The two AI frontiers every board is missing

Edition 1 of Autonomy Is Earned. Banking, the three traps that stall many AI programs before they start, and one question for every board.

Welcome to the first edition.

This comes out once a month, and each edition goes deeper on one idea than a post can, for the people who have to act on it: directors, the executives who brief them, and the regulators watching both. The name comes from a conviction I’ve held for a decade of doing this work: governance is not a brake on AI. It’s how an organization earns the right to give AI more autonomy, one piece of evidence at a time.

The map: two frontiers, every industry

Every industry now has two AI frontiers. The first is adoption: what’s experimental, what’s running inside organizations today, and what vendors already sell. The second is threat: how AI is being turned against an industry, from fraud aimed at individuals, through disinformation aimed at populations, to coordinated attacks on institutions and norms.

Almost every AI strategy I review is built entirely from the first frontier. That’s understandable; it’s where the business case lives. But the second frontier doesn’t wait for your strategy to notice it.

This month, I mapped banking, the industry that wrote the governance playbook the rest of us borrow. The adoption frontier is mature: anti-money laundering, real-time fraud prevention, and risk modeling are common today; robo advisors and hyper-personalized engagement are sold off the shelf. The threat frontier is where it gets uncomfortable. Look at pump and dump. It can be fraud aimed at individuals or disinformation aimed at markets. Banking’s playbook governs the model. It doesn’t yet govern the market the model is operating within.

The full map is in the ten-slide banking carousel. Insurance is next, with two regulatory fines already on the books.

The framework: the first three traps

Many AI programs stall in one of six recognizable traps. The first three:

Optional governance. Governance treated as a voluntary best practice, encouraged and never mandated, owned at the team level, which means owned by nobody. The test: who can stop a model going to production? If it’s a committee that advises, governance is optional.

Policy theater. A policy on paper is a promise; governance is the evidence you kept it. Pick any sentence in your AI policy and ask: who is accountable for it, what would I see if they were doing it, and when did anyone last look?

Pilot paralysis. Experimentation with no graduation criteria isn’t an experiment; it’s a way of kicking the can down the road. If you can’t name what would graduate a pilot, you can’t name what would kill it either.

Three more in October: fragile foundations, deciding from a place of lack, and explainability gaps.

The thing I got wrong

For years I described governance to executives as culture change and risk management. It was accurate and it was a mistake, because it told them governance was a cost center before they’d seen it do anything. The organizations that scale AI don’t run governance to avoid harm. They run it to earn trust they can spend: on more autonomous systems, on faster approvals for new AI tools, on regulators who stop asking for more evidence and start asking how they can hold others to your standard. I should have led with that. This newsletter does.

One ask

Forward this to one person on your board or risk committee, and tell me in the comments which industry you want mapped next. The template is ready; help me fill it with an industry that matters to you.

---

Referenced in this edition

• Banking’s two AI frontiers, the full ten-slide map
• The board question
• Four numbers for directors
• Trap 1: optional governance
• Trap 2: policy theater
• Trap 3: pilot paralysis

Autonomy Is Earned is published here first and also runs as a monthly LinkedIn newsletter, for boards, CAIOs and regulators.