By Dr. Freddie Seba © 2026 Freddie Seba. All rights reserved.
A reintroduction to the series — and an invitation to follow what comes next.
Four frameworks examined. Anthropic. OpenAI. Google Gemini. NIST CAISI. Four different organizations. Four different mandates. Four different governance architectures.
This week we examine NIST CAISI — the fourth installment in the series.
One finding that does not change.
The governance gap always lands at the same address: the institution.
Not the vendor. Not the federal agency. Not the standards body. The institution that deployed the system, embedded it into clinical workflows, student services, financial operations, or public-facing decisions — and assumed someone else had governed the consequences.
That assumption is the gap this series was built to name.
What this series is — and is not.
Ungoverned: Applied Frameworks Under the Lens is a recurring miniseries within the Ungoverned ecosystem — distinct from the Monday newsletter and from the book Ungoverned. Same rigor. Different lens.
Each installment applies the AI Minimum Viable Governance (AI-MVG) framework and the Seba 12 Ps of Responsible AI to one organization shaping AI governance globally — an ongoing series, with new frameworks added as the landscape evolves.
This is not a critique. Every framework examined is taken seriously on its own terms. The question is never whether the framework is good at what it does. The question is what it was designed to govern — and what it structurally or deliberately leaves outside its scope.
Three questions. Every installment. Without exception.
- What was the framework designed to govern?
- The Governance Gap — what falls outside the frame?
- What governance must institutions build before deployment?
What we have covered — and what each installment found
Installment 1 — Anthropic
Anthropic’s framework governs model safety, privacy, and responsible deployment at the platform level — including a revised privacy policy effective July 8, 2026, that introduced biometric identity verification provisions for consumer users.
The governance gap: institutional deployment. Anthropic can revise its consumer privacy policy, introduce identity verification, or update its terms. Those decisions belong to Anthropic. But once a hospital, university, or agency has embedded Claude into everyday workflows, those changes carry operational consequences far beyond the vendor. Who evaluates that impact? Who determines whether the institution should continue using the system? Who owns the resulting risk? Anthropic cannot answer those questions. Only the institution can.
The 12 Ps lens: Policy.
Installment 2 — OpenAI
OpenAI governs one of the most widely deployed AI platforms on the planet. Its usage policies, safety systems, and enterprise agreements represent a serious attempt to govern responsible deployment at scale.
The governance gap: the people inside your institution who are making decisions with or about AI — and who owns accountability for those decisions when something goes wrong. OpenAI’s framework assigns accountability to OpenAI. The institution must assign institutional accountability.
The 12 Ps lens: People.
Installment 3 — Google Gemini
Google’s responsible AI framework spans seven governance pillars — research, policies, testing, mitigation, launch review, monitoring, and governance forums including an AGI Futures Council. Gemini 3 underwent more safety evaluations than any previous Google model, with over 350 red-team exercises across text, audio, images, video, and agentic AI.
The governance gap emerged not from the framework itself, but from the Terms of Service beneath it. The current consumer Terms of Service state: “If you don’t agree to the new terms, you should remove your content and stop using the services. You can also end your relationship with us at any time, without penalty, by closing your Google Account.” For institutions that have made AI infrastructure, departure is not a decision. It is a disruption. And even enterprise contracts contain a provision worth noting: pre-GA offerings — including certain Gemini features — may be changed, suspended, or discontinued at any time without prior notice.
The 12 Ps lens: Policy.
Installment 4 — NIST CAISI
This week’s edition.
CAISI — the Center for AI Standards and Innovation — was established in June 2025 when the Trump administration restructured the U.S. AI Safety Institute within NIST. Its mandate: to serve as the industry’s primary point of contact within the U.S. government for testing and collaborative research to harness and secure commercial AI systems.
Its work is substantive. CAISI has completed more than 40 model evaluations, including assessments of systems never publicly released. It has signed pre-deployment testing agreements with five major AI labs. In February 2026, it launched the AI Agent Standards Initiative — the first U.S. government program dedicated explicitly to interoperability and security standards for agentic AI.
And yet three facts sit alongside that record that every institutional leader should know.
Its authority is currently voluntary — bipartisan legislation to formalize it in statute has been introduced in both chambers and is pending. Its budget is approximately one-tenth of the UK’s equivalent body. CAISI’s own red-team research found that novel attack strategies against AI agents achieved an 81% success rate compared to 11% against baseline defenses. That finding was published in January 2025. The standards designed to address it are still being drafted. The institutions deploying those agents are not waiting.
The governance gap: CAISI can evaluate a model, publish a standard, and convene industry partners. It cannot govern your institution’s deployment decisions, your change management process, or your continuity plan if its guidance is superseded. Only the institution can.
The 12 Ps lens: Predictability.
The pattern across all four
Vendor governance governs the platform. Federal governance governs the standard. Institutional governance governs the consequences. One governs the model. Another governs the benchmark. Only the institution governs the decision.
That is not a gap in any single framework. It is a structural feature of how AI governance is currently built — globally. And it is the foundation of AI Minimum Viable Governance.
What comes next
This series will examine frameworks from healthcare, higher education, financial services, and governments across Europe, Asia-Pacific, Latin America, South Asia, and beyond. Every installment applies the same three questions. Every 12 Ps lens highlights a different dimension of institutional governance readiness.
Coming editions include @AMIA, @CHAI, @EDUCAUSE, the EU AI Act, ISO/IEC 42001, UNESCO, Singapore’s Agentic AI Framework, Brazil, India, China, and a closing synthesis edition that maps what the frameworks — collectively — leave ungoverned.
Series roadmap — an ongoing series, new frameworks added as the landscape evolves
1. Anthropic AI Lab U.S. ✓ Published
2. OpenAI AI Lab U.S. ✓ Published
3. Google Gemini AI Lab U.S. ✓ Published
4. NIST CAISI Government U.S. ✓ Published
5. AMIA Healthcare U.S. Coming
6. CHAI Healthcare U.S. Coming
7. EDUCAUSE / Dept. of Education Higher Ed U.S. Coming
8. FSOC / Federal Reserve SR 26-2 Financial Services U.S. Coming
9. EU AI Act Regulatory Europe Coming
10. UK AI Governance Regulatory UK Coming
11. ISO/IEC 42001 Standards Global Coming
12. UNESCO Ethics Recommendation Multilateral Global Coming
13. Singapore Agentic AI Framework Regulatory Asia-Pacific Coming
14. Brazil LGPD + AI Bill Regulatory Latin America Coming
15. Mexico / LMIC Focus Emerging Latin America Coming
16. India NITI Aayog Government South Asia Coming
17. China AI Safety Governance 2.0 Regulatory China Coming
18. Series Synthesis All tiers Global Coming
About the Author
Dr. Freddie Seba helps boards, trustees, and executive leadership teams build practical AI governance before AI failures make governance unavoidable. Scholar-operator, Silicon Valley founder, and global executive — EdD, USF · MBA, Yale · MA, Stanford.
Ungoverned: Applied Frameworks Under the Lens is part of the Ungoverned ecosystem — distinct from the Monday Ungoverned newsletter and the book Ungoverned. Drafted with AI-assisted tools. Final editorial judgment and responsibility remain with the author.
#AIGovernance #ResponsibleAI #AIMVG #AILeadership #Ungoverned #EnterpriseAI #BoardGovernance #AIPolicy #AIRisk #CIO
Sources
Anthropic Privacy Policy (current) — anthropic.com/legal/privacy
Anthropic Privacy Center — privacy.anthropic.com
Anthropic Consumer Terms update (effective July 8, 2026) — anthropic.com/news/updates-to-our-consumer-terms
OpenAI Usage Policies — openai.com/policies/usage-policies
OpenAI Terms of Use — openai.com/policies/row-terms-of-use
OpenAI Terms & Policies hub — openai.com/policies
Google Terms of Service, consumer (updating July 30, 2026) — policies.google.com/terms
Google Workspace Enterprise Terms — workspace.google.com/terms/premier_terms
Google Cloud Platform Terms — cloud.google.com/terms
Google 2026 Responsible AI Progress Report — ai.google/responsibility
NIST CAISI — nist.gov/caisi
NIST AI Agent Standards Initiative — nist.gov/artificial-intelligence/ai-agent-standards-initiative
FAS Report: A National Center for Advanced AI Reliability and Security (April 2026) — fas.org
Drafted with AI-assisted tools. Final editorial judgment and responsibility remain with the author.
Leave a Reply