Enterprise AI's Hidden Governance Tax Is Finally Getting Named

A security consultant wrote something this week that landed with the quiet authority of someone who'd been waiting to say it out loud.[¹] The gist: clients come to them weekly saying that doing AI risk evaluation and governance at the scale the business actually wants would require so much new headcount in security that every efficiency gain disappears. The response — "yes, you get it now" — carried the particular exhaustion of someone who'd been making this argument for a year and watching companies discover it the hard way anyway. That post, with its twelve likes on Bluesky, will not be remembered as a viral moment. But it names something the AI regulation conversation keeps dancing around: compliance isn't a checkbox problem, it's a cost structure problem, and the cost structure is starting to show up in earnings calls.

The regulatory environment isn't making this calculation easier. The EU AI Act is moving into enforcement, but its practical effect on the ground is already visible in smaller ways: OpenEvidence pulled its AI medical evidence app from the EU and UK entirely, citing regulatory uncertainty as the reason.[²] That's not a company failing a compliance test — that's a company deciding the compliance math doesn't work before it even tries. The EU's April tech policy newsletter flagged concerns about the AI Act omnibus process and what observers see as weakening oversight mechanisms rather than strengthening them, which suggests the Act's teeth may be duller in practice than in text. Whether that helps or hurts companies trying to deploy in Europe depends entirely on which side of the risk equation they're sitting on.

The governance gap isn't only a European story. Australia's prudential regulator issued an urgent AI risk warning to its financial sector. Singapore is writing agentic AI governance frameworks while Western regulators are still arguing about definitions. A one-liner from a policy watcher captures the current moment with uncomfortable accuracy: global AI governance frameworks are diverging, and that divergence is now a material business variable — it changes where companies build, what they build, and whether they ship. Governments everywhere are writing AI rules, but enforcement remains the part nobody has solved.

What's sharpening in the conversation right now is less "should AI be regulated" and more "who pays for the governance layer, and what happens when they can't afford it." The security consultant's framing — that governance overhead can structurally negate AI's value proposition — is a more precise version of a concern that CFOs are already expressing about enterprise AI ROI. The people saying AI will transform organizations and the people responsible for making that transformation safe are operating with incompatible spreadsheets. That gap doesn't close by writing better policy documents; it closes when someone decides who absorbs the cost. Right now, nobody is volunteering.