Article reader Listen + reading controls
Article reader
Preparing the reader…
Reading settings
Governance needs an evidence system¶
The new year has opened with a practical test for artificial intelligence governance. California's Transparency in Frontier Artificial Intelligence Act (TFAIA), enacted through Senate Bill 53 (SB 53), is now operative. It asks covered frontier developers for published frameworks, safety reporting, incident processes, and protections for employees who raise serious concerns.
The particulars apply to a defined group of companies. The lesson travels much further: a governance commitment is only as real as the evidence an organization can produce when somebody asks how the commitment works.
Policy becomes operational at the evidence boundary¶
Most organizations already have principles for artificial intelligence (AI). Fewer can trace a principle into a named owner, a recurring decision, an approval record, a test result, and a process for learning when something goes wrong.
That gap matters. A policy can say that systems will be evaluated before deployment. An evidence system answers harder questions: evaluated for what, under which conditions, by whom, against which threshold, with which exceptions, and how recently? It preserves enough context for a reviewer to reconstruct why the organization believed a decision was reasonable at the time.
The National Institute of Standards and Technology (NIST) makes this connection explicit in its AI Risk Management Framework. Governance, context mapping, measurement, and risk management are connected functions, not separate paperwork exercises. The framework is useful because it keeps evaluation attached to intended use and affected people.
Disclosure exposes the condition of internal knowledge¶
External transparency begins as an internal knowledge-management problem. A company cannot explain its risk framework clearly if teams use incompatible definitions. It cannot report an incident reliably if product, security, legal, and operations groups do not agree about what constitutes an incident or who must be told. It cannot protect an employee raising a concern if the concern disappears between reporting channels and decision forums.
The important artifacts are therefore not just reports. They include model and system inventories, evaluation plans, decision logs, risk acceptances, change records, incident narratives, and explicit links among them. Each artifact needs an owner and a reason to remain current.
This is where formal governance either connects to work or becomes theater. Meyer and Rowan's classic account of formal structure and organizational legitimacy warns that visible policies can become decoupled from daily practice. AI governance is especially susceptible because the documents are legible to leaders while the exceptions, workarounds, and uncertainty remain with practitioners.
Build for explainability at the organizational level¶
Organizations do not need to wait for a law to apply directly before improving their evidence. A practical beginning is to choose one consequential AI system and establish a trace from intent to operation:
- State the decision or workflow the system affects.
- Name the people accountable for product performance, risk, operations, and incident response.
- Record which evidence supports deployment and which uncertainties remain open.
- Define changes that trigger reevaluation.
- Give concerns and near misses a route into the same decision process.
- Test whether an informed outsider could reconstruct the argument without relying on private explanations from the original team.
That final test is revealing. If the system can be understood only by finding the right person, the organization has expertise but not yet durable organizational knowledge.
Transparency requirements are sometimes discussed as communications obligations. They are better understood as a demand for institutional memory. The organizations that respond well will not be those that become skilled at producing polished disclosures on deadline. They will be those whose everyday management system already preserves what was decided, what was observed, what remains uncertain, and who is responsible for acting next.
Sources and research trail¶
- California Legislature, Senate Bill 53: Transparency in Frontier Artificial Intelligence Act (2025).
- California Department of Justice, SB 53 guidance and reporting information.
- California Department of General Services, Generative AI training-data transparency requirements.
- National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (2023).
- Meyer and Rowan, “Institutionalized Organizations: Formal Structure as Myth and Ceremony” (1977).