Governance is a latency problem: why time-to-evidence is the number your board is not tracking
Two numbers, one year. U.S. state AI laws went from 49 to 131, nearly 2.7 times. Federal AI regulations issued reached 59, roughly double the prior year (Stanford HAI, AI Index Report 2025).
Everyone agrees this is a lot. The argument is about what it means for a business, and that argument decides whether your governance program is an engine or an anchor.
Position A: governance is a brake. Do not let it set your speed.
The case deserves its strongest form. Rule volume is outrunning anyone's ability to interpret it. The rules conflict across states and sectors. Federal direction is unsettled, so building to today's text risks building to tomorrow's repeal. Meanwhile 78% of people who use AI at work already bring their own tools (Microsoft and LinkedIn, Work Trend Index 2024). Your workforce has voted with its keyboards. Under those conditions, the argument runs, heavyweight review boards cost real speed against competitors who are shipping, and the sensible posture is to move, keep records loosely, and respond to enforcement if it arrives.
Every part of that is partly true. Review queues do cost speed. The patchwork is maddening. Nobody is going to read 131 statutes and map them by hand.
Position B: governance is an accelerator. Speed without evidence stalls at the gate.
The counter-position starts from where AI projects actually stall. Rarely at the technology. Usually at the moment someone with authority asks "show me": a customer's security review, a procurement gate, an insurer, an auditor, a board member who read the headlines. At that moment, the company that can produce the access controls, the data handling, the audit trail, and the approval record in hours keeps moving. The one that has to reconstruct them from memory and scattered logs stops, for weeks and sometimes a full quarter, while the system, which was ready long ago, sits idle.
On this view, governance is not what costs speed. Missing evidence costs speed, and it charges its fee at the worst possible moment, when a deal, a launch, or a renewal is waiting on the answer.
The synthesis: governance is a latency problem
Both camps are describing the same company from different ends. Position A is right that a manual, queue-based process cannot scale with rule volume. If each new law needs a person to read, interpret, and map it, your workload grows with the rule count and your headcount does not. Position B is right that the real cost is not the control. It is the delay in proving the control exists.
The resolution is to stop measuring governance by what you have (policies, committees, frameworks) and start measuring what it delivers: time-to-evidence, the elapsed time between "show me" and a complete, defensible answer. That number falls when evidence is produced as a byproduct of the system running. It balloons when evidence is assembled after the fact. The second path is the retrofit tax in its purest form: the same work, done later, under pressure, with less information than you would have had if you had captured it as you went.
Where this already works, and the objection you are forming
Let me put the objection first: this is fine for a large company with a dedicated compliance staff. I have a legal team of three and a launch date.
Fair. But the companies that handle "show me" well are not the ones with the most headcount. They are the ones where evidence is a design requirement, not a deliverable. I have spent years leading production platforms in environments where a system did not run until its evidence could be produced on demand, and the lesson that transferred was not the paperwork. It was the sequence: capture it as the system runs, and the answer is already there when the question arrives.
Not the same rigidity. The same honesty about what production requires.
What this means for leaders: three moves
1. Run the Evidence Clock. Pick your three most consequential AI systems. For each, write down the five questions a customer, insurer, or auditor would ask first: who can access it, what data it touches, what it did and when, who approved it, and what happens when it fails. Then time a real attempt to answer each. Do not estimate. Run it. The result is one board-legible number per system: hours, days, or weeks. Most teams that run it honestly the first time are surprised in one direction only.
2. Audit the approval queue. Map where AI initiatives wait. For every stage (legal review, security review, risk committee) record time in queue and why it waits. If the wait is for a person to gather evidence the system could have produced automatically, you have not found a governance problem. You have found a plumbing problem, and you are paying governance prices for it.
3. Rehearse the rule change. Pick one hypothetical new rule and ask: from publication to demonstrable compliance, how many systems, teams, and documents must change? If the answer is "we'd start a project," then every one of the next 80 laws is a project. Build so a rule change touches a control, not a system inventory.
The CFO perspective
Treat time-to-evidence as a cost of delay. A system waiting on paperwork carries its full build cost and earns nothing. And the downside is not abstract: IBM's 2025 breach research found that breaches involving unmanaged "shadow" AI cost roughly $670,000 more than those where AI was governed (IBM, Cost of a Data Breach Report 2025). For an owner, that is the premium you pay for not knowing what is running. Slow evidence and weak control usually share a root cause.
The window
The rule count is not heading down. The companies that come through this well will not be the ones with the biggest governance committee. They will be the ones that can hear "show me" and answer the same day.
Download the Evidence Clock worksheet and time your own answer. It takes an afternoon, it gives you a number you can put in front of a board, and it is yours whether or not we ever work together.
[Publishing note: on the blog this should be a download button, not a "comment CLOCK" ask. The worksheet does not yet exist; see open items.]
