Ungoverned | Between the Issues: Three Signals, One Structure

When everyone assumes someone else did the governance

Applying the AI Minimum Viable Governance (AI-MVG) framework and the Seba 12 Ps of Responsible AI. Governance as Leadership.

This Signal in 60 Seconds

The thesis: Three unrelated headlines this week share one failure structure — someone assumed someone else did the governance.

Signal 1: An open-weight model leads the field in safety — but the score reflects the base checkpoint, and it’s built to be fine-tuned into something else.

Signal 2: Insurers’ exposure to AI-agent risk sits largely unpriced, hidden as “silent coverage” inside existing policies.

Signal 3: Frontier AI is entering public institutions through donation rather than procurement—routing around the review procurement normally forces.

The board move: Three questions, one per signal, below. Governance as Leadership means asking them before the tool arrives.

Two numbers, one report, published this week. Only one in five organizations reports a mature governance model for autonomous AI agents. Yet nearly half of Lloyd’s underwriters believe their policyholders manage AI risk adequately. Both figures sit inside the same study. They cannot both be true.

That contradiction is not a statistical curiosity. It is the shape of an entire governance failure mode—the belief that accountability has been handled somewhere else, by someone else. This past week, that same structure surfaced three times, in three unrelated sectors. Naming it is the point of this note.

Signal 1: The model you evaluate is not the model you deploy

Thinking Machines released Inkling, an open-weights model built explicitly for fine-tuning. On the FORTRESS adversarial safety benchmark, it leads the open-weights field, refusing more harmful requests without over-refusing benign look-alikes. Impressive — and precisely where the governance trap opens.

Those safety numbers describe a checkpoint. The whole design purpose of the model is to be changed: fine-tuned on your data, for your use case, on someone’s platform. And the lab itself is candid that it is still studying how fine-tuning affects a model’s safety behavior. So the safety profile your risk committee reviewed and the safety profile you actually run may diverge the moment your team touches the weights.

Governance reading—P for Performance, P for Proof. A vendor’s benchmark is a snapshot of the base model, not a warranty on your fine-tuned instance. Under AI-MVG, the evaluation is not a one-time gate at procurement; it is a cadence obligation that re-fires every time the artifact materially changes.

Board question: When a model is fine-tuned or updated, who re-runs the evaluation — and against what threshold?

Signal 2: Your AI risk may already be on someone else’s balance sheet

A multi-institution report — contributors from Stanford, RAND, Aon, Moody’s, and Lloyd’s market underwriters — examined how the emerging agent economy will be insured. Its central finding: insurers’ exposure to AI-agent risk is currently largely unpriced, buried as “silent coverage” within existing cyber and liability lines. Unpriced. Invisible. Carried without being named.

The report’s own trajectory is sobering: it argues that AI-agent insurability is trending in the wrong direction, as capability outpaces reliability, and concentration among a few foundation-model providers threatens correlated losses. Translated for a board: the coverage you assume protects you may not have been written for the risk you now carry — and no one has told your insurer what your agents actually do.

Governance reading — P for Portfolio, P for Protection. Risk you have not named is risk you cannot price, transfer, or defend. The gap here is not a coverage gap; it is a governance gap wearing a coverage gap’s clothes.

Board question: Does your insurer know what your agents do? Do you?

Signal 3: When the tool arrives as a gift, which committee reviews it?

The Coalition for Health AI (CHAI) launched PULSE (Public health Use case and Learning Scaling Engine), offering public health agencies donated enterprise licenses—up to 2,000 seats from OpenAI and Anthropic—to pilot generative AI, with Accenture managing onboarding. The design is serious: the scaling engine is in the name, and the deliverable is a set of reusable playbooks that other jurisdictions can adopt.

Which is exactly why the structure deserves naming. Frontier AI is entering public institutions through donations rather than procurement—because donations are the only available path. And procurement, for all its friction, is where governance normally lives: the review, the risk assessment, the named owner, the exit terms—a gift routes around all of it. There is no vendor questionnaire for a thing you didn’t buy.

Governance reading—P for Procurement, P for Permanence. A donated tool still needs an owner, a review, and an off-ramp. The absence of a purchase order is not the absence of a governance obligation.

Board question: When a tool arrives as a gift rather than a purchase, which committee reviews it—and who owns it when the donation ends?

The thread that travels furthest: from pilotitis to AI-itis

That third question reaches beyond any single agency. In low- and middle-income countries, donated technology is often the only technology—and when the donation lapses, the pilot dies with it. Global health has a name for this decades-old pattern: pilotitis—the graveyard of well-funded pilots that never reached scale or sustainability.

What’s new is the nature of the donated thing. It reasons. It updates. It acts. A traditional donated system remained within the pilot’s boundary, awaiting evaluation. A frontier model does not wait—it changes during evaluation and acts beyond the scope the pilot defined.

With colleagues in the AMIA Global Health Informatics Working Group, I’ve been calling this successor condition “AI-itis“—”pilotitis” for systems that don’t hold still. (Paper in progress.)

A note on the coinage, still being settled: “It doesn’t wait inside the pilot’s boundary to be evaluated” is the diffusion reading — the tool escapes the pilot’s scope. Two adjacent readings are worth distinguishing, because they imply different governance controls: dependency—the institution builds on donated licenses that later lapse (classic pilotitis, now with deeper lock-in); and drift—the model you piloted is deprecated or updated mid-study, so your findings describe a system that no longer exists. Each points to a different remedy: diffusion needs scope control, dependency needs exit terms, drift needs version governance.

One structure, three sectors

Open-weights safety. Silent insurance. Donated frontier tools. Three unrelated headlines, one shared architecture of failure: someone assumed someone else did the governance. The insurer assumed the policyholder. The policyholder assumed the vendor. The agency assumed the donor. The evaluation assumed the model would hold still.

Governance as Leadership means refusing that assumption—building the named owner, the review cadence, and the exit terms before the tool arrives, not after the incident.

Questions for Your Next Board Meeting

1. Evaluation cadence. When a model is fine-tuned or updated, who re-runs the evaluation—and against what threshold?

2. Insured exposure. Does your insurer know what your agents do? Do you?

3. Donated tools. When a tool arrives as a gift rather than a purchase, which committee reviews it—and who owns it when the donation ends?

One shared test underneath all three: can you name the human who owns the answer? If not, that is the governance gap—not a coverage gap, not a procurement gap.

Closing Thought

Satya Nadella, CEO of Microsoft, ended his blog post with a sentence worth reading twice: in consuming intelligence, you are creating intelligence. And what you create should belong to you.

That sentence is the governance challenge of this moment. Every institution that uses AI is creating something—institutional intelligence, refined over thousands of employee interactions, corrections, and contextual clues. Whether that intelligence belongs to the institution or to the vendor depends on one thing: whether the institution built the governance architecture to claim it before the knowledge left the building.

AI Governance as Leadership means building that architecture before the next employee opens a prompt. The knowledge is leaving now. The governance clock is already running.

What’s Next

This Wednesday, July 22—Ungoverned: Applied Frameworks Under the Lens | China. If your institution uses AI tools built on Chinese-developed models—who has assessed that exposure? China regulates AI heavily and early—binding rules already govern algorithmic recommendation, deep synthesis, and generative AI services. The governance question is not whether the state acts, but who in your institution is held accountable for the exposure those models carry.

On the desk for Issue #80. A milestone worth pausing on. Issue #80 marks 80 consecutive weeks of Ungoverned—80 weeks of documenting, analyzing, and translating the AI governance challenge for leaders, boards, and trustees. Not a database. Not an aggregator. A governance lens, applied weekly, without missing an issue. And a brief reflection on what 80 weeks of this work has revealed about where governance is heading— and where institutions still need to go—full series at freddieseba.com.

Gratitude and Acknowledgments

This issue draws on the work of nurses at Kaiser Permanente who spoke on the record about what AI governance looks like—and does not look like—in clinical practice. Their testimony is the most direct evidence in this issue of what it means when governance does not keep pace with deployment.

Appreciation this week to AMIA— the American Medical Informatics Association and the Coalition of Health Care AI CHAI whose foundational work on health data stewardship and clinical AI governance continues to inform this newsletter’s healthcare coverage.

This issue also draws on Ungoverned: Applied Frameworks Under the Lens—full series at freddieseba.com.

References

Thinking Machines Lab. “Inkling: Our Open-Weights Model.” July 15, 2026. https://thinkingmachines.ai/news/introducing-inkling/
Trout, Cristian, et al. “Underwriting the Agent Economy: The Blueprint for an AI Insurance Stack.” arXiv:2607.11999 (July 2026). https://arxiv.org/abs/2607.11999
Coalition for Health AI (CHAI). “CHAI Launches PULSE: A National Initiative to Help Public Health Agencies Responsibly Implement AI at Scale.” July 16, 2026. https://www.prnewswire.com/news-releases/coalition-for-health-ai-chai-launches-pulse-a-national-initiative-to-help-public-health-agencies-responsibly-implement-ai-at-scale-302827293.html

Companion issue: Ungoverned Issue #79 on LinkedIn — https://www.linkedin.com/pulse/ungoverned-ai-ethics-governance-leaders-boards-trustees-seba-psqbc/

About Dr. Freddie Seba

Dr. Freddie Seba helps boards, trustees, and executive leadership teams build practical AI governance before AI failures make governance unavoidable.

Scholar-operator, Silicon Valley founder, and global executive — EdD · USF · MBA · Yale · MA · Stanford—he translates fast-moving AI developments into governance frameworks leaders can deploy now, across healthcare, financial services, and higher education. Non-vendor. Non-partisan. Doctoral research, not advocacy.

Ungoverned: A Practical Guide to AI Minimum Viable Governance is available now on Amazon.

Booking keynotes and workshops for fall 2026—freddieseba.com/contact

Transparency

Drafted and refined with AI-assisted tools—this issue, Anthropic’s Claude Sonnet 4.6. Naming the tools we use is part of the provenance we advocate. This is disclosure, not endorsement. Final editorial control and responsibility remain with the author.

For informational and educational purposes only. It does not constitute legal, regulatory, or compliance advice.

For reprint or licensing inquiries: contact@freddieseba.com

Connect: freddieseba.com · LinkedIn: @freddiesebaprofile · YouTube · Spotify · Apple Podcasts: AI Governance with Dr. Freddie Seba