Your AI systems are making decisions right now — hiring decisions, credit decisions, medical triage decisions, customer service promises your legal team will be held to. Are you certain those decisions are accurate, fair, and defensible? More to the point: would you know if they weren't?
That question ceased to be hypothetical in 2022, when Air Canada's AI chatbot gave a bereaved passenger incorrect information about bereavement fares, and the airline's legal team attempted to argue that the chatbot was, in some operative sense, a separate entity from the company itself. The tribunal was not persuaded. The ruling was brief and its implications were not: Air Canada was responsible for what its systems told its customers, and the defence of institutional distance from a system you built, deployed, and profited from would not hold.
That ruling arrived into an environment that had already shifted. The European Union had enacted the world's most comprehensive AI governance legislation. State-level requirements were accumulating across the United States. Australian regulators were hardening from guidance to enforcement. Institutional investors and enterprise procurement teams were beginning to ask governance questions that most AI vendors and deployers could not adequately answer. Every organisation deploying AI was, whether it acknowledged it or not, building a liability position it had not assessed.
Governing the Machine is the book for the executive who has grasped the significance of that moment and needs to know what to do about it.
Written for board members, chief executives, chief risk officers, and the governance professionals who support them, it maps the terrain with the directness that decision-makers require. Chapter by chapter, it dismantles the comfortable assumptions that allow governance gaps to persist: that using a reputable vendor's system transfers accountability to them; that publishing an AI policy is equivalent to having AI governance; that absence of visible incidents means absence of material risk; that governance and deployment velocity trade off against each other rather than depending on each other.
The book examines what AI actually does now — why probabilistic systems fail in ways deterministic software never could, why the tool defence no longer holds in any major jurisdiction, and why the systems most likely to produce consequential harm are often the ones generating no visible errors at all. It traces the anatomy of AI risk through hallucination and brand damage, algorithmic bias and legal exposure, data leakage and adversarial attack, systemic cascade failure, and the financial contagion scenarios that central bankers and regulators are tracking with increasing urgency.
Then it turns, with equal rigour, to solutions. The governance architecture that actually works, and why bolt-on governance consistently fails. The board questions that distinguish genuine oversight from its performance. The procurement disciplines that most organisations have never applied to AI vendor relationships. The compliance-by-design principles that make deployment faster by preventing the failures that halt it. The culture — more consequential than any policy document — that determines whether ethical reasoning is distributed through an organisation or merely described in its documentation.
The argument is consistent throughout: the organisations that govern their AI well will deploy it more broadly, more reliably, and ultimately more profitably than those treating governance as overhead. Trust is not a soft value that governance achieves at the cost of performance. It is the hardest competitive asset there is — built carefully, destroyed quickly, and increasingly the factor that determines who operates in the markets that matter most.
A consultant who told you that would cost considerably more than this book.
