The Signal

A weekly read for operators thinking seriously about AI. Less noise, more signal.

The Lead

Nobody is coming to govern your AI

This month produced a remarkable amount of AI governance news, and almost none of it will govern your AI.

A prominent lab CEO proposed a US oversight body modeled on the financial regulator FINRA, built to vet frontier models thirty days before release, and wants it operational by year end. In the same stretch, twenty-nine countries — notably excluding the US and Western Europe — signed an agreement to form a new AI cooperation body headquartered in Shanghai. Two governance regimes, incompatible with each other, forming in the same month. The trade press covered both as milestones. For an operator deciding whether to ship an AI system next quarter, both are close to irrelevant.

Here is the distinction the coverage misses. External regulation governs whether you are allowed to deploy. Internal governance determines whether the deployment actually works — whether it survives contact with your data, your edge cases, your users, and the drift that sets in three months after launch. Those are different problems, and only one of them is anyone else's to solve. Waiting for a regulator to hand you the second kind of governance is waiting for something that is not coming, because it cannot come from outside. Nobody writes your data governance but you. Nobody sets your acceptable-error threshold but you. Nobody decides which of your decisions a model is allowed to make on its own but you.

We operate from a governance charter built for exactly this reason — mandatory across every system we build, written not because a regulator required it but because the projects that skip it fail at a rate the industry has quietly accepted. Somewhere between seventy and eighty-five percent of AI programs never reach durable production. They do not fail on model choice. They fail on governance: on data that could not support the objective, on an error rate nobody defined as acceptable in advance, on a decision the model should never have been allowed to make autonomously, on a drift nobody monitored. Every one of those is a governance failure, and every one is invisible to a FINRA-style body reviewing a model before release.

The charter treats governance as five layers, not one document. Ethical — does the system align with human values. Responsible — does it meet the enforceable legal and risk requirements. Transparent — can you see into the data and configuration that drive it. Governed — are there audits, versioning, and drift monitoring keeping the first three active rather than aspirational. Explainable — can the system's high-stakes decisions be interpreted and defended. And a gate in front of all of it: nine feasibility signals that must all be green before a project is allowed to start. No system is exempt. Every layer is a gate, not a guideline.

That last line is the whole philosophy. Governance that is a guideline gets skipped under deadline. Governance that is a gate does not. The difference between the two is whether someone with authority is willing to stop a project that fails the gate — and that willingness has to live inside your organization, because no external body will ever care as much about your specific deployment as you do.

The teams in a defensible position twelve months from now are not the ones waiting to see which regime wins, Shanghai's or Washington's. They are the ones who wrote their own charter this year, ran their next three AI projects through its gates, and killed the one that could not clear them before it cost anything. The external regimes will matter for compliance eventually. Internal governance matters for survival now. The teams that understand the difference have already stopped waiting.

Three Things Worth Knowing

The external frameworks are splitting in real time

A prominent lab CEO proposed a US oversight body modeled on FINRA to review frontier models thirty days before release, and warned that open-source capability could reach dangerous territory within eighteen months. Days later, twenty-nine countries excluding the US and Western Europe signed on to a new Shanghai-based AI cooperation body. Two blocs, mutually incompatible, forming in the same week. For a multinational operator the takeaway is not to pick a side. It is that a single coherent external framework is not coming, so building strategy around waiting for one is building on sand. Govern your own deployments to a standard you control, and treat external compliance as a layer you add per jurisdiction — not a foundation you wait for.

The custody failures are already here

A researcher discovered that a coding agent from a major lab was shipping entire customer repositories to company-controlled cloud storage. The company began deleting the uploaded customer data only after the discovery became public. This is not a hypothetical governance risk; it is a governance failure that already happened, to real proprietary code, this month. It maps precisely onto two things most internal charters are missing: control over where your data physically goes, and an audit trail that would have caught the exfiltration before an outside researcher did. If your governance does not already answer "we know exactly what leaves our environment and where it lands," this is the month that gap cost someone their source code.

The model is moving onto your own hardware

Two releases this month made the same quiet point. An open-weights model from a Chinese lab landed within a few points of the frontier systems on a composite intelligence index and topped the leaderboard for web design, with weights opening to the public by month end. Separately, a twenty-seven-billion-parameter model was compressed from fifty-four gigabytes to under four — small enough to run on a phone. The direction is unmistakable: capable models increasingly run on infrastructure you own, with no vendor in the loop. That is good for cost and privacy and dangerous for anyone assuming the vendor handles governance. When the model runs on your hardware, the governance is entirely yours. There is no provider to log the usage, gate the access, or absorb the blame. Own the model, own the governance.

From the Practice

The gate that kills the project

The most valuable part of a governance charter is the part that says no. When we run a Discovery with a client, the first thing the charter does is put nine feasibility signals in front of the project before anyone writes a line of code — three on the business case, three on the data, three on the technology.

Most consultants are structurally incentivized to find a way to yes, because yes is the billable engagement. The gate is built to do the opposite: to surface, in the first week, the project that cannot clear it — the one where the data does not actually measure the variable the objective needs, or where nobody is willing to budget for the monitoring the system will require after launch. Killing that project early is the highest-return thing the charter does. The client keeps the money they would have spent proving the data could not support the goal.

And they trust the next recommendation more, because they watched us talk them out of the last one. A governance framework that only ever says yes is not governance. It is a sales process wearing a lab coat. The willingness to hold a red light is the entire value of having the lights at all.

The Field Manual

The nine-light Go / No-Go gate for an AI project

Before an AI project starts — before the data work, before model selection, before any code — one question separates the projects that ship from the ones that become write-offs: should this project exist at all? The gate below is the one we put in front of every AI project. Nine signals, three categories. All nine must be green before the project proceeds. A single red is a no, or a not-yet.

It comes from the CPMAI®-aligned Phase I assessment, and it is deliberately unglamorous. That is the point — the glamour is where the write-offs come from.

01–03

Business — is this worth solving with AI at all?

Clear problem definition. The problem is genuinely cognitive and probabilistic — not something a formula or a rule-based script would solve more cheaply. If a spreadsheet macro would do it, use the macro. Willingness to invest. There is real commitment to change the process the AI touches and to budget for the monitoring the system needs after launch, not just the build. Sufficient ROI. There is a concrete projection of cost saved, time saved, or revenue gained that justifies the complexity AI adds. "It would be interesting to have AI here" is a red light.

04–06

Data — can the data actually support the objective?

Availability. The data you need exists, and it measures the specific variable the objective depends on — not a proxy you are hoping correlates. Quantity and access. There is enough volume to train on, and you hold the legal and IT permissions to use it. Data you cannot legally touch is data you do not have. Quality. A best-guess assessment says the data is accurate enough to train on, with a formal audit to follow. A small labeling error rate can defeat the best algorithm before it starts.

07–09

Technology — can your team build and run it?

Skills and technology. The team holds the ML expertise, or you have secured it externally. Enthusiasm is not expertise. Timely execution. There is real evidence the model can be built and tuned inside the timeframe the business needs — not the timeframe the demo suggested. Practical use. The production environment is defined — cloud, edge, mobile — and there is a confirmed plan for the humans who have to adopt it. A model nobody uses is a failed project regardless of its accuracy.

The meta-rule

All nine green, or the project waits. The discipline is not in scoring generously; it is in being willing to hold a red. The gate only works if someone in the room has the authority to say "not yet" and the backbone to use it. Nine green lights is not bureaucracy — it is the difference between a project that ships and a write-off that takes eight months to admit it was one.

Save this. The next time an AI project is proposed with excitement and a vague business case, these nine signals are the calmest way to find out whether the excitement is warranted before anyone has spent a dollar proving it wasn't.

Building an AI governance posture you actually control — or want a charter and a Go/No-Go gate your team can run without waiting for a regulator to define them? That is exactly the work a Discovery call is for. Bring the project you are about to greenlight; we will run it through the gate together.

Book a Discovery Call

Whether or not a call makes sense, I'd like to hear how this issue lands. If your organization already runs a governance gate and has learned something the nine signals miss, or you think internal governance is overrated next to the incoming regulation — just reply. The sharpest pushback tends to end up in a future Field Manual.

Or read this issue on LinkedIn.

Applied AI strategy, training, and implementation.

Ryan Rezeika · Founder · Vancouver, BC
ryan@resonai.ai · resonai.ai · LinkedIn

You're receiving this because you subscribed at resonai.ai/signal. · Unsubscribe