Google spent the better part of a year telling everyone that Antigravity, its agentic coding environment, was the future of software work. Agents that plan, write, test, and ship with a human somewhere in the loop, loosely defined. Last week The Register reported that Google is now tethering Antigravity to its enterprise admin controls. Policy enforcement, permission scoping, audit visibility, the works.

Read that again. The company with more AI research muscle than almost anyone on the planet looked at its own autonomous agents running inside customer environments and decided they needed a leash.

That’s not a product announcement. That’s an admission.

What the tether actually tells you

For roughly two years the agentic AI pitch has been velocity. Let the agent touch the repo, the ticket queue, the database, the deployment pipeline. Trust the model. Move fast.

Enterprises, it turns out, were not buying it at scale. Security teams kept asking the same unglamorous questions. What can this agent read? What can it write? Who approved that? Where’s the log? And the honest answer, for most agentic tools shipped since 2024, was some version of “we’re working on it.”

So Google did what a vendor under pressure does: it built the controls its buyers were demanding and wired them into the Google admin plane. Good for Google. Genuinely good for Antigravity customers, too, in the narrow sense. An agent with scoped permissions and an audit trail beats an agent without them every single day.

But notice where those controls live. Inside Google’s console, expressed in Google’s policy language, enforced by Google’s infrastructure, covering Google’s agents. If you run Antigravity plus a Copilot deployment plus a homegrown agent on an open-weights model, and most mid-size shops we talk to are already in exactly that mixed state, you now have one well-governed island and a lot of open water.

Governance rented from a vendor is still lock-in

Here’s the part that should bother you more than the ungoverned agents did.

When your AI governance is a feature of one vendor’s platform, your policy layer becomes a switching cost. Every rule you write in their console, every approval workflow you build around their audit log, every compliance attestation that cites their controls, all of it deepens the moat around that one product. Leave the product and you leave your governance behind. You’d have to rebuild it from scratch inside the next vendor’s console, in their language, with their gaps.

That’s a strange place to park something as load-bearing as “who is allowed to let software act on our behalf, and under what conditions.”

Governance isn’t a feature. It’s a function. It belongs to the organization, above the tools, the way your security policy isn’t a setting inside your firewall vendor’s dashboard. The firewall enforces the policy. It doesn’t own it.

What owning it looks like

This is exactly the problem a fractional Chief AI Officer, or a small AI Program Office if you want the standing version, exists to solve. Not a committee that meets quarterly and produces a PDF. A working function that does specific things:

• Keeps an inventory of every agent and model in use, sanctioned or not. Most orgs that build this list for the first time find two or three tools nobody in leadership knew about.
• Writes permission and data-access policy once, in plain language the business owns, then maps it onto each platform’s controls. Google’s tether becomes one enforcement point among several, instead of the whole strategy.
• Defines what gets logged, reviewed, and escalated when an agent acts, regardless of whose agent it is.
• Maintains an exit plan per vendor. If the policy layer is yours, swapping the tool underneath is an engineering project, not an identity crisis.

None of this requires a full-time executive salary, and at most firms it shouldn’t get one. It requires a few disciplined days a month from someone who has done it before and answers to you, not to a platform’s roadmap.

The alternative is what we’re watching play out now: each hyperscaler ships its own governance surface, each one slightly different, and enterprises stitch together a compliance story out of four vendors’ screenshots and hope the auditor doesn’t ask how the pieces relate.

The principle underneath

Modular’s position on data has been the same since day one. Your data, your rules. And that includes the AI working on it. Your AI, your rules. An agent that can read your files, write your code, and act in your name is not a productivity toy. It’s an actor inside your business, and the rules governing an actor inside your business should be written by you, enforceable everywhere, and portable to whatever stack you run next year.

Google tethering Antigravity is a milestone worth marking, because it settles the argument. Ungoverned agentic AI is untenable, and now even the people selling the agents say so out loud. The open question is only who holds the tether. The vendor, or you.

We think the answer is obvious, and we think it’s a solvable, medium-sized project rather than a moonshot. Most of the firms we work with get a real inventory, a written policy, and enforcement mapping in place within a quarter.

So here’s what I’m curious about. If an auditor walked in tomorrow and asked you to list every AI agent with write access to something that matters in your business, how long would that list take to produce, and who in your org would have to produce it? Tell me honestly. The answers I’ve heard so far range from “ten minutes” to “we’d have to send an all-staff email,” and the gap between those two companies is the entire story.

The post Google put a leash on Antigravity, and that’s the whole story appeared first on Modular Technology Group.

No news this week. One argument instead, built from the ground up, because it is the place our reporting keeps landing and it has earned a hearing on its own. AI governance, for a business your size, is four things. An owner. A boundary. A log. And evidence. That is the entire list.

In this episode

• Who owns this? Not who bought it, and not who is good with computers: who is accountable when it goes wrong. Software with no owner does not sit still, it spreads. The fix costs nothing. One name next to one tool, and it can be a name already on your organization chart.
• Where does it end? A boundary is not a fence around the tool. It is a sentence about your material: what this is allowed to touch, and what it is not. Two lines is a real boundary. Then the harder half: where does your material go while the tool is looking at it? If it has to stay inside your walls, the tool has to run inside your walls.
• What happened? The log, and the one design choice that decides whether it is worth keeping: give the software its own identity. If your AI runs on an employee’s credentials, then in your own logs the software and the employee are one actor, and you cannot answer the only question anybody asks afterward.
• Can you show it? Not describe it. Show it. The name of the owner, the sentence about the boundary, a month of the log. Evidence is cheap to keep and impossible to build backwards. Nobody has ever manufactured last quarter.

The question we asked

Pick any AI tool in your business and answer question one out loud. Who owns this? If a name comes easily, you are further along than you think. If it does not, you have just found this month’s work. Get the Modular Briefing by email and reply to it, or write to Arthur at arthur@modtechgroup.com. A person reads every reply.

A note on this edition

This edition cites no news and no outside sources, on purpose. It is the argument the news editions keep arriving at from different directions, made directly. Nothing in it goes stale.

A note on the voices

Laura and Arthur are AI-generated voices, produced locally on Modular’s own infrastructure. The editorial judgement and script are the work of the Modular team.

Transcript

Your data, your rules.

The post The Modular Briefing, September 3, 2026: What Governance Actually Asks For appeared first on Modular Technology Group.

Spirit Airlines needed money. Google, according to the flight attendants’ union, wanted something more interesting than interest payments.

Fortune reported last week that the Association of Flight Attendants is accusing Google of structuring a deal around Spirit’s restructuring that would hand the tech giant access to confidential airline data for AI purposes. The union’s language was blunt. “Adding insult to injury” is how they framed it: their employer is in financial distress, their jobs are uncertain, and now the data generated by their work might get folded into someone else’s model training as a side effect of a transaction they had no seat at.

Set aside for a moment whether the union’s characterization holds up in every detail. The shape of the deal is the story. And the shape is one we’re going to see again and again.

Data as the sweetener

When a company is healthy, its data sits behind contracts, policies, and a general reluctance to give anything away. When a company is desperate, all of that becomes negotiable. Data turns into an asset on the table, right next to the gates and the aircraft leases. A lender or strategic partner who wants training data doesn’t have to buy it on the open market. They can attach it to financing that the company can’t afford to refuse.

Notice who’s missing from that negotiation. The flight attendants whose schedules, communications, performance records, and operational patterns make up a real chunk of that “confidential data” were not in the room. They didn’t sign up for it when they took the job. There was no consent moment. Their information became a bargaining chip because it happened to be sitting in systems their employer controlled and their employer needed cash.

That’s the part that should make every executive uncomfortable, and not only on behalf of the workers. Flip the seats. Your company’s data is sitting in a vendor’s cloud right now. That vendor has its own investors, its own pressures, its own potential acquirers. If your vendor hits a rough patch, or gets bought, or signs a strategic partnership with an AI lab, what stops your data from becoming their sweetener?

Read your agreements. In most cases the honest answer is: less than you think. Terms of service change. “Improving our services” clauses stretch. Acquisitions transfer data along with everything else, and the successor company’s appetite may not match the original vendor’s promises.

Consent doesn’t survive the deal

Here’s the mechanism worth naming plainly. Consent, in most data arrangements, is a snapshot. An employee consents to an HR system. A company consents to a cloud provider’s terms. Then the world moves. The provider changes hands, the terms get amended, a financing deal introduces a new party with new incentives. The original consent never contemplated any of it, but the data doesn’t get re-asked. It just flows to wherever the paperwork now permits.

The Spirit situation makes this vivid because a bankruptcy court and a union give it visibility. Most versions of this story never get a headline. The data quietly gains a new downstream use, a new processor, a new training pipeline, and nobody with standing to object ever finds out.

For firms handling client files, patient records, case materials, or workforce data, this should reframe the vendor question entirely. The question is not “do I trust this vendor today.” It’s “do I trust every future owner, creditor, and strategic partner of this vendor, under financial conditions I can’t predict.” Nobody can answer yes to that honestly.

The only clean answer is architectural

You can’t contract your way out of this. You can architect your way out of it.

If the AI workload runs inside infrastructure you control, on hardware in a known jurisdiction, with models you selected and can swap, there’s nothing for a third party to acquire access to. There’s no pool of your data sitting in someone else’s cloud waiting to become deal collateral. A vendor’s bankruptcy, acquisition, or creative new financing arrangement can’t repurpose data it never touched.

That’s the entire premise behind private AI workspaces as we build them at Modular. Client data and workforce data stay inside the client’s environment. Models run locally. Nothing feeds a third-party training pipeline, not because a policy says so, but because there’s no pipe. We own the stack from the physical facility to the interface the user touches, which means there’s no intermediate layer where someone else’s business model can intervene. Your data, your rules, from dirt to desktop.

And because the pricing is fixed, there’s no meter running that tempts anyone, us included, to find secondary value in what flows through the system. The economics are aligned with the architecture. You pay for capability, not for the privilege of becoming training data.

The flight attendants understood something instinctively that a lot of boardrooms still haven’t internalized: once your data is in someone else’s hands, your interests and theirs will eventually diverge, and when they do, the paperwork will favor whoever holds the servers.

The closing thought

I keep coming back to the phrase “adding insult to injury.” The injury was the financial distress. The insult was discovering that your working life had a resale value you never agreed to. Spirit’s flight attendants at least have a union loud enough to get this into Fortune. Most employees, and most companies whose data is riding in third-party clouds, will never get the courtesy of a headline.

The uncomfortable exercise for this week: pull up your top three data-holding vendors and try to answer, from the actual contract language, what happens to your data if they’re acquired or restructured. If you’ve done that exercise, or if you think I’m overreading the Spirit deal, tell me what you found. I’d genuinely like to compare notes.

The post When the financing comes with a data clause appeared first on Modular Technology Group.

The Register ran a piece this week that should get more attention than it will: Salesforce partners are reportedly not seeing meaningful revenue from Agentforce. Not customers grumbling. Partners. The consultancies and integrators who staffed up practices, sat through the certifications, and built their 2026 pipeline around Marc Benioff’s favorite word.

That detail matters more than another “AI pilot stalls” headline would. Partners are the canary in any enterprise software ecosystem. They only make money when customers actually deploy, expand, and renew. When a vendor’s sales numbers look fine but the partner channel is starving, it usually means the product is being sold but not used. Licenses in a drawer. Pilots that never graduate.

I’ve been saying for a while that agents bolted onto a SaaS platform were going to hit this wall, and I want to walk through why, because the reasoning matters more than the schadenfreude.

The bolt-on problem, specifically

An agent is only as useful as what it’s allowed to touch and what it’s trusted to do. Agentforce, by design, lives inside Salesforce. That’s great if your entire operational reality lives inside Salesforce. Almost nobody’s does. The customer record is in the CRM, sure, but the contract is in a document system, the invoice history is in the ERP, the actual conversation with the client is in email, and the tribal knowledge is in somebody’s head or a shared drive from 2019.

So the “agent” either stays narrow enough to be safe and ends up doing work a workflow rule could have done in 2015, or it reaches outward through connectors and suddenly you’re paying platform prices for integration work while your governance story gets murkier with every hop. Neither version produces the outcome the demo promised. Partners can’t bill against outcomes that don’t materialize.

Then there’s pricing. Agentforce launched with per-conversation pricing, and consumption models like that put the customer in a strange position: the more successful the agent is, the bigger the bill, and the bill is set by the same vendor that controls the platform, the model access, and the switching costs. CFOs noticed. Variable AI bills tied to usage you can’t fully predict are exactly the kind of thing that keeps a pilot a pilot forever. Nobody signs off on production when they can’t forecast the line item.

What actually gets agents into production

Here’s what we’ve learned building AgentWorks deployments, and it’s almost boringly unglamorous.

First, the job comes before the agent. You don’t buy an agent platform and then hunt for use cases. You pick one process with a measurable cost, in hours or dollars or errors, and you build the agent to do that process. Scope is a feature. An agent that does one thing inside hard boundaries ships. An agent that “can do anything across your org” gets stuck in security review, and it should.

Second, governance is designed in, not reviewed in. Every AgentWorks agent runs against defined permissions, logged actions, and a human checkpoint wherever the blast radius justifies one. When compliance asks “what can this thing actually do, and who approved it,” the answer is a document, not a shrug. Your data, your rules. And that has to include the AI working on that data. Your AI, your rules, which means you decide what the agent reads, what it writes, which model it runs on, and where all of it lives. On a platform vendor’s agent, most of those decisions were made for you before you ever logged in.

Third, the economics have to be legible. We do fixed pricing on this work because a client cannot govern what they cannot forecast. If the marginal cost of the agent doing its job is a surprise, the agent will be throttled by the finance department long before it’s throttled by any technical limit.

And fourth, model agnosticism. The right model for a contract-summarization agent and the right model for a triage agent are often different, and both will be different again in eight months. An agent architecture that lets you swap the model without rebuilding the system is worth more than any single model choice you make today. Platform agents lock that decision to the platform’s roadmap.

The honest read on the Register story

None of this means Salesforce built something worthless, and this isn’t a pile-on. It means the “add agents to the platform you already pay for” pitch has a structural flaw: the platform’s interests and the customer’s interests diverge exactly at the points that determine whether an agent earns its keep. Scope, data reach, pricing, and model choice. The partners caught in the middle are just the first ones to feel it, because they’re the only party in the ecosystem paid strictly on real adoption.

The agent era is going to be won by narrow, governed, accountable deployments that a specific team relies on every day. We use ours daily, which is how we know which parts of the pitch survive contact with an actual Tuesday.

If you’ve run an agent pilot this year, on Agentforce or anything else, I’m genuinely curious: what killed it or what saved it? Was it governance, cost, scope creep, or something nobody warned you about? Tell me. The failure stories are teaching us more than the keynotes are.

The post When the partners aren’t getting paid, look harder at the product appeared first on Modular Technology Group.

The Hacker News ran a piece this week on “shady AI”, their sharper name for shadow AI, and called it security’s next big governance problem. They’re right about the diagnosis. I want to push on the cause, because I think most companies are misreading it.

The standard story goes like this: employees discovered that free AI tools make their jobs easier, IT hasn’t sanctioned any of them, so people quietly paste client contracts, patient notes, and source code into whatever chatbot loads fastest. Security finds out months later, usually by accident. Cue the panic memo and the blanket ban.

That story treats shadow AI as a discipline problem. It isn’t a discipline problem. It’s a vacancy.

Nobody owns the question

Walk into a mid-sized firm and ask a simple question: who decides which AI tools are allowed here? Watch what happens. IT says they handle security review but not AI strategy. Legal says they’ll weigh in on contracts when asked. The COO says it’s on the roadmap. Meanwhile a paralegal has a browser extension summarizing privileged email, a sales rep wired a free agent into the CRM with a personal API key, and an analyst is running quarterly numbers through a consumer chatbot that trains on inputs by default.

None of those people are being reckless in their own minds. They’re being productive. The tool worked, nobody said no, and more to the point, nobody was there to say no. Or yes. The chair where that decision should get made is empty at most organizations, and shadow AI is simply what fills a vacuum.

Bans don’t fix vacuums. A ban is a “no” issued by someone who wasn’t in the room when the work needed doing, and employees treat it accordingly. The Hacker News piece touches on this: prohibition pushes usage underground, off the corporate network, onto personal devices, where security has zero visibility instead of partial visibility. You traded a manageable problem for an invisible one and called it policy.

What actually fills the chair

This is the exact gap the fractional Chief AI Officer exists to close. Not a consultant who writes a 40-page acceptable-use policy and leaves. Someone who sits in the seat, part-time but genuinely accountable, and does four unglamorous things.

First, inventory. You can’t govern what you can’t see. Before any policy discussion, find out what’s actually in use: the browser extensions, the personal subscriptions, the API keys nobody logged. Most firms are shocked by this list. The shock is useful. It converts an abstract worry into a spreadsheet with names on it.

Second, sanctioned alternatives. Here’s the part the ban-first crowd skips. People adopted these tools because the tools work. If you take away the free chatbot without replacing the capability, they’ll find another free chatbot. The answer is a private AI workspace they can actually use, running on infrastructure you control, where the drafting and the summarizing and the analysis happen without the data ever leaving your jurisdiction. At Modular that’s not theoretical. Our own teams run daily on the same private stack we deploy for clients, hosted on US soil, at a fixed monthly price, so the finance conversation is as boring as the compliance conversation. Boring is the goal.

Third, a real AI Program Office. Small, standing, cross-functional. It reviews new tool requests in days instead of quarters, keeps the approved list current, and gives employees a place to ask “can I use this?” and get an answer before they’ve already used it. Speed matters more than people admit. An approval process that takes six weeks is a prohibition wearing a lanyard.

Fourth, policy that says yes with conditions. “AI is banned” and “AI is fine, go nuts” are equally lazy. The workable version reads more like: this class of data can go into these tools, this class cannot, here’s the sanctioned path for the gray areas, and here’s who to ask when you’re not sure. Employees follow rules they can actually follow.

The sovereignty thread underneath

There’s a reason this maps so cleanly onto how we think about infrastructure. Your data, your rules. That’s been the thesis all along, and shadow AI is what it looks like when the rules never got written. Every unsanctioned tool is a small, silent transfer of control: your client’s contract now lives in someone else’s training pipeline, under someone else’s terms of service, in someone else’s jurisdiction. And that includes the AI working on the data, not just the data itself. Your AI, your rules. Governance without agency over the models and the tooling is just paperwork about someone else’s decisions.

The firms that get ahead of this won’t be the ones with the strictest bans or the longest policies. They’ll be the ones where somebody actually owns the question, where the sanctioned path is easier than the shadow path, and where “which AI touched this data” has an answer you could give a regulator without sweating.

The empty chair is the whole problem. Filling it doesn’t require a full-time executive salary. It requires deciding that the question deserves an owner.

Here’s what I’d genuinely like to know from the people reading this: when you last found an unsanctioned AI tool inside your organization, how did you find it? An audit, an incident, or dumb luck? The answers to that question tell you more about your governance posture than any policy document will.

The post Shady AI is what an empty chair looks like from the outside appeared first on Modular Technology Group.

The post DBS gave 1,500 employees AI agents. The interesting part is what had to exist first appeared first on Modular Technology Group.

Three different authorities, in two different countries, inside ten days. A bar association, a securities examiner and a national cyber agency. Not one of them asked whether anybody’s AI was any good. All three asked the harder question: can you show your work?

In this episode

• The default setting is the policy. The New York City Bar Association released Formal Opinion 2026-2 on August 17 (the opinion itself is dated August 5), extending two earlier opinions from clients to co-counsel, opposing counsel, witnesses, prospective clients and a firm’s own investigators. Get consent from every participant before an AI captures a conversation, and absent a good reason, the default should be to leave it switched off. The duty of competence now includes knowing how to turn the thing off. A New York City opinion rather than a national rule, but the reasoning travels. Formal Opinion 2026-2
• What examiners want is the minutes. Financial Advisor Magazine, working from an examination request document obtained by Citywire, reports what SEC examiners are asking investment advisers about AI: does the firm have an AI committee, does it keep written minutes, which channels promote the firm’s AI (the “AI washing” probe, with two 2024 cases settled for a combined $400,000), and were employees ever trained on the policy. No rule requires a document titled “AI policy”; advertising, compliance, privacy, recordkeeping and fiduciary rules already do the work. The ask is evidence, not a binder. Financial Advisor Magazine
• Agent governance, written down at last, and it is four controls. The UK’s National Cyber Security Centre published interim guidance on agentic AI on August 20. Every agent gets its own identity in a class distinct from humans, credentials scoped and short-lived, a named individual accountable for its activity, and its actions logged into monitoring the way a person’s are. Their maturity ladder ends, for the most sensitive work, at no external access with the model hosted locally. Interim guidance from a British agency, not American law. NCSC

The question we asked

Pick the newest AI tool inside your business. Can you name the person accountable for it, and show what it did last week? Get the Modular Briefing by email and reply to it. A person reads every reply.

A note on the voices

Laura and Arthur are AI-generated voices, produced locally on Modular’s own infrastructure. The reporting, editorial judgement and script are the work of the Modular team. Facts and figures are drawn from the linked sources; check them there before acting on anything.

Transcript

Your data, your rules.

The post The Modular Briefing, August 22, 2026: Show Your Work appeared first on Modular Technology Group.

AI Governance, fractional CAIO, AI program office, ~5 min read

There is a moment that arrives a few weeks after a good governance document lands on your desk. You have read it. You agree with all of it. The five principles are sensible, the risk tiers make sense, and you cannot name a single person whose job it is to do any of it by Friday.

That moment is where most AI governance programs quietly stop.

On 29 July the Society of Pension Professionals published Governance in the Age of AI: A Practical Framework for Responsible Leadership, aimed at pension scheme trustees and the advisers and administrators who serve them. Finextra covered the launch the same week. If you do not work in pensions, read it anyway. Almost nothing in it is specific to pensions, and the argument it makes is the one every department head is about to have.

What the pensions industry actually said

The paper’s central claim is refreshingly unglamorous: AI does not need a new governance regime. It needs the duties that already exist, applied to facts those duties were not written for.

Trustees already owe a duty of prudence. They already have risk registers, service provider oversight, internal controls, and cyber and data governance frameworks. The SPP’s position is that AI belongs inside all of those, not in a separate binder next to them. The framework sets out five principles: transparency, accountability, proportionality to risk, security by design, and meaningful human oversight. It recommends classifying every AI use as low, medium, or high risk, and keeping an AI register that records current use cases, who owns each one, how it was approved, how often it is reviewed, and what gets reported to the board.

The urgency is in the adoption curve. The SPP’s own annual surveys found 87% of pension firms using AI in 2025 and 100% in 2026, as Pensions Age reported. Jo Fellowes, who chairs the SPP’s administration committee, framed it this way: “The challenge is therefore not whether AI should be used, but how it can be used safely, transparently and with appropriate oversight.”

The Pensions Regulator reached the same place in its AI Plan of 20 May 2026, stating that trustees remain accountable for decisions and outcomes even when they delegate activities to providers or advisers. No new obligation was created. An existing one grew a much larger surface area.

The gap between a principle and a control

Here is where the paper gets uncomfortable, and where it earns the attention of anyone outside pensions.

“Meaningful human oversight” is the principle everyone signs. It is also the one almost nobody can currently evidence. The SPP invokes the Information Commissioner’s Office, whose draft guidance on automated decision-making went to consultation on 31 March, and the ICO’s test for meaningful human involvement is unusually concrete. The reviewer has to be trained to understand the system’s logic, outputs, limits, and risks. They have to hold the authority and the information to reach a different conclusion, not merely endorse the machine’s. They have to review while the decision can still be changed. And they have to do it every time, because spot checks leave everything else unchecked.

Asked by CFI.co whether current administrator and adviser practice would satisfy those criteria, the SPP declined to claim it would. Fellowes said trustees and the industry are still getting to grips with AI uses and how to govern them, so there has not been enough challenge of administrators and advisers to understand what practices they actually have in place.

That is an unusually honest answer from a trade body, and it names the real problem. The distance between writing “a human reviews the output” in a policy and being able to prove it under questioning is enormous. It is filled with people, calendars, tooling, records, and someone senior enough to say no.

Who owns this on Monday

Every organization I talk to about AI governance is somewhere on the same three-step path, whether they run a pension scheme or a 60-person manufacturer.

They write the policy. That part is fast, and increasingly there is a good published framework to start from, which is exactly what the SPP has just given the pensions industry for free.

Then they discover the policy describes an operating model nobody is operating. There is no register, because building one means asking eleven departments what they are actually using and getting honest answers. There is no risk tiering, because tiering requires someone with the standing to tell a director their favorite tool is high risk. There is no evidence trail, because nobody specified what evidence looks like before the systems went live.

Then they either staff it or they do not. Staffing it properly means a Chief AI Officer, and for most mid-market organizations that role is real but not full-time. That is the gap Modular Technology Group’s fractional CAIO practice exists to fill: an executive who owns the AI program, writes and maintains the policy, runs the AI register and the sanctioned tool list, tiers the use cases, sets the review cadence, and shows up to the board meeting with the reporting the framework asks for. An AI Program Office behind that keeps the artifacts current between meetings, because a register that is six months stale is worse than none, since it looks like control.

The framework tells you what good looks like. It does not tell you who does it, and it cannot. That part is an org chart decision, and it is the only part that changes anything.

Your data, your rules, and that includes the AI working on it

Your AI, your rules. Not the vendor’s rules, not the model provider’s terms of service, and not a control that exists in a document and nowhere else.

Ask the three questions the SPP is really asking. Where is AI being used across your operation right now, including the parts nobody approved? Who is accountable for each of those uses by name? If a regulator, a client, or your own board asked you to reconstruct why an AI-assisted decision came out the way it did, could you?

If the answers are uncomfortable, you are in normal company. The SPP just told an entire industry the same thing in writing. The organizations that come out of this well will be the ones that treated the framework as a starting position rather than a finished deliverable, and put a name next to every line of it.

The post A framework is not a control. Somebody has to run it. appeared first on Modular Technology Group.

Compliance, compliance-by-architecture, CMMC, ~5 min read

Ask a compliance officer what the worst part of the job is and you will rarely hear “the regulations.” You will hear about the six weeks before an audit. The scramble to find out which control changed, when, and why. The spreadsheet that was accurate in March. The engineer who has left the company and was the only person who knew how the logging worked.

That scramble is a symptom. It happens because compliance was bolted onto a system after the system existed, and the evidence has to be reassembled by hand every time somebody asks for it.

Pierre Ferran made a version of this argument on Finextra on 29 July, in a piece titled Compliance is becoming infrastructure, not overhead. It is written for financial institutions, and the scale he describes is a bank’s scale. The mechanism he identifies is the same one that breaks a 70-person defense supplier trying to hold CMMC.

The seam where compliance actually breaks

Ferran’s diagnosis is precise, and it is worth quoting the shape of it. The bottleneck in a regulated firm is no longer expertise. Financial institutions employ some of the best regulatory specialists in the world, and they are not confused about what any single rule means.

What breaks is everything sitting between the text and the control. Interpreting the rule for this specific business. Mapping it to the products and processes it touches. Finding the gap in the existing policy. Fixing it. Assigning ownership. And being able to prove all of that later, when an auditor asks in 2027 why a control changed in 2025.

He describes the legacy operating model in a way that will be familiar well outside banking. A guideline is published. Someone in legal reads it and writes a summary. A spreadsheet gets updated. A working group is scheduled for three weeks later. Risk, technology, and product each read the same summary and reach slightly different conclusions about what it means for them, and the reconciliation happens in meetings, months before implementation starts. Then the next consultation closes and the cycle restarts.

By his account, a firm operating across a handful of jurisdictions now faces thousands of regulatory developments a day once you count level-one texts, delegated acts, technical standards, and supervisory guidance. Whether or not that number holds for your sector, the direction is not in dispute. Ferran points to DORA, applicable since January 2025, MiCAR, fully applicable at the end of 2024, and the AI Act phasing in through 2026 and 2027, with an AML package and PSD3 behind them. Regulation stopped being an event and became a flow.

Security already made this move

The best part of Ferran’s argument is the analogy he reaches for. There was a time when a security review happened just before a product went live. Today that would be unthinkable. Security is designed in across the whole build, because managing risk after systems exist is slow and expensive.

The closer precedent, he notes, is internal to compliance itself. GDPR already proved the point inside the discipline. Privacy could not be contained in the legal function. Privacy by design had to reach into product decisions, data protection assessments had to involve engineers, and records of processing depended on data teams keeping them current. That was the first obligation that could not be satisfied by a document.

AI is the next one, and it is less forgiving. An obligation about where personal data may be processed is an architectural question before it is a legal one. If your models run in someone else’s cloud, in a jurisdiction you did not choose, on infrastructure whose logging you cannot inspect, you are not going to policy your way out of it. The answer to “where does this data live and who can reach it” is decided by a purchase order, not a paragraph.

What building it in looks like

For a small or mid-sized organization, “compliance as infrastructure” is not an abstraction. It is a short list of decisions made in a particular order.

Residency and jurisdiction come first, because they are the hardest to change later. Which physical facility holds the data, under which country’s law, and who has custody of the keys. Everything downstream inherits from that answer.

Then access, scoped and revocable, with a record. Not a policy that says only authorized personnel may access client data, but a system where unauthorized access is structurally not available and every authorized access leaves a trail nobody can quietly edit.

Then evidence as a byproduct of running, rather than a project that starts eight weeks before the assessor arrives. If your audit trail is generated by the same systems that do the work, the audit stops being an archaeology exercise. You already have the answer to when a control changed, because the change is in the log.

This is what Modular Technology Group means by compliance-by-architecture rather than compliance-by-audit. Private AI infrastructure in a US facility, so residency and jurisdiction are settled facts rather than vendor commitments. Fixed monthly pricing, because a compliance program you cannot budget for is a compliance program that gets deferred. And a program built to satisfy the framework the client is actually held to, whether that is CMMC, NIST 800-171, HIPAA, or FedRAMP alignment, rather than a general posture of being careful.

The economics are the part that usually surprises people. Bolted-on compliance is cheap to start and expensive forever, because every new obligation costs another remediation project. Built-in compliance costs more in month one and then absorbs new requirements as configuration changes. Ferran’s test for a firm is a good one to steal: how long does it take you, from the day a requirement is published, to know which parts of your operation it touches and who owns the response. If the honest answer is months, the problem is architectural.

Your data, your rules, from dirt to desktop

Modular owns the stack from the physical facility through the user interface, which is the only way to answer the residency question without a footnote. One vendor, no handoffs between a cloud provider, a hosting provider, and an AI provider, each of whom can only speak for their own layer.

Compliance has always been the price of operating in a regulated industry. What is changing, and Ferran is right that GDPR started it rather than the AI Act, is that it is turning into the thing that lets you move faster instead of the thing that stops you making mistakes. The firms that get there will not be the ones with the biggest compliance teams. They will be the ones who stopped treating compliance as paperwork and started treating it as plumbing.

The post When compliance is built in, the audit stops being a project appeared first on Modular Technology Group.

Cale is back from Ai4 in Las Vegas, and the news wrote his trip report for him. Three stories this week, and one question underneath all of them: when an agent acts, who answers for it?

In this episode

• A federal court says the human who points the agent is the one who acted. On August 4 the Ninth Circuit vacated the injunction Amazon had won against Perplexity’s Comet shopping agent. Under the federal anti-hacking law, the court read “access” as a person entering a system; software is a tool, and tools do not carry liability. One circuit, an early stage, and Amazon’s other theories are still live. Opinion, No. 26-1444 (PDF)
• “A human reviews it” has a measured failure rate. Belgian developer Alex Wauters built a browser game that flashes real agent permission prompts on a sixty-second clock. Across more than forty thousand rounds, players approved roughly one dangerous request in three. Anthropic’s own telemetry puts real-world approval around ninety-three percent. The Register
• Half a continent could last one business day. A survey of 1,500 firms across the UK, France and Germany found 73.9% worried Washington could cut off their access to US technology, and 54.5% said they could operate for a single business day without their cloud services. 44% have a continuity plan they have tested. The survey was commissioned by Proton, which sells the sovereign alternative; weigh it accordingly. The Register

Report from the floor: Ai4 2026

Cale worked more than thirty booths at The Venetian, August 4 to 6. Three things he brought home.

• The argument won. A main-stage keynote titled “From Renting AI to Owning Intelligence.” Appliance vendors printing “No tokens. No surprises.” on their booth walls. The CIO of a NATO procurement agency describing keeping local models close for sensitive work. Owning your AI has stopped being a niche position.
• Most “agent governance” is a dashboard. It shows you what your agent did. Far fewer products will stop it, and watching an agent misbehave in real time is not a control. The crowd of new names read like the late nineties; Cale’s own bet, offered as a bet, is that many are gone within a year. If your oversight lives in a startup’s dashboard, your controls inherit that startup’s odds.
• Ng and Hinton. They disagree about where this goes, and Hinton’s doom ran a little thick for Cale. The take-home fits in two sentences: build now, the way Ng says. Govern like Hinton is right.

The question we asked

If one of your agents did something wrong yesterday, could you reconstruct what it touched, or would you be guessing? Get the Modular Briefing by email and reply to it. A person reads every reply.

A note on the voices

Laura and Arthur are AI-generated voices, produced locally on Modular’s own infrastructure. The reporting, editorial judgement and script are the work of the Modular team. Facts and figures are drawn from the linked sources; check them there before acting on anything.

Transcript

Your data, your rules.

The post The Modular Briefing, August 10, 2026: The Agent Was You appeared first on Modular Technology Group.