The Risk of Everything: AI Governance's Uncertainty Principle

Part I of III. Enterprises built AI governance for harm. The market is about to judge it on value.

I. Count the chairs

Board. CEO. Chief AI Officer. CTO, CISO, Chief Risk Officer. General Counsel, Privacy Officer, Compliance Lead. Procurement, System Owner, Internal Audit.

An infographic doing the rounds on LinkedIn this week sets out the twelve AI governance roles every enterprise needs, arranged like a Formula 1 pit crew around a blue car. Its promise is that when every role is clear, decisions get faster and governance becomes part of everyday AI management.

It is a good chart. I would happily put it in front of a board. It is also missing the one question the markets are now asking.

Nobody on it owns whether the AI pays.

II. One scroll apart

The post directly beneath that chart in my feed came from Jeffrey Funk, sharing a Jacobin essay by Branko Marcetic with a blunt headline: Wall Street Is Getting Very Nervous About AI.

The reporting it draws on is worth taking seriously, whatever you make of the magazine’s politics. The Wall Street Journal reports that Anthropic’s draft prospectus shows a net loss of more than $80 billion in the first half of 2026, on revenue of $16.3 billion, although most of that figure is accounting charges on convertible notes rather than cash. The Financial Times reports OpenAI projecting roughly $278 billion of negative free cash flow between 2026 and 2030. Trading in credit default swaps on AI firms, the FT found, more than quadrupled between July and September.

A lab’s losses do not, by themselves, tell you whether a bank’s claims assistant pays back. But they tell you something about the bill heading your way. Providers burning cash at this scale will not keep subsidising their customers forever. Pricing is already shifting from flat seats towards metered usage.

So the two posts, one scroll apart, are really one story told twice. The first asks who is accountable when AI goes wrong. The second asks who is accountable when AI does not pay.

Enterprises have spent three years staffing the first question. Almost nobody has staffed the second.

III. Governance was born of fear

Look again at the twelve. Seven exist to prevent bad outcomes: security, risk, legal, privacy, compliance, procurement diligence and audit. Three set direction: the board, the CEO and the Chief AI Officer. Two build and run the thing: the CTO and the system owner. The phrase “value tracked” appears exactly once, as a bullet under the Chief AI Officer, wedged between coordination and the operating model.

This is not a flaw in one infographic. It is a faithful portrait of how AI governance was born: out of fear. The EU AI Act asks whether a system is safe, fair and lawful. Model risk frameworks ask whether it is accurate and explainable. Here in Singapore, MAS published its final AI Risk Management Guidelines on 7 October, asking boards and senior management to maintain effective oversight of the risks from AI use. All of this is necessary. I have spent years helping to build it, including the agentic AI governance framework I co-authored with IMDA.

But notice the questions every one of these instruments asks. Is it safe? Is it fair? Is it lawful? None of them asks whether it is worth it.

Werner Heisenberg showed that a particle’s position and momentum cannot both be known precisely at once; the more precisely one is pinned down, the less precisely the other can be. Most enterprises behave as if they have built a governance version of his principle. They can describe an AI system’s risk in exhaustive detail. Ask for its value and the picture dissolves.

A brass balance scale: one pan heavy with sharply focused risk files, the other a soft blur of amber light — Measured in detail on one side; impossible to pin down on the other.

IV. The bill nobody can attribute

The obvious objection is that the CFO already holds the budget and can cut any line in it. True. But the CFO can only cut what can be seen, and AI cost is remarkably good at hiding.

Gartner forecast in March that by 2030, inference on a trillion-parameter model will cost providers over 90% less than in 2025. The same note warned that those savings will not be fully passed on, and that agentic models need 5 to 30 times more tokens per task than a standard chatbot. Its conclusion: overall inference costs are expected to rise. Unit prices fall while the bill climbs. That is the arithmetic of agents.

It is already showing. Fortune reported in May that Uber had used up its entire 2026 budget for AI coding tools in about four months. Asked about connecting that spend to features actually shipped, its President and COO, Andrew Macdonald, was refreshingly candid: “That link is not there yet.”

The value side of the ledger is thinner still. MIT’s NANDA initiative found in 2025, in a much-debated study, that around 95% of enterprise generative AI pilots delivered little or no measurable impact on the P&L. My own firm’s 29th Global CEO Survey, published in January (I should declare the affiliation), found that 56% of CEOs had seen no significant financial benefit from AI so far, and only 12% reported both cost and revenue gains. A Gartner survey published in September found that low-performing organisations did not know the return on 29% of their own AI initiatives.

Put those together. Costs that rise with usage. Benefits most firms cannot yet see. And a sizeable share of initiatives whose return nobody has measured at all.

The gap, then, is not budget authority. It is attribution. AI cost sits buried in cloud bills and software subscriptions that nobody maps to a use case. AI value is claimed in steering-committee decks and never reconciled to the P&L. Look back at the twelve chairs and ask who owns that reconciliation. The honest answer, in most enterprises I have worked with across Asia Pacific, is nobody.

That matters to governance itself. When budgets tighten, a governance function that can only prove what it prevented is a cost centre waiting for a restructure. One that can prove what it enabled survives.

V. The thirteenth seat

So add a seat, and give it to finance. In most organisations this belongs with the CFO and a FinOps capability, not a new C-suite title. What matters is three duties that no seat on the current chart holds.

Unit economics per use case. Cost-to-serve per transaction, per agent run, per decision, reported alongside every risk rating. If you can state a system’s risk tier but not its cost per outcome, you are governing half of it.
A value register beside the risk register. Every material AI system carries a stated business outcome, a baseline and a review date. A system that misses its outcome twice is escalated for a retire-or-reset decision.
Authority to stop the merely expensive. Our frameworks are full of ways to stop AI that is dangerous. They have almost no mechanism for stopping AI that is safe, compliant, well governed and simply not worth running.

The third duty is the uncomfortable one, which is precisely why it needs an owner.

VI. Where the published record lands

None of what follows is an endorsement of this essay. These are what my usual panel have said in public, and the record pulls in more than one direction.

Erik Brynjolfsson would read today’s disappointment as the bottom of the productivity J-curve. Writing in the Financial Times in February, he pointed to US productivity growth of about 2.7% in 2025 and argued that we are moving “from an era of AI experimentation to one of structural utility.” If he is right, the returns are arriving, and the risk is failing to see which programmes are producing them.

Daron Acemoglu is far cooler. He has estimated that only about 5% of tasks will be profitably automated in the near term, and told Fortune in June that big productivity gains are “not as easy as sometimes it’s presumed.” If he is even half right, a value register is not bureaucracy. It is how you find the 5%.

Sam Altman told reporters in August 2025 that AI was in a bubble, while insisting the technology matters enormously. A few weeks later he framed the dilemma with characteristic symmetry: “People will overinvest and lose money, and underinvest and lose a lot of revenue.” Both errors are real. Someone should be measuring which one you are making.

Ethan Mollick locates the leak. Individual workers are getting real gains, he wrote, but “these gains are not being captured by companies.” Capturing them is the thirteenth seat’s job description.

Satya Nadella has set the most demanding test of all. Dismissing self-declared AGI milestones, he said the real benchmark is the world economy growing at 10% a year. That is a value test, applied to a whole civilisation. Enterprises can at least apply it to themselves.

Jensen Huang offers the sharpest pushback, and it deserves a straight answer. At Cisco’s AI Summit in February he said he would not start from ROI at all, and urged companies to let a thousand flowers bloom. He is right that demanding a payback model from every experiment would strangle discovery. My answer is that the value register gates scale, not experiments. Let a thousand flowers bloom in the lab, then ask which ones have earned a place in the production budget.

VII. Price and value

Oscar Wilde defined a cynic as a man who knows the price of everything and the value of nothing. Much of enterprise AI governance has managed a stranger trick. It knows the risk of everything and the value of nothing.

The pressure to change is starting to come from outside. In December the SEC’s Investor Advisory Committee recommended that issuers disclose whether the board oversees AI deployment and report its material effects on operations. Activist investors are on the move too, though not in the direction a sceptic might expect. Starboard has pushed TripAdvisor to move faster on AI; Elliott has pressed LSEG to explain how its AI initiatives will drive growth. Investors want more AI and a clear story about what it returns. That combination is exactly what a value register is for.

So here is my prediction. By the end of 2027, at least one major securities regulator or listed-company governance code will expect boards to report on AI spend and its material effects alongside AI risk. Not because regulators have discovered a passion for ROI, but because AI investment at this scale is becoming too large to leave unexplained.

Short-term turbulence for long-term abundance. The turbulence this time is financial. The abundance depends on governance learning to answer a question it was never built to ask.

Next week, in Part II, I turn to the other assumption hidden in that pit-crew picture: that the car ever stops. Part III asks which AI decisions can never be undone.

VIII. Three questions for Monday’s board

Who in this room can tell us what our AI cost last quarter, broken down by use case?
Which of our AI systems would we switch off tomorrow if doing so were free?
If our AI budget were cut by a third, does our governance function know which programmes to protect?

If the room goes quiet, you have found your missing seat.

The Risk of Everything: AI Governance’s Uncertainty Principle