Every AI decision turns into one of two things: a debt or a dividend. Which is this one?
The Job Isn't Finished at Launch
The most expensive AI mistake is not just buying the wrong system. Then assuming that once it is working, your job is finished.
Most organizations think governance begins with approval. A steering committee signs off. Legal reviews the contract. Procurement negotiates the license. Security checks the boxes. Someone declares the system ready for production.
Then everyone moves on. The AI does not.
It keeps making decisions. Quietly. Every hour. Long after the project team has celebrated the launch and the executive sponsor has turned to the next priority. That is where governance debt begins. Not because someone ignored the rules. Because nobody owned the job of continuing to watch.
What Governance Debt Looks Like
Derek Mobley applied to more than a hundred jobs. He was qualified for plenty of them. He got rejected by everyone, and for a long time he could not tell you why, because a person didn’t read his application. Software did.
That software, made by a company called Workday, sits at the heart of the hiring process for more than 11,000 organizations, including roughly two-thirds of the Fortune 500. It screens applications by the billion.
In 2023, Mobley, who is over 40, sued. His claim was simple. The system was quietly screening out older applicants, and the company was not watching for it. In March 2026, a federal judge refused to throw the case out and ruled that a law written in 1967, the Age Discrimination in Employment Act, applies to an AI screening tool the same way it applies to a hiring manager. About 14,000 people over 40 joined him. The people who bought it knew the law. They just did not ask the one question that mattered: what is this tool selecting on?
Read that again. More than a billion hiring decisions. The first sustained examination of those decisions did not happen in HR, or in compliance, or anywhere inside the 11,000 companies renting the software. It happened in a courtroom, in 2026, long after they were made.
That is a governance problem.
Governance Structures Miss the Small Decisions
Most governance failures arrive one ordinary decision at a time. One resume filtered. One insurance claim denied. One loan application scored. One medical recommendation ranked. One customer flagged.
Each looks insignificant on its own. Together they become how the company operates.
And it does not stay in one company. The same screening software runs inside thousands of employers, so the pattern that filtered these applicants out is the one deciding at the next company, and the next. The bias rides the vendor, encoded once and applied everywhere it is used.
Oversight after the fact isn't governance. It's archaeology.
3 in 4 Are Watching After the Fact
A 2026 study of enterprises by Smarsh and FTI Consulting found that 55% are deploying AI, and only 26% have oversight that keeps pace. A 29-point gap between what the application is doing and what anyone is watching. Only 30% can even spot the AI apps their own people brought in.
Put the first two numbers together. Of the companies deploying AI, only about 25% can keep their oversight up to date. The other 3 in 4 watch it after the fact, if they watch at all. Most of what your AI is deciding right now, you will not see until something outside forces you to look.
Even the Rule-Makers Are Late
If you want to know how hard this is to get right, watch the people whose entire job is oversight. Europe wrote the world’s most serious AI rulebook. The hardest rules, the ones covering AI that decides on hiring, credit, and the like, were due to take effect on August 2, 2026. Weeks before the date, the EU pushed them to late 2027 and 2028, because it had not finished writing the standards companies needed to comply. And it grandfathered in what was running. Systems put in place before the new date are mostly exempt unless they get a major change. And if even the rule-makers can’t keep up, that isn’t your excuse. It’s your warning. This is hard, serious work. Don’t treat it as a box to tick.
Read that plainly. The oversight was designed to take effect after the applications were in place, and when it ran late, it left the ones deciding alone. That is the governance debt written into law. Oversight built to show up after deployment can only ever bless what is there.
Governance Already Lives in Every Part of Your Organization
Each business unit has operated under real rules for years, on both sides of the Atlantic.
AI did not pick one of those rooms. It walked into all of them at once. The rulebooks stayed where they were.
Governance Is Not a Policy
Many organizations still treat governance as a document. Write the policy. Approve the framework. Run the training. File the evidence. But governance was never meant to sit on a shelf.
Governance is a practice. It is someone asking, over and over: Is the system still doing what we intended? Has anything changed? Who is reviewing the outcomes? What assumptions are no longer true?
Governance Is a Verb
To govern is something you do, not something you approve once. Yet many organizations evaluate an AI system exactly once, before deployment, and call that governance. That is like watching the plane take off and assuming it no longer needs a pilot.
Name an accountable executive, one person who can pause the system and who answers for what it decides. Then staff the reading, because checking what an AI decided at scale is a function, not a favor. It belongs in the room that owns the system: HR for hiring, finance for credit, operations for routing. Once a quarter, leadership reviews what those reads turned up: the risks, the incidents, the calls it got wrong. The executive owns the answer. The team does the reading.
Most Reviews Only Check Layer One
Give the review a real shape, not a vibe check. Borrow the layers-of-effect method from the folks at Design Ethically. Every AI system has three layers of consequence, and a real review reads all three.
Layer 1: what the AI was built to do: screen applications, set prices, route tickets. Is it doing that, and doing it right?
Layer 2: what it does for the business: who it saves money on, who it quietly costs.
Layer 3: the one that sinks companies: the effects you did not design and did not see coming.
The qualified applicants, a proxy for age, quietly filtered out. The customers a pricing model taught itself to charge more. You will not forecast all of them. The point is to go looking on a schedule, out loud, before a court does the looking for you.
The monthly read has an owner and a shape. What did this system decide since we last looked? Who did those decisions land on, across all three layers? And would we stand behind them if they were read back to us in a deposition? Not the vendor's dashboard, the decisions themselves, pulled and checked by a person who can say that one is wrong and stop it.
The Most Dangerous Assumption About AI Governance
You can outsource technology. You cannot outsource accountability.
It’s a common trap to think “Surely the vendor has taken care of that.” Maybe they have, but most likely they haven't. Said plainly, you are still responsible for ensuring any system you purchase meets your established governance requirements, across all aspects, AI included.
FOR EXAMPLE: In the U.S. federal government, there is a capability called FedRAMP. It vets new technologies against a set of “universal” standards, and those that measure up can be purchased by federal agencies. With one caveat. That “measure up” covers about 80% of the government’s general functional requirements. The remaining 20% is specific to that organization, and that's where the real meat of the application gets configured to its own standards.
Why Governance Debt Is So Expensive
Technical debt usually slows systems down. Governance debt quietly changes decisions.
The bill rarely arrives because someone inside chose to look. Most companies do not run that audit. It comes due when something outside forces it. A lawsuit, like Workday's. A regulator with a subpoena. A reporter with a story. A customer who got a decision they can prove was wrong. The trigger is rarely you. It is someone who does not work for you, and by the time they pull the thread, its choices are load-bearing.
By then you cannot cleanly undo it. A year of hiring, a quarter of pricing, a stack of denied claims, all of it resting on unwatched decisions. You cannot remove the AI without conceding that every call it made is now suspect, so you don't. Rework is expensive; you tighten the rules on the next system and quietly live with the last hundred thousand decisions from this one.
And it lands on a person who did not make the original call. The executive who inherits the contract, the new general counsel, the program manager who asked one good question a year too late. That gap, between when the AI decided and when a human looked, is the governance debt. The company is blindsided by ten thousand decisions made without a human hand; run on settings and defaults left exactly as they shipped.
The Governance Dividend
Small habits compound the other way. Regular reviews. Clear ownership. Independent testing. Documented decisions. Human oversight.
So run Workday's story the other way. The same tool, same billion decisions, same qualified applicants moving through it. Change one thing: it got checked before it was purchased. A team wrote the business requirements and validated the system against them, including the regulations, standards, and frameworks the organization said it would meet. The vendor proved compliance against those, not against a generic certification. Then someone owned the monthly read. In month two, not year three, they pulled the actual decisions, read all three layers, and saw what the court would later see: older applicants quietly filtered out. They caught it at a hundred rejections, not a hundred thousand. Fixed it. Kept the people it wrongly cut. Wrote down what changed and why.
Receipts, and What They Buy
Then comes the part that pays. When a candidate's lawyer asks, they have the receipts: the initial business requirements documents validated against the vendor's claims. When a regulator sends the letter, they answer in a week. When the next AI tool comes up for approval, they say yes faster, because they trust their own watch to catch what it might do. The same oversight that would have been a bill becomes what lets them move. That is the dividend: trust they can show a customer, a regulator, and their own leadership.
Trust grows because people can see someone is still paying attention after the launch. That is the dividend.
Who Will Still Be Reading Its Decisions in Six Months?
Before approving your next AI system, ask that one question.
If nobody can answer that today, do not schedule another AI demonstration. Schedule your first governance review.
What did you assume the vendor had handled? I'm writing about the assumption debt next, and the sharpest answer here shapes it.
Technology remembers every decision. Governance remembers to ask why. That is the difference between creating a debt and earning a dividend.
Next in the series: the assumption debt, building AI on things that went unchecked.
Want the version you can build from? I put the whole watch into one guide, the Minimum Viable Governance Starter: what governs you, the standards that matter, and the monthly read that catches problems early. It’s a free download.
Download the Minimum Viable Governance Starter
Want the whole picture, not just governance? Start with the AI Debt Diagnostic; it scores you across all 9 debts, from urgency and governance to decision and drift, and names the one charging you the most right now.
New here? Subscribe to Debt or Dividend on LinkedIn, and the next edition finds you every Wednesday, no feed-scrolling required.
Want to read more first? Every edition and article I have written lives in one place: digitalBard Perspectives