Here is an uncomfortable observation: the agency that writes the cyber rulebook your auditors quote back at you has just disclosed its own ChatGPT governance failure – and in the same week, three vendors shipped AI governance as a product. Hexnode launched Synapse for agentic IT and security operations. Boomi announced a control plane aimed squarely at AI governance risk. Concentrix bought CastleHill outright because, in its words, AI risk is accelerating. India, meanwhile, reported enterprise AI investment up 119 per cent with governance and testing trailing the spend. I have run this experiment before, on presses and assembly lines rather than chat interfaces. I know how it ends. The ending is priced in euros.

A control plane is a records system, not a control system

Definitions first, because money rides on them. A control plane logs, routes and stores approvals – a records system, valuable and necessary. A control is a mechanism that detects deviation and forces a reaction before escape: an interlocked torque, a poka-yoke, the andon authority to stop a line, a validation protocol with acceptance criteria and a named signatory. Software can host a control. It cannot be one, because a control has someone accountable attached to it – and per-seat licences do not ship accountability.

CISA had policies. It writes them for a living. What failed was the unglamorous part: a defined reaction when the deployment drifted out of bounds. The Indian numbers tell the same story at population scale – capability bought at speed, requalification skipped. The vendors have discovered governance the way some people discover fire insurance, which is once they can smell the smoke.

A control plane tells you what the agent did. A control is the authority to stop it shipping.

We already ran this experiment – it was called SPC software

In the early 2000s I watched plant after plant buy SPC suites. Forty thousand euros a year in licences here, dashboards blooming on every press there. Out-of-control points lit up red and were exported into monthly reports nobody read. The measurement was immaculate. The escapes continued. What separated the suppliers who survived their customers' audits was never the software. It was the reaction plan: an out-of-spec point triggered quarantine, a QRQC within the hour, an owner whose name was printed on the wall. The suite hosted the loop. The loop was the control.

The observability stacks now shipping for AI repeat the pattern. Logging every prompt and tool call is measurement, not governance. On its own it is merely evidence for the 8D you have not yet opened.

Requalifying a process that changes itself

The IATF world runs on one plain rule: change the tooling, requalify the process. New cavity, new cycle time, relocated line – capability study, PFMEA revisit, run-at-rate, a signature before the first saleable part. An agentic system is a process whose tooling changes without a purchase order. The vendor swaps the model on a Tuesday. Somebody rewrites a prompt on Wednesday and grants the agent a new tool by Thursday. Each is a tooling change. Each deserves the same question: what evidence do we require before this process ships again?

I deploy and integrate these systems; I do not train models, and the layer I actually build is the governance layer. My own platform runs more than sixty models in parallel with consensus synthesis, and the architecture exists for one reason: no single model is granted trusted authority. When the models disagree beyond a set band, that disagreement is the control signal, and the query routes to a human the way an out-of-tolerance dimension goes to containment. Consensus is not a gimmick. It is an interlock.

The red-team rule carries over unchanged from my ethical-hacking work: a control you cannot attack is a poster. When a vendor demonstrates a governance product, my first request is their own adversarial results – who attacked the control plane itself, what escaped, which corrective action closed it. Silence on that tells you they are selling observation.

Three questions before the purchase order

At SNOP I built the quality function for a 900-person greenfield plant, from an empty building to a department running at 98 per cent customer satisfaction. Plenty arrived on invoices – licences, scanners, a glossy FMEA database. Nothing that governed did. The nonconformance flow, the escalation clock, the stop authority, the drilled QRQC and 8D discipline: designed, staffed, rehearsed. When 419,000 SUVs are recalled over an airbag, no customer asks the supplier which dashboard was bought. They ask what the reaction plan was. An AI escape belongs in the same flow as a dimensional escape – same QRQC wall, same 8D, same clock, not a separate "governance" inbox reviewed monthly. Put three questions to the vendor, and to your own team:

  • Which signal stops the line, and who holds that authority when the agent is the fastest worker in the building?
  • What requalification evidence – frozen acceptance set, results against it, a named signatory – does a model, prompt or permission change require before release?
  • Show me one closed 8D that originated inside this stack. If none exists, the loop has never been tested.

Key takeaways

  • Treat every model, prompt or permission change as a tooling change: requalify against a frozen acceptance set before the process ships again.
  • Route AI incidents through the existing QRQC/8D flow with the same containment clock as any other escape – no parallel governance inbox.
  • Demand the vendor's own red-team results on the governance stack; a control that has never been attacked is a poster.
  • Buy the records system if it earns its place, but staff the reaction plan – stop authority, named owners, drilled escalation – because that part has never arrived on an invoice.

None of this argues against the products. A good records system saves real hours when the auditors arrive, and a well-built control plane makes an audit trail faster to reconstruct. Be clear about what the invoice covers. The control is the requalification cadence, the reaction plan, the named owner willing to halt a release at two in the morning – and CISA fumbling its own chatbot is the cleanest demonstration on offer that even the rulebook's author has to run the process, not merely possess it. Quality directors already own this discipline; we have been requalifying changed lines for two decades. An agent is simply the newest line, and it changes itself. You can buy the plane. The control you requalify – every release, every change, every escape – or you find out, usually in front of a customer, that you never had one. Accountability has no seat licence.