Resource · Corrective
Governance is not the bottom brick.
One diagram is circulating in a dozen versions right now: a foundation of data work, with AI standing on top of it. Its prose is right. Its picture is wrong, and the picture is the part a board funds.
The words underneath these diagrams are usually sound. Automating on data nobody checked, nobody owns and nobody trusts does not produce insight; it produces the same errors at machine speed. Nothing here disputes that.
The objection is structural, and it applies to the genre rather than to any one author. A foundation is a thing you finish and then stand on. Draw governance as the bottom course and you have told a board it is a stage — something to fund once, sign off, and move up from. The three concerns that actually decide whether AI governance holds are precisely the three that never report done.
What the foundation picture holds, and what it drops
The picture gets this right The picture cannot hold this
-
Drawn, and correct
The five data courses
Lineage, ownership, data quality, metrics, trust. Real work, correctly grouped, and not the objection. Automating on data nobody checked does ship errors faster.
-
Drawn as a course
Governance
The bottom brick. A board funds a course once, at the bottom, and then moves up the stack. Governance has to hold on every floor above it — and where it does, compliance is what it leaves behind rather than a stage you reach.
-
Absent
Human capability
Six blocks and not one person. A named owner for a dataset is not an owner with halt authority: no budget line, no escalation route, no power to stop a launch. The gate is specified and never staffed.
-
Absent
Supply chain
Lineage traces data inside your own estate. It does not reach the third-party model you did not train or the vendor component you did not build, which is where most of the exposure now sits.
-
Deferred
AI itself
Drawn on top, waiting on everything underneath it. That is the instruction the picture actually issues, and it is the expensive part.
There is a version of the layers idea that survives this, and it is worth being precise about it. The buildable layers — data, model assurance, application, runtime and monitoring — do have a dependency order. You cannot monitor an application that does not exist. What that order is not is a schedule. A team consuming a vendor API starts at the application layer and stands monitoring up on day one, because it inherited the layers underneath as supply-chain dependencies rather than building them.
So the redraw keeps the layers and changes what crosses them. Human capability, governance and supply chain run the full height, because each one has to hold on every floor at once. Underneath and beside them sits baseline AI literacy, drawn as an L: the horizontal arm is the organisation-wide floor, the vertical arm is that floor applied as the role-specific skill each layer demands. A data scientist who cannot recognise prompt injection does not secure the application layer. A director who cannot read a model evaluation cannot exercise oversight. Neither of those is a course you lay and move past.
Why the drawing is expensive, not just wrong
Read literally, “foundation first” is an instruction to defer. It tells a board to fund a data programme that never reports done, and to hold AI behind it — the same sequencing that consumed a decade of warehouse budgets before anyone asked what was being waited for. Meanwhile the business ships anyway, through whatever tooling it can reach, and the governance that was supposed to be the foundation arrives after the fact as an audit.
- 01
Which of these can ever report done?
If the answer is none of them, they are not courses. Courses complete; columns are kept.
- 02
Who holds halt authority on each one?
A person, not a committee — with a budget line and a route to the risk committee.
- 03
What ships while the foundation is being built?
Something always does. The question is whether it ships governed or ungoverned.
A foundation is finished, and then you stand on it. A column is load-bearing on every floor.
What this is: a corrective on a diagram genre — the data-foundation pattern as it recurs across many versions, with the labels each author varies. No individual graphic is reproduced and no author is named; the objection is architectural, not personal. The model: Columns Not Layers — four buildable layers on a dependency order, crossed by three columns that cannot be sequenced, on an AI-literacy substrate drawn as an L. Regulatory note: the AI-literacy duty in EU AI Act Article 4 has been in force since 2 February 2025. The 2026 Digital Omnibus softened it from ensuring a sufficient level of literacy to supporting its development — an obligation of effort rather than of result. It was not deferred.
Related
Columns Not Layers: the matrix — the model on this page as a working grid. Twelve cells, each needing a named owner and a cadence, and what a blank cell actually tells you.
A Venn diagram is a claim about overlap — the same failure in a different shape. Four circles that promise intersections and place every item inside one.
The Governance Memo carries this work monthly for boards and CISOs — one breach post-mortem and two or three governance items.