Most AI governance documents AI processes and outputs after the fact. Controls exist as written attestations rather than as things that can be tested, and evidence is assembled retrospectively, separately, for each regime an organisation answers to. A firm subject to the EU AI Act, ISO/IEC 42001 and a sector regulator will typically produce three overlapping evidence packs by hand, none of which is reusable, and all of which describe the system as designed rather than as operated.

A statistical system can produce a correct output and be unable to account for it. In functions where a decision has to be defended — to a regulator, a court, a counterparty, an insurer — that gap stops deployment, or permits it while leaving the liability unpriced. Many organisations are now carrying both costs at once: AI stalled at pilot in the functions where it would be most valuable, and AI in production in functions where nobody has established what happens if the output is challenged.