Your governance was accurate once, on the day it was written

There is a gap opening between what organisations are deploying and what their governance can actually see. Deloitte puts it plainly: close to three quarters of companies plan to deploy agentic AI within two years, and only about a fifth report a mature model for governing agents. Roughly two in five organisations report inaccurate AI outputs in the past year, and around one in five have faced a legal claim connected to AI use.

The instinct is to read that as immaturity, something that resolves as practice catches up. The more useful reading is that governance has a decay rate, and almost nobody measures it.

Correct at publication, degrading from then on

A governance framework is accurate on the day it is signed. It names the systems in use, the people accountable, the thresholds that matter and the cadence of review. Every one of those facts has a half life. Systems get added. People move. Thresholds are quietly renegotiated under delivery pressure. The document does not change, so it keeps looking authoritative while describing an organisation that no longer exists.

This is not negligence. It is what happens to any static description of a moving system, and it is why a single point in time governance review is structurally insufficient no matter how good the review was.

The failure mode is silence, not alarm

Delivery failures announce themselves. A date slips, a build breaks, someone escalates. Governance failures do the opposite. The cadence slips by a week, then a month. A condition attached to a gate stops being tracked because the person tracking it changed role. Nobody escalates, because nothing visible has happened.

One technology leader put the maintenance version of this well: when anyone can ship a tool in an afternoon, nobody signs up to maintain it. The same holds for governance. Everyone will attend the design workshop. Far fewer will run the fourth quarterly review with no incident forcing it.

Handover is where the bill arrives

Programmes that survive the difficult middle often still fail at handover, and the reason is usually documentary rather than operational. The business is asked to take ownership of a governance model, and nobody can reconstruct what was decided, on what evidence, or which conditions were attached and never closed.

The receiving organisation is then choosing between accepting a model it cannot audit and rebuilding one from scratch. Most accept it, because the programme is ending and the pressure is to close. That is the moment the decay becomes permanent.

A decision nobody recorded is a decision nobody owns.

What actually holds

Two things, and neither is a framework. LR-2 governs the recalibration cadence itself, treating the review rhythm as a thing to be measured rather than a thing to be intended. LR-5 keeps the decision record intact, so that what was decided, by whom, on what evidence, and with what condition attached, survives the person who decided it.

The test is simple and uncomfortable. Take any gate decision from six months ago. Can you name who recorded it, what condition was attached, and whether that condition ever closed. If not, the governance is already the document rather than the practice, and handover will surface it whether or not anyone is ready.