to image generation. Unlike previous models that simply predicted pixels based on statistical likelihood, Gemini 3.0 understands 3D topology and lighting physics. It models the bone structure and the way light hits the skin.​ Perfectly.

As consequence, it generates a synthetic identity that passes the texture analysis algorithms used by standard ID scanners. The “Mask” is now mathematically indistinguishable from a photo.

The Driver: Kling 2.6 Motion Control

Released in December 2025, Kling 2.6 introduced “Motion Control”. This feature allows a source video to “drive” a target image.​

Now, an attacker can sit before a webcam and perform the specific “liveness gestures” (blink twice, look left, nod) required by a banking app or onboarding platform. The software maps these micro-movements onto the synthetic Gemini face in near real-time.

The result is a “Puppet” that follows orders. When the banking app says “Smile,” the attacker smiles, and the synthetic face smiles with perfect biometric fidelity. The cost to assemble this stack is approximately $8 per month.

The “Binding” Crisis

The failure is not in the government ID. It is a Camera Injection Attack targeting the Binding Layer.

According to the industry standard defined by Regula Forensics, remote identity verification operates on a strict 5-step “Holistic Workflow”.​

The Kling/Gemini stack exploits the transition between Step 3 and Step 4.

The Standard Logic Chain (in Regula Taxonomy):

Step 1: Document capture: The attacker uploads a high-resolution scan of a real stolen ID. Result: Pass.

Step 2: Document authentication: The system verifies holograms and VIZ data on the stolen ID. Result: Pass.

Step 3: Biometric capture (The Breach)

• The Requirement: The user must prove presence via “active liveness detection” - turning head, blinking.

• The Exploit: The attacker uses Kling 2.6 Motion Control to drive the synthetic face. Because the motion is fluid and the lighting is physically consistent (Gemini 3.0), the Liveness algorithm validates the feed as human.

Step 4: Face matching

• The Requirement: The system compares the “Live” face (Step 3) to the ID Document (Step 2).

• The Exploit: Because the synthetic face was generated from the ID photo using Gemini 3.0, the mathematical resemblance is perfect.

Step 5: Risk scoring

• The Result: The system sees a valid ID, a “live” person, and a perfect match. It generates a “Low Risk” score.

The system has just on-boarded a ghost for around $20.

The End of Remote Trust

The implications go far beyond credit card fraud.

The “Return to Office” (RTO) Mandate becomes a Security Protocol

For five years, the debate over RTO has been cultural (”collaboration vs. flexibility”). In 2026, the debate ends.

If a CIO cannot be sure that the person logging into the VPN is the employee they hired, the risk profile of remote work becomes unsustainable.

The Scenario

A “Ghost Employee” is hired remotely.
They pass the video interview using the Kling stack.
They receive the laptop. They access the repo.
They exfiltrate the data. They disappear.

The Policy Shift

Companies will be forced to bifurcate their workforce.
High-trust roles (developers, finance, strategy) will be recalled to the office not for “culture,” but for biometric certainty.
You cannot fake a badge swipe.
The office becomes the only “Verified Zone” left.

The End of the “Video Selfie” Economy

The entire gig economy - Uber, Airbnb, Upwork, OnlyFans, etc. - relies on low-friction video verification to scale.

If “Liveness” is broken, these platforms face a choice:

• Accept the Fraud: Allow a percentage of their supply side to be synthetic, bots driving accounts.

• Kill the Friction: Introduce hardware keys (YubiKeys) or in-person checks (Post Office verification), which kills their growth loops.
  The “frictionless onboarding” era is over.

The Geopolitical "Denial of Reality"

This is the "Geoeconomic Confrontation" Davos fears.

If video proof of identity can be forged for $15, then real video proof can be dismissed as a forgery.
In the coming "Information Cold War," this tool allows any state actor or corporation to dismiss inconvenient evidence - a war crime, a protest, a whistleblower statement - as "just another Kling render."

The danger is not just that we believe the lie. It is that we lose the ability to prove the truth.

When everything could be fake, nothing is real.

The 90-Day Collapse Points

If this diagnosis is correct, we will see the following specific breaks by April 2026:

Test 1. The “Ghost Hire” Disclosure

Watch for a Fortune 500 company to publicly admit to a data breach caused by a synthetic employee who passed video onboarding. This will be the “Patient Zero” event for the new RTO wave.

Test 2. The KYC Liability Shift

Watch for a major neo-bank (Revolut, Monzo, or Chime) to introduce a mandatory “NFC-only” onboarding tier (requiring a chip passport scan), effectively admitting that video verification is compromised.

Test 3. The RTO Pivot

Watch for a major tech CEO to cite “Security and Identity Verification” instead of “Collaboration” as the explicit reason for a strict 5-day office mandate in Q2.

The Verdict

The “Blue Checkmark” era of digital identity - where a verified account meant a verified human - is ending.

The delegates in Davos are drafting treaties for a war that has already been lost in the app store.

We are entering a Zero-Trust Internet, where the only proof of humanity is physical presence. If you didn’t shake their hand, you didn’t hire them.

Here is the deal.

If you aren’t subscribed, subscribe. It takes two seconds. It costs nothing. It separates the signal from the noise.

If you have a voice, restack it. Let your network see the signal.

And if this landed for you, if it gave you the language to name the problem, upgrade to Paid.

It is the only way to support the weekly Signals and influence the next deep-dive Analysis.

Subscribe now

Sources

This signal analysis is based on a forensic review of software release notes, cybersecurity risk assessments, and verified financial fraud reports. All technical claims are grounded in primary documentation from the relevant vendors and industry bodies.

• Global Risks Report 2026 (World Economic Forum, Jan 14, 2026): Ranking “Geoeconomic Confrontation” and “Misinformation” as the top global risks, establishing the Davos agenda context.​

• Gemini 3.0 / Nano Banana Pro Documentation (Google DeepMind, Late 2025): Technical verification of the “Thinking Mode” architecture and its ability to generate physically consistent 3D topology in image synthesis.​

• Kling 2.6 Release (Kuaishou, Dec 2025): Release of the “Motion Control” feature, enabling source-video-driven animation of static images.​

• Remote Identity Verification 101 (Regula Forensics, Sep 2025): Industry-standard definition of the 5-step verification workflow, establishing the specific “active liveness” requirement.​

• AI-powered Liveness Detection Software (Sumsub, Sep 2025): Technical detailing of the specific biometric checks (landmark analysis, texture verification) used in standard KYC, confirming the vulnerability to physically consistent 3D masks.​

• 2026 Identity Fraud Forecast (Experian, Jan 2026): The rise in “synthetic identity” fraud and its impact on remote hiring and financial onboarding.