Jon W. Hansen, FCIPS | Procurement Insights | Hansen Models™
Two AI governance graphics crossed my feed this week. Both are thorough. Both left me confused. Here is why, and what AI governance looks like in the real world.
This week, two AI governance graphics drew hundreds of reactions on LinkedIn. Vaibhav Aggarwal set out seven pillars of an AI governance framework. Matthew Coombs listed the governance documents every company needs, each mapped to the EU AI Act, ISO 42001 or NIST.
Both are thorough, and both are useful as checklists. But as I read them, I kept looking for something neither one shows: a decision.
The filing cabinet approach
Graphics by Vaibhav Aggarwal and Matthew Coombs, shared on LinkedIn.
Between them, the two graphics list dozens of policies, registers, inventories and regulatory mappings. Each one describes governance as designed: what should be written down, who should own it, and which standard it satisfies.
That is the filing cabinet approach. It answers the question “What should we have on file?”
What it cannot answer is what happens when an AI outcome falls short. Who can act? Can they act before the loss is final? What are the people involved actually rewarded for? And can anyone reconstruct the decision months later?
The cabinet also leaves out the strands that decide those answers: how people are measured, the workarounds no system records, and the AI tools nobody approved. In one 2026 survey, nearly two-thirds of senior decision-makers admitted to using AI tools their own organizations had not approved. No document in the cabinet lists them.
The operating system approach
How AI governance works in the real world. Illustrative.
Operational governance starts somewhere else: with the operation, as it actually runs.
When an AI outcome falls short, it traces back through the strands that produced it, including the hidden ones, and asks four questions where they cross:
Authority: Who can act?
Clock: Can they act before the loss is final?
Incentive: What does the rule reward?
Record: Can the decision be rebuilt later?
What actually happens then feeds the record, so the documents describe the operation as it runs, not as it was designed. And the outcome loops back two ways: the operation learns, and the rules are updated.
Not one or the other
The filing cabinet still matters. Regulators expect it, and auditors need it. But a filing cabinet is only as good as the operation it describes.
That is why AI governance has far less to do with AI than most people think. It is not a set of documents about the technology. It is an understanding of the strands the technology runs into, and the authority to act when they cross.
Start with one decision
Hansen’s Agentic Governance Readiness (AGR) Snapshot™ tests one decision against how your operation actually runs, in two weeks. It asks the four questions above, traces the strands behind them, and gives you a readiness reading: proceed, fix first, or stop.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
Sources and related reading
The two graphics: Vaibhav Aggarwal, “AI Governance Framework,” and Matthew Coombs, “The AI Governance Documents Every Company Needs,” both shared on LinkedIn, November 2026
TrustedTech and Censuswide, Shadow AI in the Workplace, March 2026 (2,001 UK and US employees), as reported by CSO Online
AI Governance: A Filing Cabinet or an Operating System?
Posted on November 10, 2026
0
Jon W. Hansen, FCIPS | Procurement Insights | Hansen Models™
Two AI governance graphics crossed my feed this week. Both are thorough. Both left me confused. Here is why, and what AI governance looks like in the real world.
This week, two AI governance graphics drew hundreds of reactions on LinkedIn. Vaibhav Aggarwal set out seven pillars of an AI governance framework. Matthew Coombs listed the governance documents every company needs, each mapped to the EU AI Act, ISO 42001 or NIST.
Both are thorough, and both are useful as checklists. But as I read them, I kept looking for something neither one shows: a decision.
The filing cabinet approach
Graphics by Vaibhav Aggarwal and Matthew Coombs, shared on LinkedIn.
Between them, the two graphics list dozens of policies, registers, inventories and regulatory mappings. Each one describes governance as designed: what should be written down, who should own it, and which standard it satisfies.
That is the filing cabinet approach. It answers the question “What should we have on file?”
What it cannot answer is what happens when an AI outcome falls short. Who can act? Can they act before the loss is final? What are the people involved actually rewarded for? And can anyone reconstruct the decision months later?
The cabinet also leaves out the strands that decide those answers: how people are measured, the workarounds no system records, and the AI tools nobody approved. In one 2026 survey, nearly two-thirds of senior decision-makers admitted to using AI tools their own organizations had not approved. No document in the cabinet lists them.
The operating system approach
How AI governance works in the real world. Illustrative.
Operational governance starts somewhere else: with the operation, as it actually runs.
When an AI outcome falls short, it traces back through the strands that produced it, including the hidden ones, and asks four questions where they cross:
What actually happens then feeds the record, so the documents describe the operation as it runs, not as it was designed. And the outcome loops back two ways: the operation learns, and the rules are updated.
Not one or the other
The filing cabinet still matters. Regulators expect it, and auditors need it. But a filing cabinet is only as good as the operation it describes.
That is why AI governance has far less to do with AI than most people think. It is not a set of documents about the technology. It is an understanding of the strands the technology runs into, and the authority to act when they cross.
Start with one decision
Hansen’s Agentic Governance Readiness (AGR) Snapshot™ tests one decision against how your operation actually runs, in two weeks. It asks the four questions above, traces the strands behind them, and gives you a readiness reading: proceed, fix first, or stop.
What strands are you missing? Contact us at HPT@hansenprocurement.com to review one decision.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
Sources and related reading
Share this:
Like this:
Related