The governance is automated. The ownership isn't.

Here is an uncomfortable observation from two decades of running quality in automotive and aerospace plants: no audit finding I ever closed was closed by a licence. This week, governance of AI became a product category. SAS shipped its AI Navigator governance suite and Collibra acquired trail ML to automate the discipline "from policy to production" – drift flags, policy checks, model inventories, the lot. Quality ran this experiment years ago. You could buy governance software by the early 2000s, and the result was always the same: the tooling automates the evidence, never the decision rights.

What the suite actually automates

Strip the messaging from both announcements and read the feature list. Logging. Drift detection. Policy enforcement. Audit trails. That is real work, and automating it saves real money – the evidence layer is expensive to maintain by hand, and auditors do read it. But it is the audit-trail layer, not the decision layer. A suite can prove a flag fired at 03:12. It cannot prove that anyone answered it.

In twenty years of VDA 6.3, IATF 16949 and customer audits, no auditor ever cited our software. They cited the reaction nobody owned. The finding reads the same every time: containment assigned to a department instead of a person, escalation routed to a distribution list, a decision deferred past its clock. I once inherited an 8D with a beautifully documented root cause and a corrective-action owner who had left the company eleven months earlier. The system knew. Nobody did.

The night-shift test

Take the scenario every governance deck now sells: a model diverges at 03:00 on a running line, the dashboard lights up. Detection is rarely what fails. What fails is the escalation path nobody owns, and it fails silently – no ticket, no call, no decision, just a model quietly wrong until the morning meeting. The one question that matters is the one the deck never answers: who pulls the plug?

A notification is not a decision. Decision rights – the authority to quarantine the model, roll back to the last validated version, stop the process it feeds – cannot ship inside a licence. They have to be assigned.

QRQC taught me the discipline at Witte Automotive. A defect appears, and within hours a named person physically owns the problem – the part on the table, the team at the board, an escalation ladder with names and clock times on every rung. Failure costs fell substantially while I ran that system, and not one euro of the improvement came from a dashboard lighting up. It came from a human being with authority facing the problem before it shipped again.

When I built the QA/QC department for a 900-person greenfield plant at SNOP, we drew the decision-rights map before purchasing a single tool: who can stop the line, who signs containment, who speaks to the customer within 24 hours, and what happens when that person is asleep. The tools came later and were better for it, because an authority structure already existed to plug them into. That department drove defect costs down 70%. The software recorded the number; the people produced it.

Spend any time on the attacking side of systems – I hold an ethical-hacking credential and a place on T-Mobile's bug-bounty Hall of Fame – and you learn what an attacker probes first: not the control itself, but the control nobody answers for. Unowned paths are the attack surface, in factories and in model stacks alike.

An alert without an owner is not a control. It is telemetry for the investigation.

Consensus is a control, not a cure

I run a live experiment on this point. I designed and built MultiPS, an orchestration platform that runs 63 AI models in parallel and synthesises a consensus answer. Models diverge every day – on dates, on units, occasionally on the entire premise of a question – and that divergence is the most valuable signal in the system. Agreement tells me an output is probably safe. Dissent tells me a human needs to look now.

The synthesis still lands on a named person with a veto and a reaction plan, because I built the veto into the loop deliberately. A system that cannot be overruled by an accountable human is not governed; it is merely monitored. The same holds for the agent chains now being wired into regulated workflows: control becomes critical the moment a model touches a decision with consequences. Consensus improves the odds. It does not transfer the obligation to decide.

The org chart ships before the licence

None of this argues against the suites. Automating evidence saves honest, expensive work: done by hand, it cost me the equivalent of two quality engineers, €140,000 a year, chasing signatures and screenshots. Buy the platform if it earns its place. But sequence it the way you sequence a plant launch: authority first, tooling second. Before the requisition goes in, the map must exist – every model failure mode with a named detector, a named decider, a named holder of the veto, and clock times on each hand-off. If drawing that map takes a fortnight of arguing across functions, good. The fortnight is the governance. The licence is the receipt.

Governance you can procure is compliance; governance you cannot automate is ownership. Write the authority structure first and buy the suite second. In that order, the licence is a tool. The other way round, it is an alibi.