Compliance is up, governance is down. That is a warning, not a win.

What most people think

Most people in the field assume that rising compliance attention means organizations are getting better at holistic AI governance. More legal reviews, more policy templates, more board updates. The logic is straightforward: if a company is spending more on compliance, it must be taking AI risk more seriously. That assumption is comfortable. It is also wrong.

What the data shows

Our live incident database, which tracks reported AI failures from public news, shows a clear divergence. In the last 45 days, compliance stories rose from 60 to 71. Governance stories fell from 231 to 154. That is an 11 percent increase on one side and a 33 percent drop on the other.

The severity mix tells the same story. Critical and major incidents fell, but only because total reporting dropped. The categories that get attention are privacy leaks, security vulnerabilities, and fraud. The categories that barely get reported are overreliance, environmental harm, and lack of capability or robustness. Those silent categories are where the real damage happens.

Meanwhile, the threat side is not quiet. Our sister platform ThreatClaw published 40 articles in 60 days, almost all on AI security, critical vulnerabilities, and actively exploited techniques. The gap between what the governance world talks about and what the security world writes about is the story.

Why this happens

Regulatory deadlines are the cause. The EU AI Act's high-risk rules apply from December 2027. Colorado's ADMT Act starts January 2027. California's CPPA rules follow in 2027. OSFI E-23 is effective May 2027. These are real laws with real penalties. A compliance officer who misses a filing or a notice requirement faces immediate legal exposure.

So risk budgets get pulled toward legal documentation. Policy templates, privacy notices, opt-out mechanisms, model cards. All of it necessary. None of it sufficient. The money has to come from somewhere, and it comes from the substantive work: technical validation, adversarial testing, and model audits. Those do not have a statutory deadline. They have a slow-burn risk that is easy to defer.

The result is a portfolio of immaculate paperwork and vulnerable models. A company can have a perfect privacy notice and still have a model that leaks training data or falls for a prompt injection attack. The paperwork does not protect the model. It protects the lawyers.

The best argument against this

One honest objection: compliance attention is a first step. You cannot fix what you have not documented. Maybe the rise in compliance stories reflects organizations finally building the baseline. Once the paperwork exists, the technical work will follow. The governance drop is just a reallocation, not a loss.

That argument has some force. Documentation is a prerequisite. But the data does not support the second half. There is no sign of a rebound in governance work. The drop is steep and the deadlines are near. If the technical work were coming, we would see at least some uptick in model audits or adversarial testing stories. We do not. The compliance work is happening because it is mandatory. The governance work is not happening because it is optional. That is the problem.

What I think happens next

By the end of 2027, enterprise legal spend on AI compliance documentation will grow by over 50 percent. Internal technical audits of AI models will decrease. The regulatory deadlines will be met on paper. The models will remain structurally vulnerable.

What would prove me wrong: if annual enterprise risk surveys through 2027 show technical audit spending growing faster than legal documentation spending. If that happens, the divergence is temporary and the system is correcting. I do not expect it to happen.

What to do about it

Start this week. You do not need to wait for a new law or a new budget cycle.

• Mandate that at least 50 percent of your AI compliance budget goes to technical validation and adversarial testing. Make it a written policy, not a preference.
• Require legal compliance teams to co-sign technical model cards alongside data scientists. If the model card says the model is robust, the legal team owns that claim too.
• Run a red-team exercise on your highest-risk model before the next quarterly review. Use a documented technique like prompt crafting or evasion. You can find real case studies in the MITRE ATLAS framework.
• Track both compliance and governance metrics in the same dashboard. If one rises and the other falls, treat it as a red flag, not a win.
• Read ThreatClaw's article "Your AI's Compliance Paperwork Might Be Lying to You" at https://www.threatclaw.ai/blog/your-ais-compliance-paperwork-might-be-lying-to-you. It explains how to check whether your documentation matches reality.

The deadline is not the goal. The goal is a model that actually works under attack. Paperwork will not get you there. Testing will.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.

Related reading:

• When Your AI Fails, Who Do You Tell? The New Rules Are Here on ThreatClaw
• Your AI's Compliance Paperwork Might Be Lying to You on ThreatClaw