In Practice: Building an AI Company | Lesson 5: Decide What You Sell Before You Decide What You Build

We rewrote the one-page product definition eleven times. I know it was eleven because the file names went to eleven, and because somewhere around the seventh I stopped believing we would ever finish it.

Version one described a technology. It used the word platform twice and named three model capabilities. It was accurate and it was useless, because it did not say what anybody would stop doing if they bought it.

Version eleven described a job. Who does it today, how long it takes them, what goes wrong when it goes wrong, and what the company takes responsibility for. It was shorter, less impressive to read aloud, and it was the first version an engineer could build against and a salesperson could sell from.

The Monday test

There is one question that should be asked before any serious money or time is committed, and it is uncomfortable enough that most teams avoid it until an investor asks it for them.

If the model provider shipped your headline feature natively on Monday, what would you still have?

Not what would you do. What would you still have. The answer is usually one of five things, and only four of them are a company.

The fifth answer, the one that is not a company, is: a better interface. Interfaces are real work and they are genuinely valuable, but they are also the layer that gets absorbed first, because the party whose feature you are wrapping has every incentive to wrap it themselves and a much lower cost of doing so.

It is worth saying plainly that wrapper is not an insult. Every application in history is a wrapper around something: a database, an operating system, a payment network. The question was never whether you wrap. It is whether the wrapping is the part that carries the value.

The four places value actually sits

Workflow depth. The product does not answer a question. It completes a job that has steps, state, handoffs and an approval somewhere in the middle. A model answers. A workflow remembers what happened last Tuesday, knows who has to sign off, and behaves correctly when somebody is on holiday. That accumulated correctness is not something a raw capability replaces, because the capability was never the hard part.

The test is simple. Can a user get most of the value by pasting their problem into a general purpose assistant? If yes, you are selling convenience. Convenience is a real business and it is a thin one.

Data you accumulate by operating. Not data you licensed, which your competitor can also license. Data that exists only because your product ran: which suggestions were accepted and which were rejected, what the correction was, what the outcome turned out to be six weeks later. This is the asset that compounds, and it is the one most teams forget to capture because capturing it is not on the critical path to the demo.

Decide on day one what you log. It is nearly free to record and impossible to backfill.

Integration surface. Work happens where work already lives. A product that reaches into the systems of record, reads the real state, and writes back is doing something a general capability cannot do without the same integration work. That work is unglamorous, slow, and it is a moat precisely because it is unglamorous and slow.

Accountability. This is the least discussed and it may be the strongest. Model providers are explicit that output correctness is not guaranteed. Somebody has to stand behind the result. When you sell into a function that has consequences, whether financial, clinical, legal or operational, a large part of what the customer is buying is that a company exists which will answer for the output being wrong.

That has a cost. It means evaluation, monitoring, human review paths and insurance. It is also the reason a serious buyer will pay you rather than use a general tool that is free to them, and it is not a position an interface can occupy.

Write down what you are not

The most useful half of a product definition is the exclusions.

A definition that only says what you do will be stretched by every customer conversation, because saying yes is pleasant and saying no is not. Six months later you have four half-products, a roadmap nobody believes, and an engineering team that has stopped asking what the priority is because the answer keeps changing.

The working test for a product definition is this: can somebody on your team decline a customer request without asking you? If they have to ask, the definition is a description rather than a decision, and you are the bottleneck on every conversation the company has.

Write both columns. What this does. What this does not do, and where those requests go instead. Put a date on it and revisit it deliberately rather than continuously.

Three ways this goes wrong

You build the demo that impresses other builders. There is a specific kind of demo that gets applause from engineers and produces no purchase orders. It shows capability rather than completion: look what it can do, rather than look what it finished. Buyers do not buy capability. They buy the absence of a problem they currently have, and the demo that sells is often visually dull because it ends with a task being finished and a person going home.

You define the product as a capability rather than a job. Any sentence of the form we use artificial intelligence to improve something is not a product definition. It contains no user, no current alternative, and no way to tell whether it worked. Rewrite it as: this person spends this long doing this thing, it goes wrong in this way, and afterward they do not have to.

You confuse novelty with demand. That nobody else does this is not evidence that anybody wants it. Sometimes it is evidence that several people tried and discovered why not. When you find genuinely empty space, spend a day asking who else has stood here before assuming you are the first to arrive.

The eleven versions were not wasted, although at the time it felt like avoidance. Each rewrite removed something we had been carrying because it was impressive rather than because it was true. What was left was smaller than what we started with and considerably harder to argue with.

A feature is not a company. A workflow somebody is afraid to change is.

Tomorrow: the ten-name customer list, and why a market is not a segment.

In Practice: Building an AI Company | Lesson 4: The Cap Table You Can Still Raise On

Our first cap table was a spreadsheet with nine rows. Founders, a placeholder for an option pool nobody had modeled, and a note at the bottom in a different color reminding us to add the advisor we had promised something to but had not yet quantified.

It fitted on one screen. That was the last time it did.

A cap table looks like a record of who owns what. It is not. It is a forecast of who will own what once everything you have already promised comes true, and the gap between those two readings is where founders lose companies they still technically control.

Outstanding versus fully diluted

There are two numbers for every line and they are rarely the same. Outstanding shares are what has actually been issued. Fully diluted includes everything that could become a share: the unissued option pool, outstanding options, warrants, and every convertible instrument you have signed.

Founders quote outstanding. Investors read fully diluted. The number that matters in every negotiation you will ever have is the second one, so start using it now, and build the model yourself rather than accepting somebody else’s summary. Not because anyone is dishonest, but because the person who built the model understands the assumptions inside it, and in a negotiation that understanding is the entire advantage.

The option pool and where it comes from

You need equity to hire. A pool of ten to twenty percent is standard, sized against the hiring plan for the next eighteen months rather than against a number somebody quoted.

The part that surprises people is when the pool gets created. Investors almost always require it to be established before their money goes in, which means it comes out of the pre-money valuation. In practice that means the founders pay for it entirely, and the arithmetic is not intuitive.

Take a round of three million dollars on a fifteen million pre-money valuation. Post-money is eighteen million, so the new investors hold one sixth of the company, about 16.7 percent. Now add a fifteen percent option pool created pre-money. That fifteen percent is fifteen percent of the post-money company, and it is carved entirely out of the existing holders. The founders do not end up with 83.3 percent minus a bit. They end up with roughly 68.3 percent, and the fifteen points went somewhere they had not modeled.

This is not a trick and it is not hidden. It is standard practice and it is negotiable at the margin. What is not acceptable is being surprised by it on the day the term sheet arrives, because a founder who is doing this arithmetic for the first time in a meeting has already lost the argument about pool size.

SAFEs, and the trap in the word post-money

Most early money now arrives as a simple agreement that converts into equity later, usually at a valuation cap. It is fast, cheap and lawyer-light, which is why it won. It also defers the moment anybody has to think, which is why it hurts.

The critical detail is whether the cap is pre-money or post-money. Under the post-money version, which is now the common one, the investor is promised a fixed percentage of the company as it stands at conversion. That percentage does not dilute when you issue the next instrument. Only the founders dilute.

Work it through. You raise one million dollars on a ten million post-money cap. That investor is promised ten percent. Six months later you raise another million on a twelve million post-money cap. That investor is promised 8.33 percent. The first investor still gets their ten percent. The founders now hold 18.33 percent less than they did, before any priced round, before any option pool, and before anyone has valued the company in a negotiation.

Three or four of these stacked up is common, and the result is a founding team that discovers at their first priced round that they collectively hold less than half of their own company and have no idea when it happened. The instrument did not do anything unfair. Nobody modeled the conversion.

So model the conversion. Before you sign each one, build the row where all outstanding instruments convert at a plausible next round, add the pool, and look at what the founders hold. If that number makes you uncomfortable, the time to act is before signing, not after.

The small grants that add up

The large numbers get scrutiny. The small ones get waved through, and collectively they do more damage because nobody is tracking the total.

  • Advisors. The market range is roughly a quarter of a percent to one percent, vesting over one or two years, with a defined commitment such as a monthly call. Anyone requesting five percent for advice is not an advisor. Vesting matters here more than anywhere else, because advisor engagement reliably decays.
  • Agencies and contractors taking equity instead of cash. This is attractive when cash is short and it is almost always expensive. You are selling the most valuable asset you have at the lowest price it will ever carry, to a party whose involvement ends when the project does.
  • Uncapped notes from friends and family. Well intentioned, and they convert at whatever the next round decides, which means the person who took the earliest risk gets the worst terms. That produces a conversation you will not enjoy.
  • Verbal promises. A percentage mentioned in a conversation and never documented is not on the cap table, but it is absolutely in somebody’s head. Those surface during diligence, always at the worst moment.

Three ways this goes wrong

You keep the cap table in a spreadsheet past the point where that works. It works for about a year. It stops working the first time somebody exercises an option, or a note converts, or a founder departs mid-vest. Move it to a proper register before it breaks, not after, because reconstructing a cap table from email is a genuinely awful week.

You optimize for a headline valuation instead of a clean structure. A high cap feels like a win and costs nothing today. The bill arrives when the priced round has to reconcile every instrument you signed. Investors are not primarily buying your valuation history. They are buying whether the founders still own enough to stay motivated for another four years, which is the actual question behind every diligence request about the cap table.

You treat dilution as loss. It is not. Owning a smaller share of a company that exists beats owning all of one that does not. The failure is not dilution, it is unmodeled dilution, which is the same mistake as unmodeled cost and produces the same expression on the same face eighteen months later.

Every early act of generosity gets priced by the next investor, and they price it against you.

Tomorrow: the one-page product definition, and the question that decides whether you have a company or a feature.

In Practice: Building an AI Company | Lesson 3: The Founder Agreement Is the First Product You Ship

The founder agreement was the fourth or fifth document we produced and the first one anybody was reluctant to open. It is a strange thing to write. You sit in a room with people you chose, whose judgment you trust enough to bet several years of your life on, and you write down what happens when one of you leaves and the rest of you resent it.

Nobody enjoys the conversation. Everybody who has skipped it has regretted it.

The agreement is not a legal formality wrapped around a friendship. It is the first thing the company builds, and like anything you build, it is either designed for the conditions it will actually meet or it is decorative.

Vesting is a promise to your future self

The standard shape is four years with a one year cliff, then monthly. Nothing vests for the first twelve months. At month twelve a quarter of the grant vests at once. After that it drips.

Founders resist applying this to themselves. The reasoning is always some version of: we are the ones building it, why would we restrict our own stock. The answer is that vesting is not protection against you. It is protection against the version of this company that exists after somebody leaves.

Run the scenario. Five people split the company evenly. In month seven one of them takes a job somewhere else, for reasons that are entirely understandable and possibly medical. Without vesting they walk away owning a fifth of the company, permanently, with no further obligation to anyone. The four people who remain now work for four more years knowing that twenty percent of everything they build accrues to somebody who left before the product existed. That is not a legal problem. It is a motivation problem, and it will not resolve.

With vesting, the same person leaves in month seven having crossed no cliff and keeps nothing. That sounds harsh in the abstract and it is exactly right in practice, because the alternative punishes the four people who stayed.

Two refinements worth understanding. Acceleration on a change of control determines what happens to unvested stock if the company is acquired. Single trigger accelerates on the acquisition itself, which acquirers dislike because it means the people they are buying can leave immediately. Double trigger accelerates only if the acquisition happens and the person is terminated, which is the market standard and the one you should default to. The other refinement is credit for time already served. If you have been working on this for a year before incorporating, it is normal to vest a portion at signing rather than pretend the year did not happen.

The election with a thirty day window

If your stock is subject to vesting, there is a tax election you must file within thirty days of the grant. Thirty calendar days. There are no extensions and there is no relief for not having known about it.

The mechanics matter, so here they are plainly. Restricted stock is normally taxed as it vests, at the value on each vesting date. In a company that is going well, that value rises. So you would recognize ordinary income every month, on stock you cannot sell, in a company with no liquid market, and you would owe real tax in cash on paper gains. Founders have been genuinely ruined by this.

The election lets you choose to be taxed at grant instead, when the stock is worth close to nothing. You pay tax on approximately zero, and everything afterward is capital gain rather than ordinary income. It also starts the clock for the qualified small business stock holding period discussed in Lesson 1, which is a second reason it belongs on day one rather than day thirty-one.

The cost of filing it when you did not need to is a stamp. The cost of not filing it when you did need to is uncapped. Treat it as unconditional.

The intellectual property, including the part from before the company existed

Here is the uncomfortable default: work belongs to the person who did it unless there is a written assignment. Not to the company they were thinking about forming. Not to the group chat where the idea was discussed. To the individual.

That means the prototype somebody built in the two months before incorporation, the model evaluation harness, the brand name, the domain, the pitch deck and the schema all sit outside the company until they are formally assigned into it. Investors check this. Acquirers check this harder. A single unassigned component discovered during diligence can hold up a transaction for weeks while lawyers chase a person who has since stopped answering email.

Two related traps. The first is employment agreements at day jobs, many of which claim inventions made during the employment period, sometimes regardless of whether company equipment was used. If any founder built anything material while still employed elsewhere, that needs a real answer, ideally a written release, before it becomes somebody else’s leverage. The second is the helpful friend. Somebody who contributed a weekend of work, was thanked warmly, was never paid and never signed anything, now holds a copyright interest in part of your product. Get a short assignment signed at the time. It is a one page document and it costs a favor.

The parts everyone skips

The equity terms get attention because they are about money. The following clauses get skipped because they are about behavior, and they are the ones that actually determine whether the company survives its second year.

  • Roles and decision rights. Not job titles. A written statement of what each person can decide alone, what needs agreement, and what needs everyone. Without it, every disagreement escalates to a vote, and a company that votes on things moves at the speed of its slowest conversation.
  • What full time means, and when it starts. Founders frequently have different runway, different obligations and different tolerance for risk. Some are in on day one, others in four months. Write down which, and tie the equity to it, because the unspoken version of this is the most common source of resentment I have seen.
  • Departure mechanics. What happens to unvested stock, to vested stock, to the title, to the email address, to the customer relationships that person owned. Decide it now, when nobody is angry.
  • Deadlock. An even number of founders needs a tiebreak rule. An odd number needs one too, once somebody leaves.

Three ways this goes wrong

You split evenly because it is the polite thing to do. An even split among a large founding team is often the right answer, and it is just as often the answer nobody wanted to argue about. If contributions and commitments differ materially, an even split encodes a disagreement rather than resolving it. Have the conversation while it is still cheap.

You agree it verbally and mean it sincerely. Verbal agreements between friends are perfectly genuine and completely unenforceable. They also drift, because two people remember the same conversation differently after eighteen difficult months. The document is not there because you distrust each other. It is there so that the version of you in month twenty does not have to reconstruct the version of you in month one from memory.

You defer it until the first raise. By then it is not a negotiation among peers, it is a condition imposed by a term sheet in a week when you have no leverage and no time. Every founder who has done it this way describes the same feeling.

Equity is easy to give and impossible to take back.

Tomorrow: the cap table, and what your early generosity looks like to the person writing the next check.

In Practice: Building an AI Company | Lesson 2: What It Costs to Stay Alive Before You Sell Anything

The first invoice the company ever received was from the registered agent. It was for a small amount, it arrived by email with no covering note, and it was addressed to an entity that had no product, no customers, no bank account and no revenue. We had been a company for eleven days.

I remember looking at it and thinking that it was a rounding error, which it was, and then thinking that it would arrive again next year and the year after that whether or not anything else went well. Which it will.

That invoice is the beginning of a category of spending most founders never model: what it costs simply to exist. Not to build anything. Not to serve anyone. Just to remain a company in good standing that has not been administratively dissolved.

The standing costs

There are five of them and they are all boring, which is why they get missed.

The registered agent. Every US entity needs a registered agent with a physical address in the state of formation, available during business hours to receive legal service. If you have no US address you cannot be your own. This is an annual fee and it is the one bill that arrives whether or not you do anything.

Franchise tax. For a Delaware LLC this is a flat annual amount due on 1 June, which is refreshingly simple. For a Delaware corporation it is not simple, and this is where founders get their first genuinely alarming letter. There are two calculation methods. The default one is based on authorized shares, and a company that has authorized ten million shares receives a number that looks like a mistake. The second method takes account of issued shares and gross assets and typically produces something far smaller for an early-stage company. Both are legitimate. You pay the lower one. Nobody tells you this in advance.

The employer identification number. Free to obtain, but if no founder has a US social security number you cannot use the online process. You file the application by fax or mail and you wait, sometimes for several weeks. Nothing else can proceed without it, so this is the item that should be started on day one rather than day forty.

A bank account. This is consistently the hardest step for a founding team based outside the United States, and it is the one that blocks everything else. You will need the formation documents, the employer identification number, identification for the beneficial owners, and usually a plausible answer about what the business does and where its customers are. Budget months, not weeks. Plan around it rather than assuming it.

Accounting and tax preparation. A US entity files a return whether or not it earned anything. Zero revenue does not mean zero filings, and a preparer who understands foreign-owned entities is not the cheapest one available.

The filings that carry real penalties

Most of the annual obligations are small in money and irritating in effort. Two are neither.

The first is the information return required of a foreign-owned single-member LLC, filed alongside a pro forma corporate return. It reports transactions between the entity and its foreign owner. It is not a tax calculation and often results in no tax at all. The penalty for not filing it is twenty-five thousand dollars. That number is not a typo and it is not scaled to the size of the company. Founders who form an LLC precisely because it seemed like the light option are the ones most likely to be unaware this exists.

The second is the corporate income tax return itself, which is due regardless of activity. A dormant company still files. Filing late compounds, and the first year of a startup is exactly when nobody is watching a calendar.

Then there are the deadlines, which do not move for you. Delaware corporations file their annual report and franchise tax by 1 March. Delaware LLCs pay by 1 June. If you have registered as a foreign entity in another state because that is where you actually operate, that state has its own report, its own fee and its own date. Put every one of them in a shared calendar with a reminder two weeks ahead, because the person who remembers in year one will be busy in year two.

Three layers of cost, and why you should separate them

The useful move here is to stop treating spending as one number and split it into three, because they start at different moments and behave differently under growth.

Cost to exist. Registered agent, franchise tax, accounting, filings. Fixed, annual, unavoidable, starts on the day you file. It does not care about revenue and it does not scale with users. For a lean single-entity structure this lands in the low four figures a year, more if you have qualified in a second state or your ownership structure needs specialist tax work. Write the real number down. It is the amount you must be able to cover in a year where nothing happens.

Cost to operate. Domain, email, code hosting, error monitoring, the design tool, the thing that sends transactional email. Starts when you begin building and grows with the team rather than with the customers. Most founders track this one because the bills are monthly and visible.

Cost to serve. Inference, storage, egress, anything metered per request. Starts when someone uses the product and scales with success rather than with headcount. This is the layer that makes an AI company different from a software company, and it is the subject of Lesson 7. For now the only thing that matters is that it is a separate line, because if you blend it into operating cost you will never be able to answer the question of what a customer costs you.

Three layers, three behaviors. The first is a floor. The second is a choice. The third is a consequence.

Three ways this goes wrong

You budget formation as a one-time cost. The filing fee is one-time. Everything else recurs, and it recurs in a year when there is no revenue to absorb it. A company that raised nothing and earned nothing can still be dissolved for not paying a few hundred dollars on time, which is an embarrassing way to lose a name you have been using for eighteen months.

You optimize the wrong end. Founders will spend two weeks comparing formation services to save a hundred and fifty dollars, then miss an information return that carries a twenty-five thousand dollar penalty. The formation is the cheap part. The maintenance is the part with the sharp edges.

You sequence the bank account last. It is the longest lead item and the one you control least. Everything else can be done in an afternoon. If you leave it until you need to receive money, you will be explaining to your first customer why you cannot invoice them yet.

None of this is expensive in absolute terms. That is exactly why it gets ignored. A cost that is small but certain is much easier to plan for than a cost that is large but uncertain, and yet founders reliably do the opposite, modeling the revenue nobody has promised and skipping the invoice that arrives every year without fail.

A company has a heartbeat cost, and it starts on the day you file, not the day you sell.

Monday: the founder agreement, and why it is the first product you ship.

In Practice: Building an AI Company | Lesson 1: Pick the Entity Before You Pick the Logo

The certificate of incorporation runs to two pages. Mine arrived as a PDF with a state seal in the corner, a file number, and a timestamp accurate to the second. It cost less than a decent dinner. It contains no description of what the company does, no mention of the product, and none of the names of the people who had spent four months arguing about the product.

It is the least interesting document the company will ever produce and the most expensive one to get wrong.

Everything downstream is shaped by it. Who is allowed to own a piece of the company. Whether you can issue options to the engineer you want to hire in eight months. What happens to your money if there is ever an exit. Whether an investor’s lawyer spends twenty minutes on your paperwork or three weeks. You feel none of this on the day you file. You feel it two years later, usually in a week when you have no time.

The question that decides it for most teams

There are three structures in the conversation: the limited liability company, the S corporation, and the C corporation. For a lot of founding teams one of those three is eliminated before the tax argument even starts, and almost nobody finds out early enough.

An S corporation cannot have a nonresident alien as a shareholder. That is not a guideline. Section 1361(b)(1)(C) of the Internal Revenue Code makes it a condition of the election, and a single share held by an ineligible person terminates S status for the entire company. Residency here is a tax classification, not a passport and not a visa. You qualify by holding a green card or by meeting the substantial presence test, which is a day-count formula. Living abroad while holding US citizenship is fine. Living abroad on a foreign passport is not.

If any of your co-founders sits outside the United States without a green card, the S corporation is gone. There is a trust structure that allows a nonresident to be a beneficiary of an entity holding S corporation stock, but it is an estate planning instrument, not a founding structure, and no early-stage company should be building one.

Two further S corporation constraints matter even for an all-US team. The cap is one hundred shareholders, which sounds generous until you have run two SAFE rounds. And there can be only one class of stock, which means you cannot issue preferred shares. Institutional investors buy preferred shares. That one line quietly makes the S corporation incompatible with nearly every venture round that has ever been done.

So for most teams the choice is not three ways. It is two.

LLC or C corporation, and the question underneath it

The limited liability company is simpler and cheaper in almost every respect. There is no share structure, which removes the main variable that makes corporate formation expensive and fiddly. Profits pass through to the members and are taxed once. Annual maintenance is lighter. If you are building a business you intend to fund out of its own revenue, and you plan to take money out of it as distributions, the LLC is not a compromise. It is the correct answer, and a lot of quietly profitable software companies are structured this way on purpose.

The C corporation is what institutional investors buy, and not out of preference. Many venture funds have tax-exempt limited partners, university endowments and foundations among them, who face real problems taking pass-through income from an operating business. Others have foreign limited partners with their own reasons for staying out of partnerships. Beyond that, employee stock options are a corporate instrument. If you intend to compete for engineers using equity, you need a corporation and a stock plan.

The question underneath the entity choice is not legal at all. It is this: how do you plan to get paid?

If the answer is distributions from profit, you want the LLC. If the answer is the sale of stock, whether to an acquirer or in a secondary, you want the corporation, and you want it early.

Where, and why the answer is boring

Delaware remains the default for corporations, and the reasons are structural rather than sentimental. It has a dedicated business court with judges who hear only corporate matters and no juries, which has produced a deep and predictable body of case law. Investor lawyers know it, which means your documents do not need to be explained to anyone. Choosing it removes a conversation rather than winning one.

It is not free. A Delaware corporation pays annual franchise tax that varies with share structure, and founders who authorize ten million shares and then use the wrong calculation method receive a bill that looks like a typo. There is a second method that produces a far smaller number for a normal early-stage company, and it is worth knowing that before the first invoice arrives rather than after. For an LLC the equivalent is a flat annual amount and the paperwork is lighter.

The argument that changed in July 2025

There is a provision in the tax code, Section 1202, that lets an individual exclude capital gain on the sale of qualified small business stock. It applies to stock in a domestic C corporation. Not an LLC, not a partnership. Stock.

For fifteen years the rule was straightforward and slow. Hold the stock more than five years, exclude 100 percent of the gain, capped at the greater of ten million dollars or ten times your basis, and only if the company’s aggregate gross assets never exceeded fifty million dollars at issuance.

That changed on 4 July 2025. For stock issued after that date the exclusion became tiered. Three years gets you 50 percent. Four years gets you 75 percent. Five years still gets you 100 percent. The per-issuer cap rose from ten million to fifteen million, indexed for inflation from 2027. The gross asset ceiling rose from fifty million to seventy-five million, also indexed. Stock issued on or before 4 July 2025 stays under the old rules, and you generally cannot reset the clock by exchanging old stock for new.

The three-year tier is the part that changes founder behavior. The old regime asked you to bet on a five-year horizon before any relief appeared at all, which for a lot of people was longer than they could honestly forecast. Partial relief arriving at year three makes the corporate structure worth choosing at formation rather than at the first term sheet.

Two cautions. This is stock, so an LLC gets nothing, and converting an LLC into a corporation later starts the holding period from the conversion, not from the day you had the idea. And every one of these conditions has to hold at issuance and afterward. It is worth an hour with a tax professional before you file anything rather than after.

Three ways this goes wrong

You form an LLC because it is cheap, then convert under time pressure. Conversion is possible and routine. It is also a taxable event in some configurations, it resets your employer identification number, it costs a few thousand dollars in legal fees, and it lands in the exact week you are trying to close a round. The saving at formation was a few hundred dollars.

You elect S corporation status on general advice and terminate it without noticing. This happens when an accountant optimizes for self-employment tax without asking where every shareholder is tax resident. The election does not fail loudly. It fails on a return, later, with interest attached.

You incorporate somewhere you do not operate and skip the second filing. Incorporating in one state and running the business from another usually requires registering as a foreign entity where you actually operate, with its own fees and its own annual reports. It is not optional, and it is easy to forget because nothing happens for a while.

None of this is advice about your situation and I am not qualified to give any. It is a description of the machinery. The point of describing it is that the machinery is knowable in an afternoon, while the cost of not knowing it shows up years later, priced in something other than money.

Choose the entity that matches how you plan to get paid, not how you plan to be described.

Tomorrow: the registered agent invoice, and what it costs to keep a company alive before it has sold anything.

In Practice: AI in the Enterprise | Day 90: What Comes Next: The Future of Enterprise AI Governance (What to Prepare For Now)

Ninety days of thinking about enterprise AI governance has been useful partly because it’s forced the question: what changes after day 90?

The honest answer is: the challenges ahead are likely to be different from the challenges of today. What follows are observations about emerging patterns and possible directions—not predictions. I’m exploring scenarios rather than asserting certainties.

Today’s governance challenges are structural and procedural. They’re about building governance frameworks that fit foundation models. They’re about distributing governance expertise. They’re about shifting from reactive to predictive. These are hard problems, but they’re addressable with work, with the right expertise, and with organizational will.

The challenges coming are different. They’re about governance in a world where AI isn’t an isolated function—it’s embedded in every part of the business. Where the competition isn’t about who has the best AI. It’s about who can govern AI reliably enough to build customer trust and regulatory confidence. Where the risk surface isn’t models or data in isolation—it’s the complex system of humans, algorithms, and business processes that are deeply entangled.

What follows isn’t a prediction about AI itself. It’s about what enterprise AI governance may need to become.

From Islands to Networks

Today, enterprises still think of AI systems as somewhat discrete things. You have a team working on a recommendation model. Another team working on a fraud detection system. Another on customer service. These are governed separately, with separate risk frameworks and separate accountability.

This was always an artificial isolation. But it was manageable. You could govern each system largely independently.

That’s ending. First, because enterprises are stacking systems—you call the recommendation model, which calls another model, which reads data that’s been transformed by a third system. The risk surface is no longer one model. It’s a network.

Second, because AI is moving from specialized applications to general infrastructure. Language models are becoming utilities. Vision systems are becoming integrated into many workflows. The same foundational system is being used across an organization in dozens of ways, most of which you didn’t architect.

This creates a governance problem that doesn’t exist today: how do you govern a network where the components are interdependent, where the same model is used in multiple contexts, where failures in one place cascade to others?

The governance frameworks of today—designed for individual systems—will not scale to that. You’ll need network-level governance. You’ll need to understand not just whether individual systems are safe, but whether the network is stable. You’ll need to understand emergent behaviors that come from interactions between systems.

The Visibility Problem Gets Harder

Right now, enterprises have an advantage: they’re still building AI systems consciously. Someone in the organization knows about them. There’s a project. There’s a team. There’s a deployment.

That’s changing. As foundation models become more accessible and easier to integrate, organizations could have systems running that nobody in a governance role knows about. A team might fine-tune a model internally for a specific use case. Another team might integrate a public model into a workflow. A third could use an AI service from a cloud provider that abstracts away the model entirely.

This is the governance problem that keeps senior leaders awake at night: shadow AI. Systems running in production, creating consequential outputs, that the governance function doesn’t know exist.

Today, most governance programs are built around the assumption that they have visibility into what’s being built. Tomorrow, they won’t. You can have strong governance processes, but if you don’t know about 60% of the AI systems in your organization, what are you actually governing?

This requires a completely different governance architecture. Not one based on approval gates for known systems, but one based on continuous discovery. Instrumentation. Monitoring. Scanning for systems that are showing characteristics of AI—generating synthetic outputs, making decisions based on pattern recognition, behaving in ways that suggest trained models.

The organizations that are preparing now are starting to think about system discovery. How would you find a deployed model you don’t know about? How would you identify that a system is using AI? What signals would tell you? Those are the governance capabilities you’ll need.

Regulation May Mature (and Create New Risk)

Right now, AI regulation is nascent. Different jurisdictions have different rules. They’re often vague. They’re still being formed. This creates uncertainty, but it also creates breathing room. You can be compliant with one standard and not fully compliant with another.

That may change. Over the next two years, regulation is likely to become more mature. The rules may become more specific, more demanding, more overlapping. Different regions may have conflicting requirements. A system that complies with the EU may not comply with Singapore. Compliance could become increasingly complex.

But here’s the harder part: regulation may create new liability. Right now, if you have a good-faith governance program, regulators are generally forgiving. But as regulation matures, the standard may shift from “did you have a governance program?” to “did you have the right governance program?” And penalties for being wrong could increase.

This creates a risk that most organizations haven’t thought through: governance drift. You could have a program that was state-of-the-art in 2026 and find it outdated by 2028. You might then face a position where you’re compliant with old rules but non-compliant with new ones, but you don’t realize it yet.

Organizations preparing now are building governance programs that are forward-compatible. That can adapt as rules change. That don’t assume the current regulatory environment is stable. Because it’s not.

The Human Factor Will Matter More, Not Less

A common hope in governance is that once you have the right processes and frameworks, execution becomes more routine. You can delegate it. It becomes systematic.

This hope is wrong, especially for AI. The more sophisticated AI governance becomes, the more it depends on human judgment. Is this model output surprising in an important way or an expected way? Does this emerging behavior represent a new risk or just normal variation? When two governance requirements conflict, which do we prioritize?

These aren’t questions you can answer with process. They require judgment. They require experience. They require people who understand both AI and the business deeply enough to see the connections.

Organizations preparing for this are investing in governance people. Not compliance people. People who can reason about risk, who understand technical AI, who can translate between technical and business language, and who are trusted by product teams as helpers, not blockers.

This is counterintuitive. The instinct is that more governance should be less dependent on people, more systematic. But with AI, it’s the opposite. Better governance requires better people.

The Trust Problem Will Emerge

Over the next few years, an interesting dynamic may emerge: AI could start failing in ways that matter. Not catastrophically—not AI systems destroying companies or harming people at scale. But visibly. Systems that discriminate. Systems that produce outputs that turn out to be confidently wrong. Systems that make decisions that, in hindsight, should have been caught.

These failures could be covered. They could be litigated. They could affect customer trust. And they may create an opportunity for enterprises that have genuine governance to differentiate.

Organizations with real governance would be able to say: we caught this. We understand our risks. We know where our systems can and can’t be trusted. We’re not perfect, but we’re reliable.

Organizations without it would be saying: this was an unforeseen edge case. We have controls. We have policies. But they wouldn’t be able to point to concrete governance practices that caught or would have caught the problem.

Trust becomes the battleground. And trust is won through demonstrated governance, not asserted governance.

What You Should Do Now

If you’re responsible for AI governance in an enterprise, here’s what I’d focus on preparing for:

First: Build the capability to discover and map your AI systems. You need to know what’s running in your organization. Invest in scanning. Instrumentation. Monitoring. Not to police, but to understand what you actually have to govern.

Second: Shift from system governance to network governance. Start thinking about how systems interact. Where do failures cascade? Where do emergent behaviors appear? Network-level risks are becoming the dominant risk category.

Third: Prepare for governance evolution. Your current governance program may need significant updates within 18 months. Design it to be updatable. Design it to be forward-compatible. Plan for change.

Fourth: Invest in people. Governance expertise is more valuable than governance process. Build a team that can reason about complex tradeoffs, that’s trusted by the business, that can evolve as the landscape changes.

Fifth: Focus on trust, not compliance. Compliance is table stakes. Trust is the competitive advantage. Build governance practices that genuinely give customers and regulators confidence in your systems.

The Work Continues

Ninety days of thinking about AI governance reveals something important: this is not a problem that gets solved. It’s a problem that gets managed continuously. The organizations that are winning are the ones that accept this. They’re not trying to build governance once and have it work forever. They’re building organizations that can think clearly about AI risk and adjust as the landscape changes.

The challenges of today—framework-building, expertise distribution, governance scaling—are real. And they’ll be solved by enterprises that take the work seriously.

But the challenges ahead are different. They’re about discovering systems you don’t know exist. About governing networks instead of islands. About building trust instead of compliance theater. About developing governance expertise that can evolve as AI itself evolves.

The work of ninety days was about understanding the current moment. The work that comes next is about preparing for what’s coming.

The organizations that are moving fast on enterprise AI are the ones that know this. They’re not waiting for perfect governance in 2026. They’re building governance that can adapt to a 2028 world they don’t fully know yet.

That’s how you prepare for what comes next.

In Practice: AI in the Enterprise | Day 89: Beyond Compliance: How Governance Becomes Competitive Advantage

A question that sometimes reveals misaligned priorities in AI governance is: “What’s the minimum we need to do to comply?”

It’s misguided because it assumes compliance is the constraint. It’s not. The constraint is everything compliance is trying to prevent: deploying systems that fail, that create liability, that damage trust, that lock you into operational patterns you can’t escape.

The organizations that get this right have stopped thinking about governance as cost and started thinking about it as operational infrastructure. The same way that supply chain management isn’t a cost—it’s what enables scale. The same way that financial controls aren’t a constraint—they’re what make complex transactions possible.

Governance becomes competitive advantage exactly when you stop treating it as something imposed from outside and start treating it as something that enables your business to move faster.

The Minimum Compliance Trap

Companies that focus on minimum compliance usually end up with the same governance architecture: a compliance team checking boxes, a business team moving fast and discovering problems later, and a constant friction between the two.

The compliance team is seen as the people who slow things down. The business team is seen as the people who take risks. They’re adversaries. And in that adversarial relationship, the organization moves slower, not faster.

Then when something goes wrong, the compliance team says “we told you so” and implements stricter controls. Which makes everything slower. And the cycle continues.

The question “what’s the minimum we need to comply” leads directly to this dynamic. Because the answer is usually “enough to pass audit.” And passing audit is a low bar for actual governance.

What Competitive Governance Looks Like

The organizations that are genuinely leading on enterprise AI have reframed governance completely. Compliance is a constraint they have to manage, but it’s not what governance is for.

Governance is for enabling confident deployment at scale. It’s the infrastructure that lets you move fast because you understand your risks.

What that actually looks like is different from what most governance programs look like. It includes:

Distributed decision-making capability. Governance isn’t something that happens at a gate. It’s something every team in the organization has learned to do. Your product teams understand how to think about AI risk. Your data teams understand how to govern datasets. Your engineering teams know how to monitor for problems. The governance team’s job shifts from making all the decisions to ensuring that capability is distributed.

Predictive rather than reactive risk management. You’re not waiting for things to break. You’re watching for signals that suggest things are about to break. You’re adjusting assumptions and approaches before problems become crises. This is faster than reactive management because you’re not spending weeks investigating problems and months remediating them.

Clear decision frameworks that empower rather than constrain. Instead of “you need approval to deploy,” the framework is “if your system meets these criteria, deployment is automatic. If it doesn’t, here’s why and what needs to change.” Teams know exactly what they need to do to move fast. They’re not waiting for exceptions. They’re building systems that meet the framework.

Integration of governance learning into how you architect future systems. When something fails, you don’t just investigate—you use that to improve how you approach similar systems going forward. Over time, you’ve learned what works and what doesn’t. Your architectures improve. Your decision-making improves. You fail less frequently.

Speed and Safety as a Unified Goal

This is where the framing shifts from cost to capability. The organizations moving fastest on enterprise AI aren’t moving fast despite governance. They’re moving fast because of governance.

They’re moving fast because:

  • They understand their risks, so they can make confident decisions
  • They catch problems early, so they don’t lose months to remediation
  • They learn from what happens, so they make better decisions next time
  • They distribute decision-making, so they’re not bottlenecked by centralized approval

These are all governance capabilities. And they’re all competitive advantages.

Compare that to companies that view governance as a constraint. They move fast initially, deploying systems without full understanding. But then they discover problems. Then they have incidents. Then they have to explain those incidents to regulators. Then they implement strict controls that slow everything down.

That’s not speed. That’s speed followed by hard stop.

What This Costs and What It Returns

Building governance that’s actually competitive is more expensive upfront than checking compliance boxes. You need people with governance expertise distributed through the organization. You need systems that give you visibility into risks. You need to invest in learning infrastructure.

But what you get back is worth it:

  • Operational speed: Your average time from decision to deployment shrinks because you’re not discovering critical problems after commitment
  • Risk reduction: Your incident rate goes down because you’re catching problems early
  • Organizational learning: You compound improvements because you actually learn from what you see
  • Regulatory confidence: Regulators see an organization that understands and manages its own risks, which leads to lighter-touch oversight over time
  • Customer trust: Your customers see a company that takes governance seriously, which builds long-term relationships

These aren’t small returns. Over a multi-year horizon, the competitive advantage of genuine governance over compliance theater is enormous.

The Threshold Moment

There’s usually a moment when organizations shift from “governance is cost” to “governance is capability.” It’s not when they read an article or hire a consultant. It’s usually when they’ve had a meaningful incident that cost them something real—money, customer trust, regulatory attention, or organizational reputation.

At that moment, they’re forced to choose: double down on theater (hire more auditors, create more policies) or invest in real governance infrastructure. The ones that choose real governance find that six months later, their incident rate has dropped. Their decision velocity has improved. They’re moving faster while being safer.

Where You Actually Are

If you’re reading this, you’re probably not at minimum-compliance-trap organization anymore. You’ve recognized that governance is important. The question is whether you’re still thinking of it as cost to minimize or capability to develop.

Here’s a useful signal: Does governance slow you down or speed you up? If every governance interaction adds time, you have theater. If governance interactions improve your confidence in decisions and reduce time spent on post-deployment remediation, you have something real.

The organizations that are winning on enterprise AI are the ones that have completed the shift from “minimum compliance” to “competitive governance.” That shift isn’t about doing more governance. It’s about doing governance that actually works.

That’s the competitive advantage.

In Practice: AI in the Enterprise | Day 88: The Organizational Learning Loop: How Accountability Creates Continuous Improvement

There’s a category of governance that doesn’t show up in policy documents or frameworks. It’s not something you can hand off to a governance team. It’s how your organization actually learns when something goes wrong.

The difference between organizations that improve and organizations that repeat failures is accountability—not in the punitive sense, but in the structural sense. When something fails, what happens? Does the organization understand why? Does that understanding change how you operate? Does it change how you build and deploy systems in the future?

Most enterprises are terrible at this. They investigate incidents, file reports, move on. They don’t have organizational memory. So they deploy similar risky systems six months later, make the same mistake, and are surprised.

The best-run organizations have built accountability into their governance structure as a learning mechanism. That’s how you improve continuously.

Why Accountability Matters for Governance

Accountability is often positioned as a way to prevent bad behavior—if people know they’ll be held responsible, they’ll be more careful. That’s true, but it’s not the important part.

The important part is learning. When something fails, someone needs to understand what happened and why. That understanding needs to be persistent—it needs to affect future decisions, not just the immediate response.

Most organizations have incident investigation processes. They’re just not connected to their governance systems. When something goes wrong, an engineering team investigates, files a report, and moves on. The governance team doesn’t see the connection. The broader organization doesn’t adjust. The same underlying issue shows up again months later in a different form.

That’s not accountability. That’s theater.

Real accountability is structural. It means when something fails, the learning flows through the organization. It means future decisions are informed by past failures. It means you’re building an organization that gets smarter over time, not one that’s constantly rediscovering the same problems.

What This Looks Like in Practice

The organizations doing this well have built a few specific structures into how they operate.

First: Clear ownership and decision documentation.

Every significant AI system has someone or some team that owns it. That ownership includes understanding what assumptions the system is based on, what the risks are, what conditions would make the system unsafe. This isn’t a symbolic ownership—it’s actual responsibility.

When something fails, the investigation starts with understanding what the owner knew and when they knew it. Not in a blame sense, but in a learning sense. Did they understand the risk? Was the risk identified but accepted? Was there genuinely no way to predict it?

This distinction matters. If a risk was identified and accepted, the organization learned something about its risk tolerance. If a risk was identified but missed, that’s a different learning—the organization needs to improve its risk identification processes. If the risk was truly unforeseen, that’s organizational education.

Second: Structured learning from incidents.

When an incident happens, you want to understand: What were we assuming? How did that assumption break? How could we have detected it earlier? What would we do differently next time?

The best organizations have a structured way of asking these questions. Not a checklist—those tend to become theater. But a genuine conversation with the people involved, aimed at understanding what can be learned and what needs to change.

That learning then gets documented and connected to future decisions. If you discover that a particular type of data is riskier than you thought, you update how you approach similar data going forward. If you discover that your monitoring systems missed an important signal, you add that signal to your monitoring. If you discover that communication broke down, you change your governance structure.

Third: Distributed accountability instead of centralized.

In many organizations, accountability for AI governance sits with a central governance team. They’re responsible for risk. But they can’t actually change how products get built or what data gets used. So accountability becomes disconnected from action.

Leading organizations distribute accountability. Product teams own the risk profile of their systems. Data teams own the governance of their datasets. Engineering teams own how systems are monitored. The governance team’s role shifts from accountability itself to ensuring accountability is being taken seriously across the organization.

This requires trust and clarity about escalation. If a team is taking accountability seriously, the governance team supports them. If accountability is being taken lightly, there’s escalation. But the day-to-day accountability is distributed.

Fourth: Connecting patterns across incidents.

Individual incidents are learning opportunities. But patterns across incidents are governance opportunities. If you have three different teams making similar risk decisions in different ways, that’s information. If you see the same type of problem emerging in three different systems, that’s a signal.

The organizations that improve fastest are the ones that aggregate these patterns and make them visible. They might hold quarterly governance reviews where patterns are discussed. They might have a simple dashboard showing types of risks being discovered, systems affected, and whether learnings are being applied. The point is to make patterns visible so the organization learns systematically, not just individually.

How This Connects to Governance Architecture

This brings us back to a theme I’ve mentioned before: effective governance requires distributed expertise and shared understanding of risk.

When accountability is centralized in a governance team, you get compliance theater. The governance team is checking boxes. The business teams are moving fast and discovering problems later. Nobody is really learning.

When accountability is distributed, you get continuous improvement. Each team owns their risk. They’re incentivized to learn from failures because it affects their own systems. Governance becomes a capability each team develops, not something external that’s imposed on them.

This is why decision velocity and governance effectiveness are connected. Organizations with high decision velocity aren’t moving fast because they’re skipping governance. They’re moving fast because governance is embedded in the teams making decisions. The accountability for the decisions is clear. The learning from failures is rapid. The organization improves continuously.

Why This Matters for Enterprise Scale

At enterprise scale, with many teams building many systems, the difference between learning-oriented and theater-oriented governance becomes dramatic. Learning-oriented governance compound over time. Early learnings affect later decisions. The organization gets smarter.

Theater-oriented governance doesn’t compound. Each team makes decisions independently. Learnings don’t spread. The organization makes the same mistakes repeatedly at different scales.

By year two of an enterprise AI program, you can usually tell which model an organization is running. The learning-oriented organizations have systems that are stable, that are improving over time, that have fewer incidents. The theater-oriented organizations have constant fires and constant surprises.

Where to Start

If you’re building accountability into your governance, start with the highest-risk systems:

  1. Define clear ownership. Who is responsible for this system? Not in a title sense, but in a substantive sense. What do they own?

  2. Document assumptions at deployment time. What are you assuming about this system? What conditions would make it unsafe? When will those assumptions be tested? Get this in writing.

  3. Create structured learning processes. When something goes wrong, what’s the process for understanding why? How do you make sure learning is documented and shared?

  4. Connect patterns across incidents. Are you seeing similar risks in different systems? What does that tell you about your organization?

  5. Measure distributed accountability. How many governance decisions are being made by product/data/engineering teams versus being escalated to a central team? Higher distribution is a signal of health.

The organizations that improve fastest aren’t the ones with the most rigid governance. They’re the ones with the most effective learning loops. And those learning loops are built through accountability structures that make learning visible and continuous.

Governance without accountability is just process. Governance with accountability is how organizations improve.

In Practice: AI in the Enterprise | Day 87: Managing Risk When You Don’t Know the Model (The Foundation Model Age)

There’s a category of risk that didn’t exist five years ago: deploying systems whose internal workings you cannot meaningfully understand, even if you built them.

This isn’t a theoretical problem anymore. For enterprises using foundation models—either off-the-shelf or fine-tuned—this is the actual operating condition. You’re deploying systems that are too large, too complex, and too emergent to hold fully in your explanation budget.

Most governance frameworks assume you can, in principle, understand the system. You might not fully understand it. There might be complexity. But with enough time and expertise, you can crack it open and explain how it works.

That assumption is no longer valid. And organizations haven’t caught up to what that actually means for governance.

What’s Actually Different

Traditional machine learning was comprehensible in a specific way. A random forest made decisions by combining decisions from many trees. A linear model had coefficients you could look at. A neural network had weights and activations you could instrument. These were all complex, but the complexity was a matter of scale and dimensionality, not fundamental incomprehensibility.

Foundation models are different. They’re trained on so much data, using such high-dimensional representations, that their internal decision-making processes are genuinely opaque. You can’t look at a foundation model and understand why it produced a particular output in a particular context. You can measure what it produces. You can test it. But you can’t explain it in the way that governance frameworks expect.

This is sometimes called the black box problem, but that’s a misleading frame. It’s not that the box is black. It’s that there’s no meaningful box at all—just a complex, high-dimensional space of patterns learned from data, activated in context-specific ways that don’t decompose neatly.

For governance purposes, this means something critical: Achieving complete interpretability of foundation models remains an unsolved challenge. This is not a temporary limitation. It is not something you can solve with better explainability research alone. For systems at this scale, full interpretability is not currently achievable.

That’s the actual constraint you’re managing now.

What Leaders Miss

Most organizations are still betting that explainability will become a sufficient governance solution. “We’ll use SHAP. We’ll use attention visualization. We’ll improve interpretability research.” Explainability research is valuable and progressing, but governance frameworks shouldn’t depend exclusively on achieving full interpretability before acting.

Current approaches to understanding a 70-billion-parameter model face significant limitations. These aren’t limitations of current tools alone. They reflect deeper constraints around human cognition, time, and the dimensionality of these systems.

What the best-run organizations are doing instead: They’re shifting from “understand the model” to “understand its behavior in your context.”

That’s a completely different question. You may not know why the model produces a certain output. But you can know:

  • How does it behave on different user populations?
  • Where does it fail systematically?
  • What are the edge cases that make it unreliable?
  • How does its behavior change with different inputs?
  • Where is it making decisions that surprise you?

This is behavioral understanding, not mechanical understanding. And it’s actually achievable, even with systems you can’t fully explain.

The Governance Shift This Requires

If you accept that you can’t understand the model itself, your governance has to shift in three ways.

First: Shift from internal validation to external validation.

You face significant limitations in validating the model by analyzing its internals alone. You must validate it by observing its behavior in the real world. You deploy it. You monitor it. You watch for surprising behavior. You measure whether it’s actually creating the value you expected.

This is slower than trying to achieve complete understanding beforehand. But it’s more realistic. You’re validating against ground truth, not against incomplete understanding. Governance approaches should vary by use case and risk profile—higher-stakes deployments warrant more rigorous interpretability efforts.

Second: Shift from designer intent to observed outcomes.

When you build a logistic regression, you have a specific intent: predict X based on Y. You can validate that the model does what you intended. With foundation models, the intent and the outcomes often diverge. The model might be great at task A (which you tested) and terrible at task B (which someone found in production). The emergent capabilities I mentioned in Day 82 are the clearest example—the model is doing things you didn’t design and didn’t test.

Governance becomes about observing what the model actually does, not what you intended it to do. That requires different monitoring. It requires actual usage data. It requires people watching for surprises.

Third: Shift from point-in-time validation to continuous validation.

You used to be able to validate a model once, sign off on it, and deploy it. The model’s behavior was relatively stable over time. With foundation models, behavior can drift, can vary with input distribution, can change as people discover new use cases. Validation isn’t a gate you pass. It’s an ongoing process.

What Actually Matters for Governance

If you’ve accepted that you can’t understand the model, here’s what your governance framework should focus on:

Behavioral Observability: Can you see how the model behaves across different populations, use cases, and inputs? You need instrumentation that tells you where behavior is surprising, where confidence is high but accuracy is low, where edge cases are emerging.

Failure Mode Monitoring: You can’t enumerate all possible failure modes for a billion-parameter model. But you can watch for the ones that matter most. You can monitor whether outputs are coherent. Whether they align with your training data. Whether they make sense given the context. You can instrument for the specific risks that would matter most if they failed.

Assumption Boundaries: You deploy a model with certain assumptions: It works well with data like X. It’s safe for use case Y. It works well for populations like Z. Your governance should be continuously checking whether those assumptions still hold. When they start to drift, you should know.

Escalation Protocols: When you observe surprising behavior, you need clear protocols for what happens next. Do you temporarily limit deployment? Do you investigate? Do you get human feedback? You can’t treat every surprise as a crisis, but you need a structured way to decide what deserves escalation.

Feedback Integration: When something goes wrong or surprises you, does your organization learn from it? Does that learning feed back into how you deploy similar systems in the future? Or do you treat each deployment as new and independent? Learning organizations catch patterns. Non-learning organizations repeat mistakes.

Why This Matters for Your Enterprise

Foundation models are becoming standard infrastructure. Within a few years, many enterprises are likely to be using them in consequential ways. If your governance framework assumes you can fully understand the models you deploy, it may be worth reconsidering those assumptions. Governance approaches should vary by use case and risk profile—higher-stakes deployments warrant more rigorous interpretability efforts.

Some organizations are restructuring governance around this reality. Rather than focusing exclusively on making models interpretable, they’re building systems that give them visibility into what models actually do.

They’re accepting that they can’t understand everything, so they’re being very clear about what they’re monitoring and why.

Where to Start

If you’re deploying foundation models or planning to, start here:

  1. Accept the constraint: Achieving complete interpretability faces significant limitations at this scale. Rather than focusing all governance effort on achieving full interpretability, prioritize understanding its behavior and building visibility into its operations.

  2. Build observability: What will tell you if something has gone wrong? What would surprise you? Build monitoring around those questions.

  3. Document your assumptions: What are you assuming about this model’s behavior? When will those assumptions be tested? Have you built in signals that tell you when assumptions are breaking?

  4. Create escalation paths: When something unexpected happens, what’s the process? Get clarity on that before you need it.

  5. Measure learning: When something goes wrong, how does your organization learn from it? Can you trace whether you’ve seen similar issues before? Are you updating your understanding based on what you observe?

This isn’t perfect governance. It’s governance in the age of systems you can’t fully understand. It’s better than pretending you can explain what you can’t.

The alternative is deploying black boxes without understanding what they do. That’s not governance. That’s hoping for the best.

In Practice: AI in the Enterprise | Day 86: The Data Foundation That Enables Everything Else

Every significant governance failure in enterprise AI traces back to the same root cause: data problems that weren’t identified early enough.

Not every data problem. Not data quality issues, though those matter. But foundational data problems—questions about where data comes from, who is represented in it, what assumptions are baked into the collection process, whether the data actually reflects what the model is supposed to do.

When those questions don’t get asked until after a model is in production, you’re managing a crisis. When they get asked before, you’re managing a system.

Data governance is where enterprise AI governance stops being theoretical and starts being operational.

Why Data Comes First

Most organizations structure AI governance around models. You have model risk frameworks, model monitoring, model explainability requirements. The assumption is that the model is the primary risk surface.

It’s not. The model is an amplifier. The actual risk surface is the data.

If your training data is biased in a certain direction, your model will amplify that bias. If your data doesn’t include edge cases, your model won’t handle them. If your data collection process has gaps, your model will have blind spots that match those gaps. If you don’t understand what your data represents, you don’t understand what your model represents.

Every model risk problem I’ve seen at enterprise scale had a data problem at its root. The model was fine—it was learning what it was trained to learn. But what it was trained to learn wasn’t what the organization thought it was learning.

What Separates Leading Organizations

The enterprises that are managing data governance well are doing something that seems obvious in hindsight but is almost absent in most organizations: they’re treating data as a primary governance artifact.

Not just data quality metrics. Not just checking that data meets technical requirements. But actual governance of the data lifecycle—from collection through to decommissioning.

That includes: Where does this data come from? Who created it? Under what assumptions? Has it been validated against ground truth? Who is missing from this data? Has the population it represents changed since we started collecting it? What were we assuming when we chose this data source?

These aren’t questions data scientists ask. These are questions governance people need to ask with data scientists.

The organizations doing this best have created cross-functional data governance committees that include product, compliance, data science, and privacy. The committee doesn’t approve every dataset, but they understand the high-risk datasets—the ones that are sensitive, that represent consequential decisions, that are foundational to multiple downstream systems.

The Problem of Inherited Data

One of the hardest data governance problems is inherited data—data that’s been flowing through your organization for years, that you didn’t create, that nobody fully understands anymore.

This is surprisingly common. A dataset that came from a legacy system. A data stream that’s been joined and transformed so many times that tracing back to the original source is difficult. A dataset that was originally collected for one purpose but is now used for something completely different.

Inherited data is where most governance gaps live.

Leading organizations are starting to do data audits—going back through their datasets, understanding where they came from, documenting what assumptions are baked in, identifying which are high-risk for downstream decisions. It’s expensive. It’s unglamorous. But it’s foundational.

The organizations that don’t do this are building AI systems on top of data foundations they don’t understand. That’s a structural risk that no amount of model governance can fix.

The Practical Foundation

Here’s what mature data governance looks like:

1. Data Provenance. For any dataset used in consequential decisions, you can answer: Where did this come from? How was it collected? Who created it? Under what constraints? This isn’t metadata about the dataset. It’s actual documentation of how the dataset exists.

2. Data Representativeness. You know what population this data represents. You know who’s included. You know who’s underrepresented. You know how that shapes what models built on this data can and can’t do. This is crucial for knowing the safe operating envelope for any system built on the data.

3. Data Freshness and Drift. You’re monitoring whether this data still represents what it used to represent. Data distributions change. People change. The world changes. Is your data still valid for its current use case? That’s not a static question. It’s something you monitor.

4. Data Lineage. When you’re using derived data—data that’s been transformed, joined, or aggregated from original sources—you can trace it back. You know what assumptions are in the transformations. You know what’s been lost in the aggregation. You can explain the difference between raw data and what you’re actually using.

5. Data Access and Accountability. You know who is using which datasets for what. Not as surveillance, but as basic governance. If a dataset is foundational to a consequential system, you know who’s responsible for monitoring it and understanding how it’s being used.

Why This Matters Now

Data governance is increasingly the place where enterprise AI governance becomes real. It’s where you move from policy documents to actual decisions about what can and can’t be done.

With foundation models, data governance becomes even more critical. These models are trained on massive, diverse datasets. Their behavior is determined by those training datasets. If you don’t understand what’s in the training data—what biases might be there, what populations might be overrepresented or underrepresented—you’re deploying systems blindly.

For enterprises fine-tuning foundation models or using them with proprietary data, data governance is the lever that determines whether the system is trustworthy. Not the model architecture. The data.

The Starting Point

If you’re starting data governance work, start with the high-risk datasets:

  1. Datasets used in consequential decisions. Who is affected if these models are wrong? Start there.

  2. Datasets that are foundational to multiple systems. If one dataset feeds many downstream models, that’s high-risk for cascade failures.

  3. Datasets you inherited or don’t fully understand. These are structural risks.

For each of these, document: provenance, representativeness, freshness, lineage, and access. That’s not comprehensive data governance, but it’s where governance becomes operational.

The Real Constraint

Data governance is harder than model governance because it requires understanding things that exist outside your systems—how data was collected, what the collection process missed, how the world has changed since collection.

But that difficulty is also why it’s foundational. The organizations that are moving fast are moving fast because they understand their data. They know what their systems can safely do because they know what the data actually represents.

All other governance—model governance, compliance, risk management—is built on top of understanding your data. If you don’t have that, everything else is theater.

Start with data. Everything else builds from there.