One control, four regulators: why regulated firms are paying four times for the same compliance
Take one control. Just one: decision provenance, the ability to reconstruct how a consequential AI output was produced.
Walk it through four rooms.
In a bank, model risk calls it model documentation and validation evidence, tied to an inventory record with an owner and a review date.
In a hospital, it lives near clinical decision support governance: which version of which model informed which patient encounter?
At a utility or pipeline operator, it sits inside operational technology change control: what did the system do during the event window?
Under the EU's rules for high-risk AI systems, it looks like technical documentation and record-keeping.
Four rooms. Four vocabularies. Four evidence packages. One control.
In most regulated institutions I talk to, those four packages come from four different teams, four different extracts, four different schedules. Nobody planned it. It happened the way most architecture happens: one regime at a time, each urgent, each handled by whoever was closest.
That is the duplication bill, and almost nobody has it on a line item.
Position A: the differences are where enforcement lives
Here is the strongest case against everything I just said, and it deserves to be taken seriously. The people making it have usually sat through an exam.
Your examiner does not care about your abstraction layer. Enforcement does not happen at the level of "we have a provenance capability." It happens at the level of this threshold, this retention period, this disclosure format, this definition of a consequential decision. Those specifics are not cosmetic. They are the regulation. A generic control core is the kind of tidy abstraction that collapses the first time someone asks a specific question with a specific answer in mind.
And the regulators are not standing still. FDA authorizations of AI-enabled medical devices grew from 6 to 223 over roughly a decade (Stanford HAI, AI Index Report 2025). That is not dabbling. That is a regulator that has industrialized its own evaluation process. The referee scaled.
Position A is right about the context. It is wrong about the conclusion.
Position B: four stacks is four stacks you cannot maintain
Because what Position A never prices is what happens after go-live.
Four implementations of one control are four things to patch when the data model changes, four sets of logic to re-test when you swap a model, four evidence pipelines each rotting at its own rate. Unmaintained controls do not fail loudly. They fail the way a stale registry fails: still there, still producing output, no longer true.
And the cost surfaces where compliance never looks. Duplication lands as infrastructure: parallel storage, pipelines, jobs, environments. 21% of generative AI initiatives fail due to compute costs (IBM Institute for Business Value, The CEO's Guide to Generative AI: The Cost of Compute, 2024). One in five. Not deprioritized. Killed by a number.
It shows in readiness, too. Fewer than 1 in 4 banks consider themselves ready to deploy AI at scale (Boston Consulting Group, 2025), in the industry with the deepest governance bench on earth. Institutions that have done model risk management for decades do not lack rigor. They lack an architecture that lets rigor be reused.
The synthesis: one record, many renderings
Both positions describe the same system from different ends. The resolution is not a compromise. It is a separation of concerns most compliance programs never make.
Build the substance once. Render the evidence many ways.
The control substance (inventory, data lineage, decision provenance, human oversight, incident response, auditability) is genuinely shared. Build it once, enforced in the system, captured when the work happens rather than reconstructed afterward.
The divergence (thresholds, timelines, retention, disclosure formats, what counts as consequential, who gets notified how fast) is real, material, and exactly what Position A defends. But it is a rendering problem, not a second system.
That reframe changes what your scarce people do. Model risk specialists and regulatory counsel stop supervising four rebuilds of the same logging and start working the actual deltas. Compliance sprawl is an architecture decision, not a legal one. It just gets made by default, and early.
Retrofitting later is expensive not because of a multiplier anyone can defend, but because of what it involves: finished systems waiting on approval, engineers hand-assembling audit evidence from logs never designed to answer the question, per-regime scripts that break on the next upstream change.
What this means: three things to run this quarter
1. The duplication count. Pick one control. Decision provenance is sharpest. Count how many separate implementations exist across your business lines, regions, and regimes. Not policies. Implementations. Whatever the number is above one is your duplication bill.
2. The single-record, many-renderings test. Can you produce that control's evidence in each regulator's format from one underlying record, without a person re-assembling it? If the second format needs a person, a spreadsheet, and a week, you do not have a control. You have four projects sharing a name.
3. The divergence inventory. List every place your regimes genuinely differ on that control: threshold, timeline, retention, format, notification path. It is shorter than people expect, and it is where your specialists belong. Everything not on it is engineering, and engineering should be done once.
Where this already works, and the objection you are forming
I have spent years leading production platforms in environments where this question was settled long ago, because there was no version of the job where you rebuild the same evidence four times. Evidence was captured at the moment the work happened, once, and rendered for whoever asked.
I know the objection, because it is the right one: a bank exam is not that environment, and a clinical audit is not either. True, and it matters.
What transfers is not the rigidity. It is the discipline of capturing evidence at the source, so when someone asks a question you did not anticipate, in a format you did not design for, the answer is already in the record. Not the same rigidity. The same honesty about what production requires.
And to be precise: a well-built architecture gets you to compliance with the controls your regimes require. It does not grant an exam outcome, a certification, or a conformity assessment. Those remain yours to pursue and own.
The CFO perspective
This is a balance-sheet argument, not a virtue argument.
Today each new regime is funded as a project: its own scope, build, run-rate, and people. Compliance cost grows with the number of regimes you are exposed to, and with state AI laws moving from 49 to 131 in a year (Stanford HAI, AI Index Report 2025), that curve has no ceiling anyone can name.
Build-once, render-many changes its shape. The core is built once; each new regime becomes a marginal configuration cost, and the parallel infrastructure driving the compute bill stops multiplying. The CFO question is not "are we compliant." It is "what is our cost per additional regime, and is it flat or rising?" Most finance teams have never been asked to produce that number. It is knowable, and it is the most useful one in this conversation.
The one-page version. I mapped the six controls across financial services, healthcare, and critical-infrastructure regimes: what each is actually asking for, and the short list of places they genuinely diverge. Comment CROSSWALK on the LinkedIn version of this post, or reply to the Friday note, and I will send it.
The close
The regulators industrialized. Going from 6 to 223 AI-enabled device authorizations (Stanford HAI, AI Index Report 2025) is what an institution looks like when it decides to scale. The regulated institutions largely did not. They added workstreams.
The rulebooks will keep coming, and the data is getting harder to work with: the share of training-accessible web data newly restricted rose from 5 to 7% to 20 to 33% in a year (Stanford HAI, AI Index Report 2025). Provenance questions are getting sharper, not softer.
You can meet that by adding a workstream each time. Or you can build the substance once and treat the rest as a translation layer, not a second system.
The firms that get this right will not be the ones with the most compliance headcount. They will be the ones whose cost per additional regime is close to flat.
