Governance Fatigue Is Real, and It’s Killing the Governance That Matters

Every governance failure gets the same response: add a committee. Nobody ever asks which of the five committees already in the room should be deleted.

I have watched this play out on the same programme, twice, thirteen months apart. An incident happens. A review is commissioned. The review recommends a new gate, a new sign-off, a new board with a name that sounds important. Nobody asks whether the five existing boards had already covered this ground and simply were not being used properly. The new layer gets built. The old layers stay exactly where they were, because retiring a control is a much harder conversation than adding one, and nobody wants to be the person who removed the safeguard right before something went wrong.

Multiply that pattern across a few years of incidents, mergers, audits and regulatory nudges, and you get an organisation with more governance than anyone can actually operate.

 

The sprawl nobody planned and everybody built

Governance frameworks get bloated one reasonable-sounding addition at a time, not in a single decision. A near-miss produces a new checkpoint. An audit finding produces a new form. A departing executive leaves behind a committee that made sense under their sponsorship and none under anyone else’s. Each addition was defensible in isolation. Nobody ever sat down and asked what the whole structure looked like once you added them all together.

The organisations most proud of their governance maturity are often the ones carrying the heaviest version of this problem. More boards. More gates. More documented sign-offs. It reads as rigour on an org chart and feels like wading through treacle to anyone actually trying to get something delivered.

 

Fatigue looks like silence, not rebellion

The expensive part is what people do once the meetings stop making sense to them, not the extra meetings. They do not object. They do not escalate the absurdity of an ninth sign-off. They quietly learn which boxes can be ticked without real scrutiny, which approvals are theatre, and which route gets something through fastest regardless of whether it is the correct one.

That is governance fatigue, and it is far more dangerous than having too little governance in the first place. An organisation with no controls at least knows it is exposed. An organisation with too many controls believes it is protected, right up until the one decision that actually mattered slipped through a gate everyone had stopped taking seriously.

 

Clarity beats volume, every time

The research on decision rights backs this up more directly than most governance debates acknowledge. Itonics’s analysis of partner and programme governance found that organisations using a properly maintained RACI framework report 70 per cent fewer “who decides” disputes and 25 per cent faster decision cycle times. RACI works by replacing ambiguity with a single, shared answer to a question that used to require a meeting to resolve, not by adding another layer. The gain comes from governance that is unambiguous enough that people stop needing to ask, rather than from adding more of it.

That is the distinction most organisations miss when they respond to a failure by adding structure. The problem was usually oversight so diffuse that nobody could say, without checking three separate documents, who actually held the decision.

 

The discipline of taking something away

Fixing this requires a habit most organisations have never built: retiring governance on purpose. Every new control should come with an audit of what it is replacing, not just what it is adding. Every steering board should have to justify its existence against a simple test: if this group disappeared tomorrow, what decision would genuinely not get made anywhere else? If the answer is “nothing, it would just move up a level,” that board is inertia with a calendar invite, not governance.

The organisations that manage this well treat their governance structure the way a good engineer treats a system under load, asking what is carrying weight it no longer needs to carry and taking it out, rather than just adding capacity when something breaks.

Governance was never supposed to be heavy. It was supposed to be clear. Somewhere along the way, most organisations mistook the two for the same thing.

 

What We Found When We Measured Adoption, Not Just Deployment.

A go live report is easy to write. Every site is on the new system, every licence is issued, every training session delivered on schedule. Three months later, the usage dashboard tells a different story, and it is the dashboard nobody puts in front of the steering committee.

 

The Metric Everyone Reports

Deployment is countable in a way adoption never is. Percentage of sites migrated, number of licences activated, hours of training delivered, these are the figures that go into a programme status report because they can be measured on the day the rollout finishes. None of them says whether anyone is still using the system a quarter later, or whether they have quietly gone back to the spreadsheet it was meant to replace.

 

The Number Nobody Puts in the Steering Deck

IBM’s 2026 Global CEO Study, based on more than 2,000 chief executives surveyed worldwide by the IBM Institute for Business Value, found that only 25 per cent of workers use AI regularly in their jobs, even though 86 per cent of CEOs believe their workforce already has the skills to do so. Eighty three per cent of the same CEOs said AI’s success depends more on people’s adoption than on the technology itself. The rollout finished on schedule. The adoption did not follow.

 

What Poor Adoption Actually Costs

A Forrester Consulting study commissioned by Whatfix, surveying 335 senior decision makers at large organisations across North America, Europe, APAC and India, put a figure on what that gap costs a mid-sized enterprise, $10.9 million a year, plus 728 hours lost per employee navigating systems that were rolled out but never properly embedded. That is not a training budget line. It is the ongoing cost of a deployment nobody followed up on. The same research found a wide gap between organisations with adoption maturity and those without, 53 per cent of mature adopters reported improved user experience against 28 per cent of the rest, and 56 per cent reported stronger return on investment against 28 per cent.

 

Why Deployment Metrics Miss This

Programme reporting is built around milestones a PMO can close off: go live achieved, training complete, licences distributed. Adoption behaves more like a curve than a milestone, one that keeps moving long after the project has been marked complete and the team has moved on to the next initiative. By the time low usage shows up in a satisfaction survey or a renewal conversation, the people who owned the rollout are three programmes further down the roadmap.

Part of the reason adoption rarely gets measured is that almost nothing in a typical programme is set up to reward it. Vendor contracts are frequently structured around go live milestones rather than usage thresholds, so the commercial incentive to keep measuring stops the day the system switches on. Programme teams are resourced to deliver a rollout, not to own what happens to it afterwards, and by the time adoption data would be available, the team has usually been reallocated to the next initiative. None of this is deliberate. It simply reflects a reporting structure and an ownership structure that both end at the same milestone.

 

What We Started Measuring Instead

On some programmes I have run, the fix had less to do with better software and more to do with what the steering committee agreed to look at. We started tracking active usage at 30, 60 and 90 days after go live, alongside a simple drop off rate, how many people who logged in during week one had stopped logging in by week twelve. We also moved benefits realisation sign off away from the go live date and tied it to a usage threshold instead, so a project could not be closed as successful until people were actually using what had been built. It is a small governance change, and it surfaces problems a deployment report never will.

Rollout dates and licence counts still matter, deployment discipline was never the issue. What most programmes are missing is a second dashboard sitting next to the first one, what deployment made possible, and what adoption is showing three months after anyone stopped watching. The programmes that quietly fail are rarely the ones that missed a go live date. They are the ones that hit it, reported it as a win, and never checked what happened next.

Your Gates Aren’t Protecting the Business. They’re Protecting Themselves.

Nobody sets out to build a bureaucracy. Every heavy stage-gate process started as three good intentions: get bad projects killed early, get good projects through fast, and keep a clean record of why each call was made. Then it grew a review board nobody remembers approving, and the good projects started waiting as long as the bad ones.

That is the actual failure. Not that gates exist. That almost nobody still measures them against the job they were built to do.

 

The Test a Stage Gate Was Actually Built to Pass

Governance run properly delivers three things, and nothing else matters as much as these: faster decisions, so a good project stops waiting weeks for a yes. Earlier kills, so a weak one frees up capital instead of quietly draining it for another two quarters. And a clean audit trail, so nobody has to reconstruct the reasoning after the fact. Get those three right and a stage gate speeds decisions. Miss them and it slows every decision down, good and bad alike, because the mechanism has stopped doing the job it was built for.

Someone genuinely has to decide which projects live, which pivot, and which ones are quietly draining the business. That much was never in question.

 

Why the Mechanism Rots

Four patterns do most of the damage, and each one accumulates quietly rather than arriving as a single bad decision. Entry gates get heavy while exit and kill discipline stay weak or disappear entirely, so zombie projects clog the funnel and starve the strong ones of attention. Panels grow larger and meetings grow longer until authority is spread across so many people that nothing actually gets decided. Reviews turn into theatre, rubber-stamping or deferring rather than choosing, and momentum dies in the gap between gates. And decision rights stay ambiguous enough that nobody is the clear owner of the yes or the no, so everything escalates and stalls at once.

Each of those four is a governance design that stopped serving the teams running through it and started serving itself, not a process flaw you fix by adding another step. The entry gate feels productive, so it keeps growing. The exit gate feels harsh, so nobody wants to own it, and that imbalance is where most of the trouble actually starts.

 

The Numbers Behind the Frustration

The frustration shows up in real operating numbers, not just complaints. At Vivix Vidros Planos, a Brazilian flat-glass manufacturer, resolving a customer complaint used to take weeks, long enough for a buyer to lose patience and take the next contract elsewhere. After building an AI-powered chatbot into its existing production and quality data, that shrank to minutes, an 80% reduction in complaint resolution time. Responses to production-line issues sped up by a further 85%. Both figures come from Vivix’s own case study, published jointly by Siemens and AWS. The underlying pattern holds regardless of the exact numbers: the real cost of a slow gate shows up as lost trust and lost contracts, not just lost hours.

 

What Minimum Viable Governance Actually Looks Like

The fix is sizing each gate to the actual risk in front of it, rather than running every decision through the same heavy process regardless of what it actually requires. A low-risk process tweak does not need the same panel as a bet-the-quarter platform launch, and treating both the same is exactly how standing committees fill up with work they should never see in the first place. High-risk decisions keep full board review, because that rigor is proportionate there. Mid-tier decisions get a lightweight gate with a single accountable owner. Low-risk work proceeds by default through a simple intake form, with oversight applied only if something in it actually warrants it.

The useful design target sits between two failure modes: above a ceiling, controls become bottlenecks and teams quietly route around them; below a floor, real risk creeps in unmanaged. Getting that band right is not abstract. One organisation that tightened its policy down to the minimum viable version halved the time complex decisions took and surfaced three times more opportunities than peers still running the heavier version.

 

The Test Most Gates Would Fail

Pick the last three projects your organisation killed at a gate, and the last three it approved. If the kills took longer to reach than the approvals, the gate is not protecting the business from bad decisions. It is protecting itself from having to make any decision at all.

Pre-Mortem: The Accountability Question the Mills Review Left Open

On 6 July 2026, the Financial Conduct Authority published the Mills Review, its examination of how AI will reshape retail financial services in the UK. The review covers seven recommendations across the regulatory perimeter, oversight architecture, and the transition to autonomous decision-making. It names the accountability gap at the centre of autonomous AI trading. It does not close it.

This is the thirteenth piece in the Pre-Mortem series. Five questions, applied to the public record, before the outcome is known.

 

The Bet

UK firms deploying autonomous trading AI are betting that the Senior Managers and Certification Regime (SMCR), the framework that holds named executives personally accountable for conduct failures in their area of responsibility, covers their position through general senior manager oversight. The FCA has been clear that delegating a decision to an algorithm does not transfer senior manager liability to the algorithm. The bet is that this principle, correctly stated and on the public record, can be demonstrated in practice before an enforcement case defines what demonstrating it actually requires.

 

The Assumption

Seven recommendations. One question still without an answer:

When an autonomous trading system executes a decision at machine speed, without pausing for human approval of the individual trade, which specific senior manager function is accountable if that decision causes a customer loss, and what does demonstrating adequate oversight of a system like that actually require?

The Mills Review acknowledged the problem directly. Without guidance, the review found, the combination of greater opacity in AI-mediated decisions and factors such as model drift makes it harder for the regulator to identify a de facto responsible individual, or for senior managers to evidence meaningful human control. Stakeholder feedback throughout the review called for clearer guidance on what constitutes the “reasonable steps” expected of senior managers. The review recommends the FCA develop it. The FCA has not yet published it. Every firm currently deploying autonomous trading AI is operating on the assumption that its existing accountability structure covers the gap. That assumption has not been tested in an enforcement case.

 

The Sequence

December 2019. SMCR extended to all FCA solo-regulated firms, completing its rollout across financial services.

27 January 2026. The FCA launched the Mills Review, acknowledging that AI in retail financial services had developed faster than the regulatory frameworks designed to govern it.

24 February 2026. Call for input closed.

6 July 2026. The review published seven recommendations. The FCA committed to adapting its regulatory frameworks as the transition to autonomous models continues. No guidance named a specific senior manager function as accountable for autonomous trading decisions. No guidance defined what “reasonable steps” requires for a system executing at machine speed without human review of individual decisions.

The capability reached the market before SMCR was tested against it. The review arrived after the capability. The guidance has not arrived yet.

 

The Pager

The FCA has confirmed there will be no dedicated Senior Manager Function for AI, and that accountability falls on existing functions. That is a clear policy position and it deserves credit for being stated plainly. The Treasury Select Committee has urged the FCA to publish guidance specifying the level of assurance expected of senior managers for AI-related harm. The Mills Review carried that request forward into its recommendations. The harder question is the one seven recommendations did not answer: when an autonomous trading system causes a customer loss, which specific function holder carries the call?

 

The Proof

There are no enforcement cases. The first case will establish what “reasonable steps” means in an AI trading context. The Mills Review is a process measure: it produced recommendations. The outcome measure worth watching is whether the FCA’s follow-on guidance names a specific function and defines the oversight standard in operational terms rather than principles alone. A principle restated is not a gap closed.

 

Verdict

If the FCA’s follow-on guidance names the senior manager function accountable for autonomous trading AI and defines what “reasonable steps” requires at the operational level, UK financial services will have resolved an accountability gap that every other major jurisdiction is still navigating. The review’s existence, the named individual who led it, and the seven published recommendations are genuine evidence that the FCA identified the problem and moved on it. Without operational guidance, the gap stays open. The first enforcement case will write the rule in the least comfortable setting available. That is a considerably worse way to write it.

Why Traditional Project Management Is Failing Modern Teams

Why Traditional Project Management Is Failing Modern Teams

Most project failures get blamed on execution. A missed deadline. A stakeholder who went quiet at the wrong moment. A scope that crept until nobody could point to when it happened.

Look earlier and the failure was already built in before a single sprint started.

A Forbes Technology Council analysis makes the point directly: misalignment gets embedded into the foundation long before execution begins, not manufactured somewhere in the middle. The team that won the deal rarely stays involved in delivery. The customer’s actual operating mindset only reveals itself once work is already moving. The incentives written into the contract often point delivery and client in different directions before day one. Teams execute a plan that was already structurally unsound before the first sprint started.

Traditional project management was never built to catch that kind of problem. Waterfall assumes you can define requirements fully upfront, lock them, and deliver against a fixed spec months later. That assumption survives about as long as the first change request. Priorities that shift inside a six-week planning cycle, which describes most programmes now, make a locked spec obsolete before it has even shipped.

 

Rigidity Is the Symptom. Something Else Is the Disease.

Here’s the twist most framework debates miss. Methodology by itself isn’t what separates the teams that deliver from the ones that don’t. PMI’s most recent Pulse of the Profession research found project performance sits at roughly 73.8% whether a team runs predictive, hybrid, or agile delivery, and whether people work remote, hybrid, or in-person. What actually moved the needle was business acumen: professionals strong in it posted 27% lower failure rates, regardless of which framework sat on the wall.

Framework still matters. It was just never the whole story, and treating “which methodology” as the central question misses where most programmes actually break.

A PM Solutions case study makes the same point at a larger scale. A U.S. staffing company with more than 8,000 internal and 90,000 contract employees had already tried and failed to stand up a PMO once. On the second attempt, the team built a hybrid methodology suited to the client’s actual environment, blending traditional project management, agile, and the touchpoints where each meets software delivery, then added a governance structure, portfolio visibility and resource planning on top of it. Within six months, every project flagged red under the new reporting system, more than $13 million worth of work, was recovered. One severely troubled multi-year project, over budget and behind schedule, was turned around in four weeks once it had a dedicated programme manager working inside that structure. Not a framework doctrine. Governance and visibility.

 

The Real Adoption Curve

That pattern shows up in the adoption numbers too. Hybrid delivery has grown 57% since 2020, while purely predictive approaches have fallen 24% over the past three years. The pattern behind that shift is simple: pure Waterfall and pure Agile were both answering questions the actual work wasn’t asking, and organisations are admitting it with their adoption numbers rather than in a strategy memo.

Rigid, one-size-fits-all implementation is what actually ages badly, more than the framework choice underneath it. Portfolios that mix delivery models by what the work actually demands, a predictable cadence for mature products, flow-based delivery for continuous work, fast validation cycles for early bets, consistently outperform portfolios that force every initiative through the same certified process regardless of fit.

 

What This Means for the Programme You’re Running Now

The practical shift isn’t abandoning structure for chaos. It’s building governance that travels with whichever delivery model fits the work, instead of assuming the delivery model is the governance.

Start by naming decision rights before the kickoff, not after the first dispute breaks something. Someone owns scope changes. Someone owns the call when a dependency slips. Everyone on the programme should be able to name both without asking. Build the escalation path into the plan itself rather than inventing one under pressure in week eight, and match the delivery model to the type of work in front of you rather than to what worked on the last programme. A regulated, multi-vendor transformation and a ten-person product team shipping a new feature are not the same problem, and forcing them through the same framework produces the same failure pattern twice.

Track what the framework was supposed to deliver, not whether the ceremonies happened. A team that ran every stand-up and still shipped nothing useful followed the process and failed anyway.

 

The Question Every Kickoff Should Answer First

Before the next programme gets a charter and a framework stamped on the cover page, ask a harder question first: who owns the decision when priorities collide, and does that answer exist in writing before the first sprint starts?

If it doesn’t, the framework on the cover page was never going to save the programme underneath it.

The Governance Training Nobody Budgets For

Nobody has ever failed a project because they didn’t know how to build a Gantt chart. However some failed because nobody taught them who was allowed to say no.

I have sat in quite a number of programme inductions, and every one of them covers the same ground. Scheduling. Budgeting. Risk logs. RAID templates. Reporting cadence. Then, somewhere around the second afternoon, someone puts up a slide about governance and the room’s attention visibly leaves the building. It is treated as the compliance module, the thing you sit through before you get to the real work. Nobody walks out able to say, with any confidence, who actually owns the call when a decision does not fit neatly on a template.

That gap is not an oversight. It is a choice organisations keep making, year after year, without ever naming it as one.

 

The curriculum has a hole in it

Ask a newly promoted programme manager to explain their RAID log and they will do it fluently. Ask them who has the authority to accept a risk above a certain threshold without escalating it, and watch the pause. That pause is the sound of someone realising they were never actually taught the answer, only ever expected to absorb it by watching more senior people long enough.

A 2026 AI Governance Gap Report surveying more than 500 HR professionals found that only 45 per cent of organisations provide AI literacy training to all employees, one concrete, measurable instance of the broader governance-literacy gap this piece is about. Two-thirds of HR teams are already using AI to shape compliance and policy decisions, and the same report found fewer than half have given employees even that AI-specific literacy training to keep pace. The gap shows up well beyond HR too, in every function that has ever built a decision-rights framework, filed it in a folder, and assumed the document itself did the teaching.

Documents do not teach. People do, and usually only the ones who were already senior enough to have picked it up somewhere else.

 

Decision rights are treated like folklore

Most organisations do not lack a governance framework. They have one, usually a good one, sitting in a policy library that almost nobody outside the PMO has opened. What they lack is a mechanism for turning that document into instinct.

The result is a workforce that learns decision rights the hard way: by guessing wrong in front of a steering committee, by escalating something trivial and being quietly told off for wasting everyone’s time, or by not escalating something serious and finding out only when it has become a crisis. Every one of those is an expensive way to teach a lesson that could have been taught in an afternoon.

This is where the “knowing-doing” research cited by Harvard Business Review becomes uncomfortable reading for anyone who runs a training budget. Two out of three managers say they are still uncomfortable having accountability conversations with their own people, despite most of them having sat through the leadership training designed to prepare them for exactly that. The problem was never a shortage of content. Knowing a framework exists and being able to act on it under pressure are two entirely different skills, and organisations keep training the first while assuming it produces the second.

Governance training suffers from the same fault line. Knowing there is an escalation policy is not the same as recognising, in the middle of a stressful Tuesday, that the decision in front of you is the one the policy was written for.

 

The training everyone skips because it looks obvious

There is a reason this particular gap survives budget reviews when almost nothing else does. Governance training looks like it should be simple, so nobody prioritises building it properly. Everyone assumes the framework document is self-explanatory, right up until the moment someone makes the wrong call and the post-incident review discovers that three different people had three different understandings of who was supposed to decide.

I have run those reviews. The finding is almost never “the framework was wrong.” Almost always, nobody had ever been walked through what the framework meant in a live situation, so everyone applied their own version of common sense, and common sense is not actually common.

 

What actually needs teaching

A longer policy document will not fix this. Longer documents get read less, not more. The fix is teaching people to recognise a decision point before it arrives, not after.

That means running people through real scenarios instead of abstract categories, trading “what is your escalation threshold” for “here is a supplier problem that looks small and is not, what do you do in the next ten minutes.” It means naming, out loud and often, the handful of decisions in your organisation that carry disproportionate weight, so people learn to feel the shape of one before it is labelled for them. And it means treating governance literacy the way you would treat safety training: refreshed, tested, and taken seriously enough that senior leaders visibly participate in it themselves, rather than left as a one-off induction module.

The organisations that get this right build fewer, better decision-makers rather than thicker governance frameworks: people at every level who can spot a genuine decision point on instinct, the same way an experienced engineer can hear an engine fault before the dashboard lights up.

You cannot budget for the crisis a decision creates and then refuse to budget for teaching people to see it coming.

 

 

Pre-Mortem: The Liability Chain Medicare’s AI Prior Auth Model Has Not Drawn

On 1 January 2026, the Centers for Medicare and Medicaid Services in USA launched the WISeR model in six states, introducing prior authorisation to procedures that traditional Medicare had always provided without it. Contracted companies now assess medical necessity using AI. Human clinicians are required to sign off on any denial. The Senate voted 46-50 in July 2026 to keep the programme running. One question has not been answered.

This is the twelfth piece in the Pre-Mortem series. Five questions, applied to the public record, before a programme has had the chance to succeed or fail.

 

The Bet

CMS is wagering that AI-assisted prior authorisation reduces unnecessary Medicare spend without producing the patient-safety incident that forces a political reversal. If WISeR delivers measurable waste reduction without a documented causal chain from AI denial to patient harm, it becomes the template for prior authorisation across Medicare nationally. If it produces that chain, a documented line from AI recommendation to denial to patient harm, it does not just end WISeR. It becomes the reference point that makes AI prior auth politically untouchable in federal health programmes for a generation.

 

The Assumption

CMS has answered every operational question about WISeR except this one:

When an AI recommendation leads a contracted clinician to deny care and a patient is harmed as a result, where does liability sit?

The model design places a human clinician between the AI output and the denial decision. That establishes a paper trail. It does not establish a liability framework. Contractors earn between 10 and 20 per cent of the savings generated by denials and lose that payment when a denial is overturned on appeal. That is a commercial penalty, not a clinical one. The Federal Tort Claims Act does not cover contracted entities. No federal court has tested whether a contracted clinician reviewing AI recommendations at volume carries the same duty of care as a treating physician making an independent clinical judgement.

The assumption doing all the work in this model is that the human review layer is accountability enough. That assumption has not been tested.

 

The Sequence

1 July 2025. CMS published the WISeR notice in the Federal Register and did not submit it to Congress under the Congressional Review Act. That omission would matter later.

1 January 2026. WISeR launched in New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington.

17 March 2026. The Washington Post published an exclusive: Medicare’s new AI gatekeeper was delaying care for seniors. The University of Washington’s medical system had nearly 100 patients waiting for epidural injections. In Arizona, Phoenix pain specialist Dr Matthew Crooks told Medscape that every epidural injection submitted in the first three months had been denied and described the system as completely nonfunctional and unsustainable. In Texas, initial AI approval rates ran at 62 per cent, against a 92 per cent national approval rate across Medicare Advantage.

25 March 2026. The Electronic Frontier Foundation filed a FOIA lawsuit against CMS in federal court in California, seeking records on WISeR’s AI algorithms, training data, bias safeguards, and the financial incentives paid to contractors. The suit confirmed that CMS had not made its AI methodology or vendor compensation structure publicly available seven weeks after launch.

6 April 2026. CMS published a Federal Register notice delaying prior authorisation implementation for certain services within the model to allow additional time for operational readiness. CMS also issued a corrective action order against one of its AI contractors. Both confirmed that the model’s operational design had not performed as intended in the first quarter.

12 May 2026. The Government Accountability Office issued its determination: WISeR met the Administrative Procedure Act definition of a rule and was subject to the Congressional Review Act. CMS had not made the required submission to Congress before the model took effect.

20 May 2026. Senator Ron Wyden and Representatives Suzan DelBene and Greg Landsman introduced resolutions of disapproval in both chambers, seeking to repeal WISeR under the CRA.

6 July 2026. Gold carding launched in Washington state. Providers achieving a 90 per cent affirmation rate across a minimum of ten prior authorisation requests become exempt from further review for covered services. Quarterly rollout to the remaining five states is planned.

16 July 2026. The Senate voted 46-50 against advancing the disapproval resolution. Party line. WISeR survived. The liability question the GAO had exposed survived with it.

The Pager

Dr Mehmet Oz, Administrator of the Centers for Medicare and Medicaid Services.

The message: WISeR’s accountability chain has not been drawn. The model places a contracted clinician between an AI denial recommendation and a Medicare beneficiary, but no published document establishes where negligence sits when a patient is harmed following an AI-assisted denial. The Federal Tort Claims Act does not cover contractors. Contractors point to the human clinician. Clinicians are reviewing AI output under volume pressure with no published duty-of-care standard for that specific context. When the first federal lawsuit tests this configuration, and one will, CMS will need a published framework, not a contract clause. That framework is easier to write before litigation than after.

 

The Proof

Gold carding is the model’s self-correction mechanism. If quarterly rollout reaches all six states and the 90 per cent affirmation threshold functions as a genuine quality signal, the AI layer contracts over time as trust is established. Proven providers exit prior auth. New entrants face the review. The model becomes calibrated rather than blanket.

If gold carding stalls or rollout criteria are applied inconsistently across jurisdictions, the AI layer expands without a release valve. Prior auth burden accumulates regardless of provider track record. The model becomes a cost-reduction instrument with no exit for providers who have earned one.

The proof of the bet is not the aggregate savings figure. It is whether WISeR, by the end of 2026, has published a liability framework and delivered gold carding in all six states. Without both, the model is running on the same untested assumption it started with.

 

Verdict

If CMS publishes a liability framework for AI-assisted denials before a federal case forces the question, and gold carding delivers consistent rollout across all six states, WISeR will be the strongest government evidence yet that AI-assisted utilisation review can reduce Medicare waste without a patient-safety crisis. The accountability design would become the reference for every federal health programme that follows.

Without the liability framework, WISeR accumulates its risk quietly. Not through a single dramatic incident, but through the gap between AI recommendation volume and human review capacity, compounded by an accountability vacuum no published document has yet closed. That gap does not stay open indefinitely.

Pre-Mortem: The US Government’s 3,611 AI Use Cases

On 3 April 2025, the White House issued OMB Memorandum M-25-21, directing every major federal agency to appoint a Chief AI Officer, expand the use of artificial intelligence across government operations, and manage risk proportional to each system’s impact on citizens. Twelve months later, the Federal Agency AI Use Case Inventory records 3,611 AI use cases across 56 agencies, more than double the prior year’s total. A May 2026 survey of more than 200 technology executives across civilian and defence agencies found 53% are actively planning agentic AI pilots. Only 8% of those agencies have incident response frameworks in place.

This is the eleventh piece in the Pre-Mortem series. Five questions, applied to the public record, before a programme has had the chance to succeed or fail.

 

The Bet

The US government is betting that embedding AI across 3,611 federal workflows covering benefits decisions, immigration adjudications, healthcare determinations, and law enforcement, will make government faster and more efficient before the accountability architecture governing those decisions is clarified. OMB M-25-21 requires Chief AI Officers, public AI inventories, and risk management proportional to impact. The hard compliance deadline for role-specific AI training arrives in September 2026. If that architecture catches up to the deployment before a consequential wrong decision reaches a citizen with no named relief, the bet holds.

 

The Assumption

The expansion’s credibility turns on one unanswered question: whether the Federal Tort Claims Act, designed to govern negligent acts by human federal employees, applies without amendment to decisions made by AI agents running inside federal systems. The same May 2026 survey found only 44% of agencies include vendor liability clauses in AI contracts, and only 29% have documented kill-switch procedures. The legal architecture governing accountability in federal government was designed for humans acting on behalf of the state. No court has ruled on whether it extends to the agents they built.

 

The Sequence

In 2024, federal agencies reported 1,757 AI use cases. By 2025, that figure had grown to 3,611. In March 2026, the Department of Veterans Affairs expanded AI use in claims processing, with 215 of its 367 AI systems classified as high-impact, covering benefit eligibility, healthcare access, and fraud detection. In May 2026, the majority of agencies were planning agentic pilots, with only 20% having defined pre-deployment testing policies. The AI reached citizens before the accountability reached the AI.

 

The Pager

Russell Vought, Director of the Office of Management and Budget, carries the M-25-21 mandate at the centre of the federal AI expansion. Every covered agency has designated a Chief AI Officer responsible for inventory, risk management, and AI governance at agency level. The VA alone runs 215 high-impact AI systems. No single published document names what relief is available to a veteran whose claim was influenced by one of those systems, which official carries accountability for that decision, or whether the Federal Tort Claims Act applies when the acting party is software, not a civil servant.

 

The Proof

The measure that would settle this is a published legal standard: a named accountability chain clarifying who carries liability when a federal AI agent makes a consequential wrong decision, whether government, vendor, or joint, and whether the Federal Tort Claims Act applies or new legislation is required. No such standard has been published. OMB M-25-21 requires risk management proportional to impact. It does not name the relief available to a citizen when that risk management fails, nor the date by which that question must be answered.

 

Verdict

If OMB publishes, before the September 2026 training compliance deadline, a named accountability standard for AI-driven decisions in high-impact federal systems, covering who carries liability when the AI is wrong and what legal remedy a citizen holds, the expansion will stand as the most deliberate attempt the US federal government has made to govern AI before it reaches citizens at scale. Without that, the US government has put AI into 3,611 workflows and left the question of who carries the call when the AI gets it wrong to be answered in court, by accident, or not at all.

Regional Leadership Roles Reward a Different Kind of Patience Than Western Corporate Careers Teach.

Most Western executives arrive in a regional leadership role with the instincts that got them promoted at home: move fast, show visible wins early, let the quarterly numbers do the talking. Those instincts do not transfer. They actively work against you.

Western corporate careers train impatience, and reward it. Promotion cycles run on twelve to eighteen month windows. Performance reviews measure the quarter just closed. The fastest route up is a visible individual win, attached cleanly to your name, delivered before the next review cycle starts. None of that is wrong inside the system that built it. It is a system optimised for institutional and contractual trust, built on the assumption that the relationship survives even if the individual leaves tomorrow.

 

What Regional Leadership Rewards

Gulf leadership runs on a different clock, and the data on how regional leaders actually spend their time backs that up. PwC’s most recent Middle East CEO survey found Saudi Arabian chief executives dedicate 27% of their time to planning five years or more ahead, compared with 16% globally, and GCC chief executives overall spend meaningfully more of their schedule on long-term strategic planning than their global counterparts. That time allocation is a rational response to a business environment where relationships carry the weight of a deal through its inevitable rough patches.

The mechanism underneath that patience has a name: wasta, the use of personal relationships and trust networks to get things done. Research summarised by Northeastern University’s D’Amore-McKim School of Business puts it plainly: “in the Arab context, trust at the interpersonal level needs to be established before any business relationship can unfold.” That is not a bureaucratic delay. It is the actual mechanism through which decisions get made, and skipping it does not speed anything up. It just means the decision never fully lands.

 

The Failure Rate Everyone Quotes Does Not Hold Up

Ask any expat executive circle and you will hear it: 20 to 40% of international assignments fail. It is one of the most repeated statistics in expatriate management, and it is very likely wrong. Anne-Wil Harzing’s 1995 analysis traced the figure back to a small number of frequently misquoted articles, only one of which actually contained solid empirical evidence, and that evidence showed failure rates to be low. The myth persisted for three decades anyway, because it made a better opening line for a consulting pitch than the more boring truth.

The more useful question is why the ones who do fail actually fail. The qualitative research on that is far less contested: misjudging the local pace of trust-building rather than any shortage of competence or effort.

 

What Patience Looks Like in Practice

Cross-cultural consultancy Commisceo Global puts the practical advice plainly: do not expect deals to be completed in two visits to the region, because the relationship has to be nurtured before the commercial conversation can move forward at all. That advice sounds soft to an executive trained to treat a second meeting without a signed term sheet as a stalled deal. It is a description of how decisions actually get authorised in a hierarchy where personal trust in the room outweighs the org chart on paper.

Twenty years running programmes across markets that operate on this clock, the pattern I have seen most often has nothing to do with understanding the concept. Most executives can recite the advice back accurately in an interview. Where they struggle is stopping themselves from behaving as though the Western clock is still running underneath it: checking for the win they would expect by month three, reading the absence of one as a signal that the relationship has stalled, when it has not.

 

Three Things That Actually Help

Building trust deliberately, rather than waiting for it to accumulate on its own, takes specific behaviour. Spend real time in the room before asking for the decision. Learn who actually holds influence in a given relationship, because it is rarely only the most senior title at the table. And resist manufacturing a visible early win for the story it tells back home, because the fastest way to damage the trust being built is to be seen optimising for your own next review cycle instead of the relationship in front of you.

 

What This Requires

The patience regional leadership rewards has nothing passive about it. Ninety-three per cent of CEOs across the GCC expect domestic momentum to keep strengthening, against 55% of their global peers. These are not leaders coasting on a slow market. The patience is aimed at a specific target: building the trust that makes fast execution possible later, instead of chasing a fast, visible win the relationship cannot yet support.

That is a genuinely different skill to the one a Western corporate career trains for, and it rarely shows up on the resume that got someone the role in the first place. The executives who actually succeed in regional leadership rarely arrive already patient. They learn to notice, quickly, that the clock they were trained on is the wrong clock, and recalibrate before the org chart tells them they have run out of time to.

Two-Thirds See AI Working. The CFO Still Can’t Prove It.

Two-thirds of organisations say AI is delivering real productivity gains. Ask the CFO whether that translates into a return they can defend, and the answer changes completely.

 

Two Surveys, Same Landscape, Different Question

Deloitte’s 2026 State of AI in the Enterprise report, surveying 3,235 senior leaders across 24 countries, found 66% of organisations reporting real productivity and efficiency gains from AI, and 53% reporting genuinely better insights and decision-making. That is not a marginal result. Two-thirds of a very large sample are seeing the operational benefit show up in how the work actually gets done.

EY’s 2026 Global DNA of the CFO Survey, covering 1,610 CFOs, finance directors, and heads of finance at organisations with over a billion dollars in revenue, was fielded in the same window and asked a different question: not whether AI is helping, but whether finance can prove it in the language capital allocation actually requires. The answer is uncomfortable. Just 12% of CFOs say their finance transformation outcomes exceeded expectations over the past two years. Only 21% describe their function’s AI readiness as leading or advanced. And 71% say plainly that traditional metrics are not enough to evaluate initiatives that combine people and technology.

 

This Is Not Two Surveys Disagreeing

Read carelessly, that looks like a contradiction: one report says AI is working, the other says it isn’t. It isn’t a contradiction. It is two different functions answering two different questions, and the gap between the answers is the actual story.

The operational teams reporting gains in the Deloitte data are measuring what they can see directly: faster cycle times, fewer manual steps, sharper analysis. None of that is fabricated, and none of it is trivial. But productivity gain and return on invested capital are not the same measurement, and the EY data shows finance has not built the bridge between them. Sixty-one per cent of CFOs cite data quality and bias as their top challenge in securing further AI investment, which is a polite way of saying the numbers underneath the business case are not yet reliable enough to defend in a capital allocation meeting.

A separate July 2026 survey of 1,505 senior finance leaders across the US, UK, Australia, and India found the same pattern from a slightly different angle: 92% feel active pressure to prove AI investment is paying off, while only half report their AI agents have actually achieved a measurable return. The pressure to prove value is running well ahead of the organisation’s actual ability to measure it.

 

The Real Governance Gap

None of this is a technology problem. The Deloitte numbers show the technology is doing what it was bought to do, in a majority of cases, across a very large sample. It is not really a capital problem either. Boards are still funding AI investment at pace, and EY’s own data shows CFOs largely expect that to continue.

It is a measurement problem, and measurement problems are governance problems wearing a data costume. Somebody has to own translating “the team says this is working” into “here is the return, measured the way capital allocation actually requires it to be measured,” before the investment decision, not after it, using metrics that were agreed while everyone could still agree on them.

Most organisations have not assigned that ownership to anyone specific. It sits, by default, somewhere between IT, who built the thing, and finance, who has to defend the number nobody built the measurement framework to produce.

 

What Actually Closes the Gap

Fixing this does not start with better AI. It starts with defining, before the next AI investment gets approved, exactly what “return” means for that specific initiative, in terms finance and the operational team both sign off on before deployment, not after. It means putting one named owner against that measurement framework, not a committee, and not IT by default because they happened to build the system. And it means accepting that a lot of the value AI is already producing is real but currently invisible in the metric finance is required to report against, which is a reason to fix the metric, not to distrust the value.

 

The Question Worth Asking Before the Next AI Business Case

The next time someone asks whether an AI investment delivered a return, the sharper question is whether anyone defined, in advance, what return was actually supposed to look like, and in whose language it would need to be proven. Most organisations running significant AI programmes right now cannot answer that question. That is the real gap the numbers are describing, and it is entirely fixable, starting with the next business case, not the last one.