In April of last year, a thirty-two-page document landed on the desks of seventeen executives at a hospital system we work with. It was titled Enterprise AI Governance Policy, v1. It had been authored by a working group, edited by counsel, and blessed by the board. By the time it was signed, it was already wrong.
Not wrong in the sense of containing errors — its language was careful, its definitions reasonable. Wrong in the more dangerous sense: it described a state of affairs that, by the time of signing, no longer existed. The vendor list was stale. Two of the named owners had left. The risk taxonomy was based on a regulatory regime that had moved underneath it. The document was, in a word, obsolete.
This is not a story about that hospital. It is a story about the genre. We have read forty-one such policies in the last eighteen months. The pattern is uniform. They are sober, comprehensive, well-intentioned — and inert.
§ I · The policy reflex
The policy is the wrong instrument.
When a board asks an executive team for "an AI policy," the request is usually a translation of a different anxiety. The board has read the headlines. It has been to the conference. It has been told, by someone wearing a suit and holding a deck, that this is an existential matter. It wants to do something. The thing it knows how to ask for is a policy.
Policies are what corporate institutions produce when they want to demonstrate seriousness without yet knowing what to do. They are an artefact of deferral: the question is converted into a document, the document is converted into a meeting, the meeting is converted into a sign-off, and the sign-off is converted into the comforting feeling that something has happened.
A policy is what you write when you have not yet decided how to operate. It is, in the best case, a description of an operating model that does not yet exist. — Field note, Q4 install review
We are not against policies. Every program needs one. But the policy — even a good one — is the byproduct of governance, not the substance of it. Treating it as the substance is the central error of the genre.
§ II · Four ways the policy fails
Four failure modes we see, repeatedly.
Across forty-one reviews, we have seen the same four failure modes. They are not surprising. They are also not contestable: in each case the artefact failed in a manner we could observe.
01The policy describes a steady state that the practice never reaches.
Three roles named. Two filled. The third, "Chief AI Officer," remains aspirational sixteen months after sign-off. No mechanism in the document accounts for its own implementation gap.
02The taxonomy ages faster than the document.
"High-risk" is defined against an EU AI Act draft that has since been revised twice. The document points at a moving target. The reader is left to do the reconciliation work themselves — which means it does not happen.
03There is no register of what is actually in production.
The policy governs in principle. In practice, no one in the firm could, on the day of signing, list the models actually deployed. The denominator is missing. Governance without a denominator is theatre.
04The cadence is annual.
The document specifies a yearly review. The technology cycle is six weeks. The failure here is arithmetic: by the time the second annual review opens, the eighth model generation has shipped.
Each of these is a failure of instrument. The policy is being asked to do work it is not designed to do — track state, enforce ownership, reconcile against a moving regulatory environment, and update itself faster than the production environment it describes.
§ III · What the registry does
The registry is the right instrument.
The firms whose programs are working did something different. They built — and we mean this literally — a single sheet. We have seen it as a Google Sheet. We have seen it as a Notion table. We have seen it inside ServiceNow, Smartsheet, and one regrettable Word document. The form does not matter. The discipline does.
The discipline is this: every model in production has a row. The row contains, at minimum: the model's name, its version, its named owner, its risk tier, its last review date, its retirement date, and its evidence link. Nothing else. The sheet is updated weekly, in a forty-five minute meeting, by four people. There is one rule: if a model is not on the sheet, it is not in production.
That, the registry, is the working artefact of governance. Everything else — the policy, the committee, the board pack — is a derivative of it. Without the registry, those instruments are describing nothing. With it, they have a denominator. With a denominator, they can do real work.
§ IV · Cadence over committee
The unspectacular minute.
The second discipline is cadence. The firms whose programs work meet weekly. Forty-five minutes. Four people: a named owner, a risk function, an engineering function, and a chair. They review what changed in the registry that week. They make a small number of named decisions. They produce a one-page minute.
The minute is the second working artefact. It is unglamorous. It is short. It is read, the next morning, by the chair, the CRO, and one board observer. Read across a year, the stack of minutes is the firm's actual governance position — which is to say, what it actually decided to do.
The committee is not the same thing. A committee meets quarterly, by agenda, with thirteen attendees. It is, in our experience, a deferral mechanism dressed as governance. We are not categorically against committees. We are against the substitution of the committee for the cadence.
§ V · The 48-hour test
When the regulator calls.
There is a test we run, increasingly often, in our second-quarter reviews. It is a simple test. We ask: if the regulator called on Friday afternoon and asked for a list of every model in production, the named owner, the risk tier, and the last evidence packet — could you produce it by Monday morning?
At sign-off, the median answer is no. Sixty percent of clients estimate two weeks. Twelve percent say "I don't know." After install, the median answer is forty-eight hours. The work that closes that gap is exactly the work the policy could not do: the registry, the cadence, the named owner, the unspectacular minute.
We are not arguing that policy is unimportant. We are arguing that it is the wrong place to start. Start with the registry. Start with the meeting. Start with the named owner. The policy will write itself, and it will be a description of something true.
§ VI · Where to begin
Two hours, four people, one sheet.
If you take one thing from this essay, take this. Put four people in a room — the executive sponsor, a risk lead, a technical lead, and a recorder — for two hours. Open a blank sheet. List, by name, every model your firm has in production. Put a named owner against each row. Put a risk tier. Put a last-review date.
It will be incomplete. That is correct. The list, version zero, is the starting line. By the third Friday, it will be more accurate than your policy. By the sixth, your policy will be revising itself against it.
That is the whole argument. Most AI policies are obsolete because they were authored without a register, ratified without a cadence, and put into a drawer next to a stack of similarly serious documents. The cure is not a better policy. It is a working artefact, four people, and forty-five minutes, every Friday morning, until the artefact is true.