An AI-First Framework for Responsible AI. Fear Was the Wrong Place to Start.

An AI-First framework for Responsible AI

Your current framework protects you from being sued. The AI-first version protects you from being replaced. Thirty brains instead of one, risk priced on both sides, and one first principle the fear framework forgot: do not go out of business while being responsible.

Stephen MesserCo-founder, Collective[i] & Intelligence.com. Co-founder, LinkShare (sold to Rakuten, $425M). EY Entrepreneur of the Year and 2x Deloitte Fast 50 Winner. Board Member, Spire Global (NYSE: SPIR). Subscribe.

Here is the trade off your responsible AI framework actually made and why almost everyone made the wrong call. AI risk priced like it could end the firm. The other risk priced like it does not exist. The first risk is the lawyer getting sued for recommending "unsafe" AI use. The second risk is your business losing to a competitor who moved faster. The second one is already happening to the companies that followed the first one's advice.

That is not a responsible AI framework. That is a liability waiver with a $400,000 consulting invoice attached.

I made the broader case in The Safest Move You Can Make With AI Will Cost You Everything that the responsible approach as currently written is a trap. This piece is the AI-first replacement. What follows treats business risk as the senior partner, legal risk as the junior one, and your competitors as the thing you were supposed to be governing against in the first place.

Your framework priced legal risk at infinity and business risk at zero. One of those is what actually ends companies.

Fear was the wrong starting point

Every responsible AI framework I have read in the last three years started in the same place. A list of risks. A list of controls. A list of things the model can never do. A list of things the vendor must promise. Nowhere was a column for what the business needed to do to stay competitive.

That is not an accident. That is the signature of a document written by someone whose job is to minimize their own liability, not yours.

The AI-first alternative starts somewhere different. The question is not "what could go wrong." The question is "what happens to our business if we move slower than the firms that figured out how to balance both." Risk gets priced on both sides. The downside of using AI is one line in the ledger. The downside of not using it is the other. If your framework has only the first column, you are not practicing responsible AI. You are practicing responsible bankruptcy.

Do not go out of business while being responsible.

Watch what the lawyers did, not what they billed you to create

The same lawyers who wrote your firm's responsible AI framework (the one that says do not let AI train on your data) were, that same quarter, feeding their own briefs into Harvey and letting Harvey train on them. About 80 percent of AmLaw 100 firms are running Harvey. Kirkland & Ellis committed $500 million over three to four years to build its own proprietary AI. Morgan & Morgan committed $1 billion over ten years to the MX2 platform. Latham & Watkins bought Nvidia GPU servers to run open-weight models on-premise with sensitive client data. $1.5 billion of committed law-firm AI spend while no public SaaS incumbent has committed comparable sums. I covered the full set of numbers in The Hypothesis Company.

They told you to follow a rule they knew would kill their own business. So they did not follow it. They billed you for the framework and went back to their office and did the opposite.

Harvey hit 80 percent of AmLaw 100 because the AmLaw partners figured out that the firm that waits dies. The death does not come from a malpractice case. It comes from a competitor firm using Harvey to produce the same brief in a tenth of the time at a fraction of the cost. Kirkland and Morgan and Latham did not spend $1.5 billion of partner compensation because the governance framework said it was safe. They spent it because the governance framework was the thing that was going to kill them if they listened to it.

Then they sold your firm the framework they rejected for themselves. The law firm had almost no downside from the first risk. Your firm has existential downside from the second. The writer kept the fee. The reader kept the risk nobody put a number on.

The firms that wrote your framework are running the tools the framework forbids. They sold you the framework they rejected.

The vendors ran the same play on top

The lawyers were not the only ones playing this deception game. The SaaS vendors did their own version. Alex Karp of Palantir went on CNBC's Squawk Box in July 2026 and told enterprises their alpha dies the moment their data touches a frontier model. He was selling Palantir's walled stack while his own engineers were using AI coding agents from the frontier labs to build it. The pitch piggy-backed on exactly what your lawyer told you. The pitch had the same flaw as your lawyer's framework. Both ignored the biggest risk, which is your competition in the market.

Here is the specific thing both arguments got wrong. Most of what you do in business deals with externalities, which are patterns that exist outside your own four walls. Ninety percent of your competitive questions are externality questions. What is the market paying for shipping. How are your competitors buying capacity. Where is the credit risk inside the economy. What is the demand pattern across your category. Telling you to answer those questions using only your own data is the same as telling you to run credit decisions using only your own accounts-receivable history instead of a credit bureau. The answer you get is wrong, late, and expensive. The firm that pools data with the bureau gets a better answer earlier at a fraction of the cost. The firm that keeps its data to itself finds out its customer is in trouble weeks after everyone else saw the pattern.

I made the full externality argument in Karp and Nadella Are Selling You a Wall. The short version is Karp was right about 10 percent of your data and dangerously wrong about the other 90. Your lawyer was running the same math.

This is the largest business-disruption risk since electricity. Electricity did not have a legal framework in 1900. It had a competitive one. The firms that figured out how to run factories on electric motors did not win a legal argument. They won a cost argument, a speed argument, and a scale argument. The firms that waited for the governance framework to settle were not around to see the second decade.

Three years from now, the companies that are not maximizing what AI can do to transform the business will not need to worry about legal risk. They just will not be around.

How an LLM actually works. The math nobody in the framework meeting has done.

Most of the "do not train on our data" rules in corporate frameworks were written by people who think the model stores your document and will spit it back out to the next person who asks, word for word. That is not how a language model works. It's not how any of the model companies AI works. The misconception is the single biggest source of bad policy in the current framework canon.

A large language model, like all other models, is a statistical next-token predictor. The model takes a sequence of tokens, which for an LLM are chunks of words, and outputs a probability distribution over the next token in the model's vocabulary of roughly 50,000 to 200,000 tokens. What you read on your screen is the model drawing from that distribution one token at a time, feeding each pick back into the sequence, and running the loop until the output ends. The model is not retrieving a stored answer. It is sampling from a probability curve it computed on the fly.

Training is where the curves get set. Modern frontier models are trained on one to thirty-two trillion tokens of text. DeepSeek V4 used 32 trillion. The training loop shows the model a sequence, asks it to predict the next token, measures the error, and nudges billions of internal weights by a tiny amount to reduce the error. Then it moves to the next sequence. The procedure runs for trillions of examples. The model does not store your document anywhere. It stores a smoothed statistical pattern across the whole corpus.

If you drop a 10,000-word client memo into a model trained on 15 trillion tokens, your memo represents roughly 0.00000007 percent of the signal. Even if the vendor trained on it directly, a specific sentence is almost never reproducible on the other side without the exact prompt that would elicit it. The exceptions are the rare documents repeated verbatim across many sources, which the model will reconstruct because the pattern is dense. Your routine memo is not that.

This mechanic is not unique to language models. Diffusion models train by sampling patterns from billions of images. Economic models like the one we run at Collective[i] train by learning the probability shape of commercial activity across millions of deals over time. Protein-folding models train by compressing the pattern across every known protein structure. In every case the model converts raw data into statistical signal. Your contribution is tiny. The aggregate is powerful. The fear that the model will spit your document back out is almost entirely wrong.

Google search has worked this way for twenty years. Your employees have typed proprietary company questions into Google since the day you got broadband. Google used those queries to improve the product for everyone. Nobody wrote a framework prohibiting it. Nobody formed a committee. The product kept getting better because every user's queries made it better. The trade was so obviously worth it that we stopped noticing we were making it. The AI version of that trade is the same trade with better returns.

The framework writer treated the model as a database. The model is a probability curve. You cannot write good policy from the wrong mental model.

The actual risks are four. Each has a different fix.

Training. Does the vendor's terms say your inputs can be used to train a future model. In the consumer tiers of ChatGPT and Claude, the default is often yes unless you opt out. In the enterprise tiers it is almost always no, with contract language and audit rights. The fix is paying for the right tier and verifying the setting. The fix is not banning the tool.

Retention. Does the vendor hold a copy of your prompts and outputs on its servers. Most do, for safety, abuse detection, and support. OpenAI was ordered by a federal court in 2025 to preserve all ChatGPT user chats regardless of the user's privacy preferences, as part of ongoing litigation. The retention risk is independent of the training risk. A tool that does not train on your data may still store your data.

Discovery. If your firm is in litigation, your prompts and outputs may be discoverable. A June 2026 Nassau County decision (Assini v. Recchio) quashed a subpoena to OpenAI for an opposing party's prompts on work-product grounds. A different case the same year found an expert witness's prompts fully discoverable because the prompts were part of the method. A prompt asking how to minimize or explain away conduct can be read as awareness that the conduct was a problem. Treat your prompts like email.

Third-party access. The vendor's employees. The vendor's contractors. The vendor's incident-response team. The subprocessors in the vendor's chain. Each one is a surface. The fix is contractual, not architectural.

A framework that collapses all four risks into "do not train on our data" is solving the wrong problem four times.

Tech comes in bottom up now. Your framework still pretends otherwise.

Governance frameworks assume governance is where the decision happens. The numbers from the last two years say the opposite.

Microsoft's 2024 Work Trend Index put the number plainly. Seventy-eight percent of AI users at work bring their own tools. Fifty-two percent use tools their employer did not provide. Over half say they would not disclose to their manager that AI helped them finish a task. Verizon's 2026 Data Breach Investigations Report measured unauthorized AI use tripling from 15 percent to 45 percent of employees in a single year. Salesforce's 2026 Workforce AI Survey found 67 percent of employees use AI tools at work and only 18 percent of organizations have formal AI security policies. Cyberhaven's data put the share of pastes containing sensitive information at 34.8 percent in 2025, up from 10.7 percent in 2023. IBM's 2025 Cost of a Data Breach report found that shadow AI incidents added $670,000 to average breach costs, and 97 percent of AI-breached organizations lacked basic AI access controls.

That is the enterprise AI adoption curve. ChatGPT launched November 2022. Microsoft 365 Copilot became generally available November 1, 2023, roughly eleven months later. The eleven-month gap was the window when the users made the decision for the company. By the time Copilot shipped, the sensitive data was already in the consumer tier and the governance framework existed to describe a condition that was no longer true.

Seventy-eight percent of your workforce brought their own AI anyway. The framework was never where the decision was being made.

The lesson for a framework writer is the one almost nobody wants to learn. A rule that your users will not follow is a rule that makes your organization less safe, not more. The data is in the breach ledger.

LLMs were the first brain. Thirty more are already here.

LLMs were the first brain companies adopted. They are limited. They make a lot of mistakes. They are overly confident when the answer is really bad. They are not what your AI policy should be written around. The policy needs to take all the AI brains into account, including the ones that will have greater impact on the business than the LLM ever did. The policy has to enshrine the trade-offs you care about in a form that scales across every brain that comes next.

Count what is already here. Language models for text. Diffusion models for image. Video generation. Music generation. Voice synthesis. Voice cloning. Speech recognition. Code models trained specifically for programming. Protein folding. Materials science discovery. Drug discovery. Weather and climate. Economic time-series. Financial trading. Fraud detection. Credit scoring. Recommendation ranking. Search relevance. Robotics foundation models. World models for spatial reasoning. Autonomous driving. Medical imaging. Pathology. Satellite imagery. Logistics optimization. Supply chain. Multi-modal reasoning. Mathematical proof. Game-playing agents. Each one is a specialized brain. Each one has its own failure modes, its own training-data provenance, its own vendors, and its own regulatory posture.

I argued in The AI Shuffle that most of your SaaS tools will be replaced by AI model companies, including the legacy SaaS tools that bolted "AI" onto their logo last quarter. That turned out to be an understatement, Fei-Fei Li's World Labs was acquired by AMD for $8.2 billion in September 2026, closing before year-end, with Li joining AMD as EVP and chief scientist. All the other AI models are in many cases already starting to surpass language models in the business impact they will create over the next decade. Isomorphic Labs is training protein folding out of DeepMind. Microsoft's MatterGen is training materials science. Physical Intelligence and Skild AI are training robotics. Runway on video. Suno on music. ElevenLabs on voice. Black Forest Labs on image. Collective[i] has demonstrated more impact on Economic outcomes for our clients than 30 years of SaaS and CRM and ML, a time-series model of B2B commerce on top of a live context graph changes everything about running a business.

Each brain carries its own trade-off question. Voice-cloning models force you to decide whether to tell a client that the voice on the call is an AI. Is it fraud if the AI sounds exactly like a person and the person listening does not know. Diffusion models force you to decide whether a product image generated from a competitor's style guide is marketing creativity or trademark infringement. Protein-folding models force you to decide whether to publish a discovery that could be used to design a therapy and also a toxin. None of those decisions is reachable from a framework written for language models. I covered the specific case of voice and emotion in When AI Learns to Feel.

Your framework governs one brain. Your competitors are coordinating thirty. The gap compounds every quarter.

Your company's framework will have an LLM section, a diffusion section, an economic-model section, a voice section, and sections for whatever brains come next. The principles stay. The controls change by class.

The AI-first org has more builders and a shorter chain of command

Something else about your framework will not survive. The org that implements AI-first looks nothing like the org that wrote the framework.

AI-first companies have flattened. Marketers are shipping code. Lawyers are running proprietary models against their own case files. Finance teams are building economic forecasts without touching the FP&A team. Engineers are coding at ten times prior throughput using Claude Code and Cursor. Operators are standing up customer-service agents inside a weekend. Sales teams are running predictive scoring and action-triggering off models their CRM vendor cannot touch. The old functional silos are not fences anymore. The person who used to open a ticket to IT and wait six weeks is now the person who shipped the thing in two days using an AI model their CIO has never heard of.

The chain of command is shorter and the number of builders is larger. Both at once. A framework written for the old org, where every AI decision goes through a committee that meets twice a month, is going to collide with the new org, where decisions get made inside the Cursor window at 11pm on a Thursday. The old framework slows the fast org to the speed of the committee. The result is that the framework gets ignored, or the people being slowed down leave for a competitor that does not have the framework.

A responsible AI framework for a flattened org has to accept the new chain of command and move the controls to where the decisions are. Permissions at the agent level, not the committee level. Guardrails inside the tool, not inside the approval process. Education for every user before every new model. Audit after the fact instead of approval before.

Recursive decision-making is the other thing you lose if the framework slows you down. AI-first companies compound. Every decision becomes an input to the next model, which produces the next decision, which trains the next model. The compounding happens inside the business and shows up as learning. The firm that moves fast gets a model that gets better fast. The firm that moves slowly through a framework gets a model that stays dumb. Over 18 months the gap between the two firms is the kind of gap that produces an acquisition announcement.

Fear is a plan to survive one quarter. AI-first is a plan to compound for the next decade. Only one of them makes money.

Common law, not French civil code. Business leaders, not lawyers, interpreting it.

Common law and civil law are two different ways of running a legal system, and they can be instructive to how you rebuild your responsible ai framework. Common law, which the US and UK use, lays out a framework, judges then interpret it in context. The framework updates and adjusts as more and more cases get decided. Civil law, which France and much of Europe use, writes out specific rules. If this happens, then that follows. The framework is heuristic. It does not interpret, it does not evolve. It executes.

Current responsible AI frameworks operate like French civil code. Specific prohibitions. Specific controls. Specific thresholds. Specific vendor restrictions. The problem is that AI is moving faster than any civil code can be rewritten. Write "no agent may have write access to a production database" into your doc today and you will be rewriting that rule inside a quarter. Multiple times. The code gets stale faster than the committee can revise it.

The common-law alternative writes down the principle and the decision rights. The principle is the thing being protected. The decision right is who gets to say yes or no in a specific case. Judgment does the work. Decisions update as the market changes. The doc does not have to be rewritten every time the market moves.

The question of who holds the decision rights is the one most frameworks get wrong. Common law in the US works because the people interpreting the framework are generalist judges with broad authority. A common-law AI framework works when the people interpreting it are business leaders with authority to balance both sides of the risk. Not the lawyer whose job is to minimize one side. Not the risk manager whose job is to flag the downside. And definitely not the middle manager whose job is at risk from the thing the agent is going to do better than they do. Those three people will optimize the framework to protect themselves, and the result will be a framework that protects everyone except the business.

History tells us why. English common law has handled industrial revolution, electricity, telephony, aviation, antitrust, internet, and now AI without being rewritten from scratch. Civil codes have been rewritten every two to three decades to keep up. The pace of AI is faster than either. Common law adjusts case by case. Civil code gets replaced. Pick the one that adjusts.

The EU AI Act is already discovering what a civil-code approach to AI costs. The jurisdictions that pick common law are going to run laps around it.

Do no harm. The first principle of a framework that functions.

The first principle of a practical responsible AI framework is "Do no harm".

The hard stop is the law. Anything that would violate the laws and regulations of the places you operate in is off the table. No framework debate required. Those stops are already written in every jurisdiction you touch, and they get updated by legislatures and regulators without your framework needing to track them.

Inside the hard stop, the goal of AI is twofold. Reduce cost. Create new advantages. Both for you. Both for your clients. The brains you use open ways to deliver goods and services your company could not deliver a year ago. The responsible framework lets you take those openings while making sure you do not harm the people on either side of your business.

Harm has to be specific. Harm is a person losing a loan they should have gotten because the model inherited a bias from its training set. Harm is a candidate getting rejected on the same bias. Harm is a patient getting bad advice from a tool that was never cleared for medical use. Harm is a customer getting a product that does not do what it was sold to do. The framework names the specific harms your business could cause and builds controls for those. The framework does not build controls for every imagined harm somebody wrote about in a vendor whitepaper.

Trade-offs, not prohibitions

Data policies are not one size fits all. The trade-off argument matters most when the thing you are trying to learn about is an externality, which is almost everything that matters to a business.

Take logistics. If your goal is to study shipping pricing, the model has to learn from other companies that ship. The data has to pool across buyers for a pattern to appear. The only way to find the optimal time to ship or the optimal way to buy capacity is to train on the shipping behavior of many companies, not just yours. Your own history will show you how you bought shipping. It will never show you what the market knows.

If shipping margins matter to your competitiveness, and in a manufacturing business they usually do, the choice is a model that learns from everyone or a disadvantage against every competitor whose model does. The share-nothing position puts the whole organization at risk of failing. The share-contributed-data position puts your raw inputs at risk if the control is weak. One of those is a repairable control problem. The other is a structural competitive problem.

Neural nets are black boxes by design. The protection you should want is on the raw inputs and on making sure no insight the model produces can be attributed back to your firm or your clients. That is a very different control architecture from "do not share the data." It is also the architecture regulated finance has been running for a hundred years through D&B, Experian, and every other credit bureau.

When to say no. When the value of the trade does not outweigh the improvement you would get. Say no when the partner cannot protect the raw data. Say no when the training set would make one of your clients identifiable in the output. Say no when a specific regulatory regime makes the training itself the liability. Say no when the data is the thing that makes you different and the model learning from it would hand that difference to every competitor at once. The default "no training on our data" line in every framework collapses all of these into a single rule that misses the actual trade behind each one.

Opt in, opt out, explain the trade. A responsible framework treats clients and employees like adults. It puts the trade in front of them. The user who wants the better product opts in. The user who does not opts out. Incremental opt-ins work better than one all-or-nothing choice. People will opt in to the feature that solves the problem they have today. Over time they opt into more as the features earn trust.

Hiring, firing, and the German works council. The biggest fear for employees is loss of employment to AI. A responsible framework addresses it directly. German works councils have been open to AI HR tools in many cases. The assurance they want is specific: the AI model will not be the thing that fires an employee. The decision stays human. The augmentation sits in the preparation, the draft, the pattern recognition, the summary. The decision that ends someone's livelihood is not probabilistic. Every union, every works council, and every regulator looking at AI in HR will ask the same question. The framework that answers it directly, in writing, with specific controls, is the one that gets adopted. The one that leaves it ambiguous gets rejected or routed around.

Human in the loop. Human on the loop.

A good framework defines when a human has to approve and when a human has to monitor.

Human in the loop means a human approves every action before the AI proceeds. Human on the loop means the AI acts autonomously and the human steps in to handle exceptions. The first is a traffic cop at every intersection. The second is a monitor watching the whole highway for the crash about to happen.

A good policy sets approval stages for when the model moves from one to the other. The first few weeks of a new agent, human in the loop. Once the error rate on the specific task drops below a defined threshold and the human-monitored sample stays clean, move to human on the loop. The framework defines the thresholds, the monitoring, and the triggers that pull the agent back if the error rate rises again.

The framework also defines what decisions in the organization never run on an agent alone. A pricing recommendation can run on an agent. A regulated credit decision has to carry an explanation a human can defend. A medical diagnosis has to pass through a licensed clinician. A hiring or firing decision stays with the manager. These are the lines where no amount of monitoring moves the agent to autonomous.

The question is not whether to put a human in the loop. The question is which humans at which decisions. Everything else slows the business.

Focus on Agents, they are coming fast.

Agent spending authority is a counterparty problem, not a dollar cap. Current frameworks address agent spending with a transaction dollar cap. "No agent may authorize more than $500 per transaction." The dollar cap is the wrong primitive. An agent authorized to spend $500 at AWS is not the same as an agent authorized to spend $500 at a vendor the agent found on its own last Tuesday. The counterparty is the risk, not the dollar amount. The practical framework uses counterparty whitelists. The agent transacts with the vendors on an approved list up to defined limits without further approval. Any new counterparty requires human sign-off before the first dollar moves.

The agent gets a lot smarter about the "new counterparty" question when it has a network signal to read. If your firm has a connector graph that tells the agent which counterparties your network knows, trusts, and already does business with, the whitelist becomes dynamic. The agent sees that the new vendor has active relationships with five firms your partners work with, that your CFO has met the vendor's CEO three times, and that your network has transacted $14 million with the vendor in the last two years. That is how we wire the connector graph into every agent that runs on Intelligence.com. The agent is not making a cold judgment on a stranger. The agent is reading the same network signal your human staff would use to make the same call.

The second primitive is action class. An agent that can issue refunds to existing customers is different from an agent that can sign a new contract. An agent that can book travel is different from an agent that can wire money. Many classes have no dollar threshold at all. "Agent may issue public statements on behalf of the company" is a class that needs human approval regardless of cost. The third primitive is rate limits. An agent processing five refunds a day should not process fifty in an hour without a human looking at the trigger.

Agents can also be used to analyze and pre approve different ai models based on risk/reward. Having a policy is one thing, speeding up the process that allows your teams to move to AI first does not require teams reviewing tools anymore. Based on use cases the risk rewards of your policy can be reviewed by an agent and if on the line by human in the loop. Think speed, when you think AI First.

After Air Canada, disclosure is table stakes. The Telephone Consumer Protection Act requires a recorded call to disclose it is being recorded. AI agents are headed for the same regulatory landing. Air Canada found out in February 2024. The airline's chatbot invented a bereavement-fare policy. A grieving customer bought a ticket on the strength of the invented policy. Air Canada refused to honor it. The British Columbia Civil Resolution Tribunal in Moffatt v. Air Canada ordered the airline to pay. Air Canada argued the chatbot was a separate legal entity. The tribunal rejected that argument in one paragraph. The chatbot was the company. The practical framework writes four requirements into every outbound agent at build time. First-contact disclosure that the counterparty is talking to an agent on behalf of your firm. A statement that the agent can make mistakes and any important decision should route to a human. A visible path to a human on request, with the response time stated. A logged record of each disclosure having been delivered.

A dollar cap is the wrong primitive. The counterparty is the risk. The disclosure is the trust tool. The eval harness is the only thing that catches drift. These four are where current frameworks age the worst.

Focus on Driver's ed

Every state in the US requires a new driver to take driver's ed. The point is that a car behaves in specific ways in a specific operator's hands. The operator who does not know the behavior is the one who crashes.

Models are the same.

A user who has not been taught about a language model does not know it has no sense of time. Does not know it will confidently repeat something it read on five sites that got it wrong. Does not know the court case it cited does not exist. Does not know to run the output past a second model to catch the first one's errors. Does not know to ask the model to argue the other side of a position before accepting the first.

Deloitte Australia learned this the public way in 2025. The firm delivered a $440,000 government assurance review to Australia's Department of Employment and Workplace Relations. Sydney University's Chris Rudge, reading the report after publication, noticed citations to multiple papers and publications that did not exist. A fabricated judicial quote attributed to Federal Justice Jennifer Davies, whose name Deloitte had also misspelled, was in the body of the report. The firm had used Azure OpenAI GPT-4o as part of the drafting pipeline. Deloitte refunded the final installment.

Deloitte did not get here because the model is unusable. Deloitte got here because the operators did not know the model confidently hallucinates citations and nobody in the chain was checking.

Teach users to test. Teach them to confirm claims. Teach them to use two models against each other to find flaws neither one would catch alone. Teach them that a model is confident whether or not it is right, and confidence is not a reason to skip the check.

The next layer is what happens when brains get strung together. One model's small confident error becomes an input into a second model that treats it as truth. The second model's output becomes an input to a third. The errors compound. The user who understands that each brain has edges and that chaining those brains magnifies the edges is the user who catches the compound failure before it ships. The user who thinks of the chain as one AI that just works is the one explaining to the regulator why the output was wrong at every step and nobody noticed.

Driver's ed happens for every new model. Every new agent. Every new permission the model gets granted. Before use, not after

If you write the framework. If you sign it. If you have to live inside it.

If you write the framework. Start with the business goals. Write risks against those goals. Write principles against those risks. Write decision rights against those principles. Build the four-risks taxonomy into the data section. Build the model-class breakdown into the controls section. Build the eval harness into the drift section. Build the counterparty whitelist into the agent-authority section. Build the disclosure requirement into every outbound agent. Define where humans stay in the loop, where they move on to the loop, and where no agent ever runs alone. Make the whole thing a common-law framework with decision rights, not a civil-code rulebook. Then push it through three audiences before publication: the lawyer who will defend it, the operator who will implement it, and the salesperson who will have to use it to close deals. If the salesperson says the framework will cost deals, you have not written a responsible AI framework. You have written a competitive disarmament treaty.

If you sign it. Ask whether the people who wrote it have used the tools they are governing. If the answer is no, send it back. Ask whether the framework addresses the four risks separately. If it collapses them, send it back. Ask whether the framework distinguishes between model classes. If it treats everything as an LLM, send it back. Ask what the eval harness looks like. If there isn't one, send it back. Ask how the framework handles vendor deprecation. If the answer is "we'll revisit it then," send it back. The framework that comes back from the third round is the one that will survive six months of use. Everything before that is theater.

If you have to live inside it. The honest answer is that the version your firm has today is probably not the one that will let you compete. Use the tier you are allowed to use. Pay for the enterprise setting. Opt out of training where that is the trade. Keep your prompts work-product clean. Document the chain when you use a model for a client deliverable. Run the output past a second model. Confirm the citations. Catch the compound errors before they ship. The driver's ed is on you until the framework catches up.

Do not go out of business while being responsible

The last three years taught me that most of the frameworks written to protect the firm have, in practice, protected the firm from competing. The lawyers who wrote them are running Harvey. The CTOs who signed them watched 78 percent of their workforce bring their own AI anyway. The companies that followed them are losing to the companies that did not.

Your lawyers are already using Harvey. Your engineers are already using Cursor. Your sales team is already running analysis in Collective[i]. Your competitors are already coordinating thirty brains while you are governing one. The framework that pretends otherwise is the thing holding you back.

Three years from now, the firms that updated their frameworks around trade-offs, model classes, four-risk taxonomy, eval harnesses, counterparty whitelists, and disclosure will be the ones with margin. The firms that kept the civil code will be the ones on the auction block, up for sale at a discount because the firm that could not move is worth less than the parts.

Do not go out of business while being responsible. That is the first principle. Everything else is implementation.