AI Governance, fractional CAIO, AI program office, ~5 min read

There is a moment that arrives a few weeks after a good governance document lands on your desk. You have read it. You agree with all of it. The five principles are sensible, the risk tiers make sense, and you cannot name a single person whose job it is to do any of it by Friday.

That moment is where most AI governance programs quietly stop.

On 29 July the Society of Pension Professionals published Governance in the Age of AI: A Practical Framework for Responsible Leadership, aimed at pension scheme trustees and the advisers and administrators who serve them. Finextra covered the launch the same week. If you do not work in pensions, read it anyway. Almost nothing in it is specific to pensions, and the argument it makes is the one every department head is about to have.

What the pensions industry actually said

The paper’s central claim is refreshingly unglamorous: AI does not need a new governance regime. It needs the duties that already exist, applied to facts those duties were not written for.

Trustees already owe a duty of prudence. They already have risk registers, service provider oversight, internal controls, and cyber and data governance frameworks. The SPP’s position is that AI belongs inside all of those, not in a separate binder next to them. The framework sets out five principles: transparency, accountability, proportionality to risk, security by design, and meaningful human oversight. It recommends classifying every AI use as low, medium, or high risk, and keeping an AI register that records current use cases, who owns each one, how it was approved, how often it is reviewed, and what gets reported to the board.

The urgency is in the adoption curve. The SPP’s own annual surveys found 87% of pension firms using AI in 2025 and 100% in 2026, as Pensions Age reported. Jo Fellowes, who chairs the SPP’s administration committee, framed it this way: “The challenge is therefore not whether AI should be used, but how it can be used safely, transparently and with appropriate oversight.”

The Pensions Regulator reached the same place in its AI Plan of 20 May 2026, stating that trustees remain accountable for decisions and outcomes even when they delegate activities to providers or advisers. No new obligation was created. An existing one grew a much larger surface area.

The gap between a principle and a control

Here is where the paper gets uncomfortable, and where it earns the attention of anyone outside pensions.

“Meaningful human oversight” is the principle everyone signs. It is also the one almost nobody can currently evidence. The SPP invokes the Information Commissioner’s Office, whose draft guidance on automated decision-making went to consultation on 31 March, and the ICO’s test for meaningful human involvement is unusually concrete. The reviewer has to be trained to understand the system’s logic, outputs, limits, and risks. They have to hold the authority and the information to reach a different conclusion, not merely endorse the machine’s. They have to review while the decision can still be changed. And they have to do it every time, because spot checks leave everything else unchecked.

Asked by CFI.co whether current administrator and adviser practice would satisfy those criteria, the SPP declined to claim it would. Fellowes said trustees and the industry are still getting to grips with AI uses and how to govern them, so there has not been enough challenge of administrators and advisers to understand what practices they actually have in place.

That is an unusually honest answer from a trade body, and it names the real problem. The distance between writing “a human reviews the output” in a policy and being able to prove it under questioning is enormous. It is filled with people, calendars, tooling, records, and someone senior enough to say no.

Who owns this on Monday

Every organization I talk to about AI governance is somewhere on the same three-step path, whether they run a pension scheme or a 60-person manufacturer.

They write the policy. That part is fast, and increasingly there is a good published framework to start from, which is exactly what the SPP has just given the pensions industry for free.

Then they discover the policy describes an operating model nobody is operating. There is no register, because building one means asking eleven departments what they are actually using and getting honest answers. There is no risk tiering, because tiering requires someone with the standing to tell a director their favorite tool is high risk. There is no evidence trail, because nobody specified what evidence looks like before the systems went live.

Then they either staff it or they do not. Staffing it properly means a Chief AI Officer, and for most mid-market organizations that role is real but not full-time. That is the gap Modular Technology Group’s fractional CAIO practice exists to fill: an executive who owns the AI program, writes and maintains the policy, runs the AI register and the sanctioned tool list, tiers the use cases, sets the review cadence, and shows up to the board meeting with the reporting the framework asks for. An AI Program Office behind that keeps the artifacts current between meetings, because a register that is six months stale is worse than none, since it looks like control.

The framework tells you what good looks like. It does not tell you who does it, and it cannot. That part is an org chart decision, and it is the only part that changes anything.

Your data, your rules, and that includes the AI working on it

Your AI, your rules. Not the vendor’s rules, not the model provider’s terms of service, and not a control that exists in a document and nowhere else.

Ask the three questions the SPP is really asking. Where is AI being used across your operation right now, including the parts nobody approved? Who is accountable for each of those uses by name? If a regulator, a client, or your own board asked you to reconstruct why an AI-assisted decision came out the way it did, could you?

If the answers are uncomfortable, you are in normal company. The SPP just told an entire industry the same thing in writing. The organizations that come out of this well will be the ones that treated the framework as a starting position rather than a finished deliverable, and put a name next to every line of it.

The post A framework is not a control. Somebody has to run it. appeared first on Modular Technology Group.

Compliance, compliance-by-architecture, CMMC, ~5 min read

Ask a compliance officer what the worst part of the job is and you will rarely hear “the regulations.” You will hear about the six weeks before an audit. The scramble to find out which control changed, when, and why. The spreadsheet that was accurate in March. The engineer who has left the company and was the only person who knew how the logging worked.

That scramble is a symptom. It happens because compliance was bolted onto a system after the system existed, and the evidence has to be reassembled by hand every time somebody asks for it.

Pierre Ferran made a version of this argument on Finextra on 29 July, in a piece titled Compliance is becoming infrastructure, not overhead. It is written for financial institutions, and the scale he describes is a bank’s scale. The mechanism he identifies is the same one that breaks a 70-person defense supplier trying to hold CMMC.

The seam where compliance actually breaks

Ferran’s diagnosis is precise, and it is worth quoting the shape of it. The bottleneck in a regulated firm is no longer expertise. Financial institutions employ some of the best regulatory specialists in the world, and they are not confused about what any single rule means.

What breaks is everything sitting between the text and the control. Interpreting the rule for this specific business. Mapping it to the products and processes it touches. Finding the gap in the existing policy. Fixing it. Assigning ownership. And being able to prove all of that later, when an auditor asks in 2027 why a control changed in 2025.

He describes the legacy operating model in a way that will be familiar well outside banking. A guideline is published. Someone in legal reads it and writes a summary. A spreadsheet gets updated. A working group is scheduled for three weeks later. Risk, technology, and product each read the same summary and reach slightly different conclusions about what it means for them, and the reconciliation happens in meetings, months before implementation starts. Then the next consultation closes and the cycle restarts.

By his account, a firm operating across a handful of jurisdictions now faces thousands of regulatory developments a day once you count level-one texts, delegated acts, technical standards, and supervisory guidance. Whether or not that number holds for your sector, the direction is not in dispute. Ferran points to DORA, applicable since January 2025, MiCAR, fully applicable at the end of 2024, and the AI Act phasing in through 2026 and 2027, with an AML package and PSD3 behind them. Regulation stopped being an event and became a flow.

Security already made this move

The best part of Ferran’s argument is the analogy he reaches for. There was a time when a security review happened just before a product went live. Today that would be unthinkable. Security is designed in across the whole build, because managing risk after systems exist is slow and expensive.

The closer precedent, he notes, is internal to compliance itself. GDPR already proved the point inside the discipline. Privacy could not be contained in the legal function. Privacy by design had to reach into product decisions, data protection assessments had to involve engineers, and records of processing depended on data teams keeping them current. That was the first obligation that could not be satisfied by a document.

AI is the next one, and it is less forgiving. An obligation about where personal data may be processed is an architectural question before it is a legal one. If your models run in someone else’s cloud, in a jurisdiction you did not choose, on infrastructure whose logging you cannot inspect, you are not going to policy your way out of it. The answer to “where does this data live and who can reach it” is decided by a purchase order, not a paragraph.

What building it in looks like

For a small or mid-sized organization, “compliance as infrastructure” is not an abstraction. It is a short list of decisions made in a particular order.

Residency and jurisdiction come first, because they are the hardest to change later. Which physical facility holds the data, under which country’s law, and who has custody of the keys. Everything downstream inherits from that answer.

Then access, scoped and revocable, with a record. Not a policy that says only authorized personnel may access client data, but a system where unauthorized access is structurally not available and every authorized access leaves a trail nobody can quietly edit.

Then evidence as a byproduct of running, rather than a project that starts eight weeks before the assessor arrives. If your audit trail is generated by the same systems that do the work, the audit stops being an archaeology exercise. You already have the answer to when a control changed, because the change is in the log.

This is what Modular Technology Group means by compliance-by-architecture rather than compliance-by-audit. Private AI infrastructure in a US facility, so residency and jurisdiction are settled facts rather than vendor commitments. Fixed monthly pricing, because a compliance program you cannot budget for is a compliance program that gets deferred. And a program built to satisfy the framework the client is actually held to, whether that is CMMC, NIST 800-171, HIPAA, or FedRAMP alignment, rather than a general posture of being careful.

The economics are the part that usually surprises people. Bolted-on compliance is cheap to start and expensive forever, because every new obligation costs another remediation project. Built-in compliance costs more in month one and then absorbs new requirements as configuration changes. Ferran’s test for a firm is a good one to steal: how long does it take you, from the day a requirement is published, to know which parts of your operation it touches and who owns the response. If the honest answer is months, the problem is architectural.

Your data, your rules, from dirt to desktop

Modular owns the stack from the physical facility through the user interface, which is the only way to answer the residency question without a footnote. One vendor, no handoffs between a cloud provider, a hosting provider, and an AI provider, each of whom can only speak for their own layer.

Compliance has always been the price of operating in a regulated industry. What is changing, and Ferran is right that GDPR started it rather than the AI Act, is that it is turning into the thing that lets you move faster instead of the thing that stops you making mistakes. The firms that get there will not be the ones with the biggest compliance teams. They will be the ones who stopped treating compliance as paperwork and started treating it as plumbing.

The post When compliance is built in, the audit stops being a project appeared first on Modular Technology Group.

Cale is back from Ai4 in Las Vegas, and the news wrote his trip report for him. Three stories this week, and one question underneath all of them: when an agent acts, who answers for it?

In this episode

• A federal court says the human who points the agent is the one who acted. On August 4 the Ninth Circuit vacated the injunction Amazon had won against Perplexity’s Comet shopping agent. Under the federal anti-hacking law, the court read “access” as a person entering a system; software is a tool, and tools do not carry liability. One circuit, an early stage, and Amazon’s other theories are still live. Opinion, No. 26-1444 (PDF)
• “A human reviews it” has a measured failure rate. Belgian developer Alex Wauters built a browser game that flashes real agent permission prompts on a sixty-second clock. Across more than forty thousand rounds, players approved roughly one dangerous request in three. Anthropic’s own telemetry puts real-world approval around ninety-three percent. The Register
• Half a continent could last one business day. A survey of 1,500 firms across the UK, France and Germany found 73.9% worried Washington could cut off their access to US technology, and 54.5% said they could operate for a single business day without their cloud services. 44% have a continuity plan they have tested. The survey was commissioned by Proton, which sells the sovereign alternative; weigh it accordingly. The Register

Report from the floor: Ai4 2026

Cale worked more than thirty booths at The Venetian, August 4 to 6. Three things he brought home.

• The argument won. A main-stage keynote titled “From Renting AI to Owning Intelligence.” Appliance vendors printing “No tokens. No surprises.” on their booth walls. The CIO of a NATO procurement agency describing keeping local models close for sensitive work. Owning your AI has stopped being a niche position.
• Most “agent governance” is a dashboard. It shows you what your agent did. Far fewer products will stop it, and watching an agent misbehave in real time is not a control. The crowd of new names read like the late nineties; Cale’s own bet, offered as a bet, is that many are gone within a year. If your oversight lives in a startup’s dashboard, your controls inherit that startup’s odds.
• Ng and Hinton. They disagree about where this goes, and Hinton’s doom ran a little thick for Cale. The take-home fits in two sentences: build now, the way Ng says. Govern like Hinton is right.

The question we asked

If one of your agents did something wrong yesterday, could you reconstruct what it touched, or would you be guessing? Get the Modular Briefing by email and reply to it. A person reads every reply.

A note on the voices

Laura and Arthur are AI-generated voices, produced locally on Modular’s own infrastructure. The reporting, editorial judgement and script are the work of the Modular team. Facts and figures are drawn from the linked sources; check them there before acting on anything.

Transcript

Your data, your rules.

The post The Modular Briefing, August 10, 2026: The Agent Was You appeared first on Modular Technology Group.

Agentic AI, agent governance, permissions, ~5 min read

Somebody at your company has already handed an AI agent a credential. Maybe it went through review. Maybe an operations manager wanted invoice reconciliation to stop eating her Fridays, found a tool that promised it, and pasted in a service account key. The agent works. It has been working for six weeks. Nobody wrote down what it is allowed to touch, who owns it, or how you would switch it off at four o’clock on a Friday.

A piece published on BleepingComputer on 29 July puts the mechanism plainly: agents guess. They try an action, read what comes back, adapt, and try again. The article is sponsored content from an identity security vendor, so take the product pitch with the usual salt. The diagnosis holds up anyway, and it is the part worth putting in front of your own team.

Guessing is the job description

A script does the same thing every time. You can read it, test it, and know what it will do in production because it has no capacity to do anything else. An agent works differently on purpose. You give it an objective, and it decides on the path. That flexibility is why anyone wants one. It is also why you cannot write an allow-list of the actions it will take, because neither you nor the vendor knows what they will be until it takes them.

Most of the safety work being sold right now sits downstream of that. Prompt filters, content policies, behavioral monitoring: all of them inspect what the agent is trying to do after it already holds the keys to do it. The BleepingComputer piece has a good line about the arithmetic there. One percent of infinity is still infinity. An agent making thousands of decisions a week against a filter that catches almost everything will still get through, and when it does, the only thing standing between a wrong guess and a bad outcome is what that agent’s credential can reach.

So the useful question is not whether the agent will be wrong. It will be wrong. The question is how far a wrong answer travels.

The math nobody put in the budget

Palo Alto Networks surveyed 2,930 security leaders for its 2026 Identity Security Landscape report and found 109 machine identities for every human identity in the enterprise, up from 82 to 1 the year before. The same research found that 96% of respondents say their human identities already operate with access well beyond what their roles require.

Two more numbers from that report are the ones I would put on a slide. Only 37% of organizations can revoke an AI agent’s credentials. Only 30% keep immutable audit logging of what those agents did.

Sit with that for a second. A third of companies can turn an agent off. Under a third can reconstruct what it touched. Everyone else has deployed something that acts on their data, at speed, with standing access, and has no mechanism to stop it or to explain it afterward. That is not a technology gap. It is a governance gap wearing a technology costume.

Small and mid-sized organizations tend to assume this is an enterprise problem because the identity counts are enterprise counts. The ratio is the point, not the total. A 45-person company running a handful of agents across email, finance, and a shared drive has the same structural exposure as a bank, minus the identity team that would notice.

Scope the mandate, not the model

The fix is old and boring, which is why it works. Treat an agent the way you would treat the person whose work it took over.

That person had a job description. They had a manager. They had access to the systems their job required and not the ones it did not. When they left, IT closed the account, and there was a record of what they had done while they were there. None of that was exotic. It was just applied consistently, because HR and IT had a shared process that made skipping it awkward.

Applied to agents, it comes down to four things you can start this week:

• Find them. Every organization has more agents running than leadership has approved. Ask each department head what is automated and who set it up, and write the answers down. This is a conversation, not a scan.
• Give each one a named human owner and a written mandate. What is this agent for, what data does it need, what is it explicitly not permitted to do. If nobody will put their name on it, that is your answer about whether it should be running.
• Scope the credential to the mandate, and make it revocable. Standing broad access is the multiplier that turns a wrong guess into an incident. An agent that reconciles invoices does not need write access to the CRM.
• Log what it did, somewhere it cannot edit. When an auditor, a client, or your own board asks why a decision came out the way it did, “the AI did it” is not an answer that survives contact with anyone.

Notice that none of this requires you to predict the agent’s behavior. It requires you to bound it. That is the shift the BleepingComputer piece is arguing for, and it is the same shift identity teams made twenty years ago when they stopped trying to trust users and started scoping them.

Your data, your rules, and that includes the AI working on it

Your AI, your rules. That means an agent operating inside your walls, on infrastructure you control, with permissions you set and can withdraw, and a record you own of everything it did. Not a promise from a vendor that their filters are good. A boundary you can point at.

At Modular Technology Group we build agent programs this way because the alternative gets expensive in a specific, predictable direction: the day something goes wrong and nobody can say what happened. Modular’s agent work runs under a written policy from day one, with a named owner per agent, scoped and revocable access, and an audit trail that lives on the client’s own infrastructure rather than a vendor’s.

Agents are worth having. Ours run our own operations daily. But an agent is a delegation of authority, and delegation without a mandate is just hoping. Start with the list of what is already running. Most teams find it is longer than they expected, and that discovery alone is worth the afternoon.

The post Your agents will guess. Permissions decide what that costs you. appeared first on Modular Technology Group.

Three stories this week, and one question underneath all of them: when the AI does something, whose name is on it?

In this episode

• Your team is already using AI outside their job. An OpenAI analysis of more than 800,000 work messages found 44% of occupation-specific messages involved tasks outside the sender’s own role. For HR professionals it was 69%, third highest of any group, and the crossover runs highest at small companies. HR Dive
• What real oversight looks like. The Society of Pension Professionals published a five-principle AI governance framework. Two travel to any industry: tier AI uses by risk instead of writing one blanket rule, and make sure the human reviewing an automated decision has the authority to overturn it. Finextra
• “AI did it” is not a defense. After a rogue agent went after another company’s systems, lawyers were asked who is liable. Nobody knows yet, because the law was built around human decision makers. Liability turns on who designed the system, who set its objectives, what safeguards existed, and how much independence was judged acceptable. The Register

From the week

Cale’s post on a bank hiring its first Chief AI Officer reached more than thirteen thousand people. Two later versions of the same argument reached about two hundred each. The difference was posting the day the news broke and opening with the specifics.

On the road

Modular is at Ai4 in Las Vegas, August 4 to 6, at The Venetian.

The question we asked

At your firm, right now, if somebody asked who approved the AI that touches your client files, is there a name? Or is there a document? Tell us. Get the Modular Briefing by email and reply to it, and it lands with a person who reads it.

A note on the voices

Laura and Arthur are AI-generated voices, produced locally on Modular’s own infrastructure. The reporting, editorial judgement and script are the work of the Modular team. Facts and figures are drawn from the linked sources; check them there before acting on anything.

Transcript

Your data, your rules.

The post The Modular Briefing, July 31, 2026: Is There a Name on It? appeared first on Modular Technology Group.

Modular house · Explainer, Private AI · ~4 min read

Private AI is your models and your agents running on infrastructure you control, with your data staying inside boundaries you set. The name is about who holds the keys. It says nothing about how capable the tools are. Your data, your rules, from dirt to desktop, one partner from the hardware to the interface. Here is what that looks like in practice, and what it does not require you to give up.

The common misconception

Say “private AI” in a planning meeting and watch what people picture. Usually something small. A stripped-down model wheezing away on a spare laptop, good for a demo and not much else, the discount version of the tools everyone already uses at work. That picture is years out of date. A private workspace runs current open-weight models, several of them, on real hardware in a real facility, and you pick the one that fits the job. Privacy and capability are two separate questions. Answering one does not cost you the other.

The confusion is easy to forgive, because the line got blurry on purpose. The public tools sell a business tier with a setting that promises your data will not be used for training, and that promise is worth something. Read where it lives, though. It lives in a contract, and a contract is a thing both parties can revisit. Meanwhile your prompts still leave your building, cross the open internet, and land on servers you have never seen, in a jurisdiction you did not pick. The setting governs what the vendor says it will do with your data. Where your data goes stays the same.

Private AI closes that gap by removing the trust exercise entirely. Data cannot leak out of a boundary when the computing happens inside the boundary. There is nothing to opt out of. A setting is a promise. A boundary is a fact.

The three things that make AI private

Start with where the model runs, because everything else follows from it. When you ask a public tool a question, the question travels. It leaves your network, crosses the internet, and gets processed in a data center you cannot name, alongside everyone else’s traffic. Private AI turns that around: instead of sending your data to the model, you bring the model to your data. For our clients that means an isolated environment in a US-based, FedRAMP-certified data center, and for organizations that want it, dedicated hardware on their own premises. The question gets answered a few racks away from the data it draws on. Sometimes a few feet.

Then the data itself, which covers a lot more than chat history. The real value of a workspace shows up when you connect it to your documents. Contracts, research, case files, the institutional memory of the whole company. That happens through retrieval: the model reads the relevant pieces of your knowledge base at query time and grounds its answer in them. In a private environment, the documents, the index built from them, and the retrieval itself all stay inside the same boundary. Nothing is used to train anyone’s model. Nothing is retained by a third party, because there is no third party in the room.

And the part that gets discussed least while mattering most: who draws the boundary. Who can see which documents. Whether the system can reach the internet at all. What gets encrypted, what gets backed up, and what happens to all of it if you decide to leave. On public platforms those rules are set by the vendor and adjusted at the vendor’s discretion. In a private environment they are yours to set: access controls that separate the legal team’s vault from marketing’s, an air gap where the work demands one, and an exit that is just your data, in usable formats, walking out the door with you. That last one tells you who really owned the environment. If leaving is easy, you did.

What you keep

Everything your team actually liked about the public tools. The chat interface, the drafting and summarizing, the document questions, the code help. Those run just as well on infrastructure you control, through a clean web interface with access to multiple models, so people pick the model that fits the task instead of the one a vendor is promoting this quarter. Good UX is a software problem, and the software exists. Nobody has to learn to love a command line.

You also keep room to grow, because private is a spectrum, and you do not have to buy the far end of it on day one. Our Wildcat tier is the entry point: an isolated environment on shared infrastructure, in the same FedRAMP facility, under the same US jurisdiction as everything above it. Panther steps up to dedicated infrastructure, with file vaults, role-based access controls, and enhanced encryption for teams handling sensitive documents. Grizzly is the top: fully dedicated hardware, zero-trust architecture, an optional air gap, and the option to run it on your own premises instead of ours. The boundary tightens as you climb. What never changes is the jurisdiction. Your data stays in the United States whether it sits in our facility or in your building.

And you keep one accountable partner across the whole stack. The facility, with its redundant power and its guarded doors. The hardware in the racks. The models, kept patched and current, swapped for better ones as better ones ship. The interface your people log into every morning. When something needs attention, there is no seam between a cloud vendor, a hosting vendor, and an AI vendor for the problem to fall through. You hold the deed, and there is one number to call.

Your data, your rules.

The post What ‘private AI’ actually means appeared first on Modular Technology Group.

From the Desk of Cale · Cost, Fixed-cost AI · ~5 min read

Per-token pricing is a great way to start and a hard way to budget. The variable cost of someone else’s AI infrastructure isn’t actually variable to you. You just absorb the outputs: pricing changes, capacity limits, decisions made at a scale you’ll never see. Fixed, right-sized private infrastructure flips that. You know what you’re paying, and you know why.

The day-one price is not the real price

I’ve been thinking about taxi meters. A taxi is the right call for a trip to the airport, and nobody argues with the meter for one ride. But if you found yourself taking that same taxi to work every morning, you’d start doing math on a car payment before the end of the month. Per-token AI is a taxi meter, and a lot of companies are now commuting in it. Nobody chose the commute, either. The meter was already running when the habit formed.

The day-one price looks great because day-one usage is tiny. A handful of questions, a summarized document or two. Fractions of a cent each. Then the tool turns out to be useful, which is the whole point, and useful tools get used. People stop asking one question and start pasting in whole contracts. Someone wires it into a workflow that runs on every support ticket. Then come the agents, and an agent doesn’t make one call per task. It reads the document, checks its own work, calls a tool, reads the result, tries again. Every one of those steps is a metered ride. The per-token price never moved. Your consumption did, while everyone was busy being productive.

I sat with a client this spring and put a year of their AI invoices side by side on one screen. That was the entire exercise. No spreadsheet wizardry, no consultants. The line went one direction, and nobody in the room could name a month where anyone decided to spend more. That’s the tell. Metered costs don’t get decided. They accumulate.

Variable to them, fixed to you (and vice versa)

Here’s the part that took me embarrassingly long to see clearly. The provider’s costs are mostly fixed. The data centers are already built and the payroll is already set. What’s variable, to them, is you. Metered pricing is how they convert their fixed cost into your variable one. That’s a rational move on their side of the table. It’s just worth noticing which side of the table you’re on. When a business absorbs volatility, it charges for the service. When it passes volatility through, you’re the one providing that service, and nobody’s paying you for it.

So when their world shifts, the shift gets passed through. A new model generation lands and the price per token changes. Demand spikes and rate limits show up at exactly your busy hour. An older model gets retired, and the workflow your team spent a quarter tuning now runs on something that behaves differently. There’s no villain in any of that. A business planning for millions of customers makes ordinary capacity decisions, and you’re one line in the plan. You don’t get a vote. You get an email.

Now put yourself in the budget meeting. Finance asks what AI will cost next year. The honest answer under metered pricing is “it depends on how much people use it,” which is another way of saying the better it works, the less we can predict. That’s a strange incentive to hand a mid-sized team. Success becomes a cost overrun. I’ve watched a manager quietly discourage adoption of a tool his own company was paying for, because every new enthusiastic user made his forecast worse. Every budget is a guess, but this one is a guess about other people’s guesses.

What predictable looks like

Predictable starts with a boring question: what do you actually run? Not someday, today. Count the real workloads. The document review, the drafting, the internal search, the two or three automations that matter. Most teams find the list is shorter than they feared and steadier than the invoices implied. That steadiness is the asset. You size for your own team and the work it actually does. The whole internet is somebody else’s capacity problem. Once you know the workload, you can size the hardware to it, and once the hardware is sized, the cost is flat. You know the number in January and it’s still the number in October.

That’s the shape of what we build at Modular Technology Group. Our Private AI Workspaces start with Wildcat on shared infrastructure, step up to Panther on dedicated infrastructure, and top out at Grizzly on fully dedicated hardware, which you can host with us or stand up in your own building. The hosted tiers all live in a US-based, FedRAMP-certified data center. Every one of them bills as a flat monthly number. No per-token billing anywhere. We run our own work on the same stack, so when the meter argument comes up, we’re not speculating. We live on the fixed side of it. Right-sizing is a conversation. Some teams land on shared infrastructure and stay there happily. Some need the hardware where they can see it. Either way the number gets chosen, and you’re in the room when it happens.

The total-cost math is worth saying plainly. Owning can look more expensive on day one, the way a car payment looks worse than one cab fare. But a fixed cost changes the direction of every incentive after that. Under a meter, each new user is a liability. On infrastructure you own, each new user makes every task cheaper, because the same monthly number is now doing more work. You quit rationing the tool and start pushing it. Adoption stops being a cost problem and turns back into what it should have been, which is a productivity story. And because the models sit behind an interface you control, no single provider’s pricing decision can reach into your budget. When a better open model ships, it slots in. The bill doesn’t notice.

Here’s something you can do this week, and it costs nothing. Pull your last twelve months of AI invoices and put them in one place. Ask two questions. What happens to this line if usage doubles, and who decided the current number? If the answers are “it doubles” and “nobody,” you’re renting, and now you know what the rent really is. Then you get to decide what the number should be instead. Your data, your rules, from dirt to desktop.

If your AI line item has quit behaving, or you just want a second set of eyes on the own-versus-meter math, I’m always glad to compare notes. No pitch. Bring the invoices.

Own it, don’t rent it. Your data, your rules.

The post The hidden cost of renting your AI appeared first on Modular Technology Group.

Episode 8 · 4:40 · Download MP3 · RSS · Transcript

An AI agent is not a feature you switch on. It is an actor with authority. This week: a single link that could build a working agent inside somebody’s workspace with every connector attached and approvals switched off, an attacker who ran an agent unattended inside a national finance ministry, and a government that stopped a billion-euro cloud procurement to ask where its data lives. Three sizes of the same question.

In this episode

• A link that built an agent. Researchers showed one crafted URL could create a working agent inside a logged-in account, attach every connected mailbox and file store, set approvals to never ask, and put it on an hourly schedule. Patched on June 8, with no reported exploitation in the wild. The open question is not the bug. It is how casually agent authority gets handed out.
• An agent nobody was supervising. A security firm reports an attacker running an off-the-shelf agent with its approval mode disabled for post-exploitation work inside a national finance ministry. One firm is the only public source and the ministry has not confirmed it. The transferable lesson is that the useful setting was the one that removed the human.
• A government asking where its data lives. Ireland’s Office of Government Procurement cancelled a cloud framework competition over digital sovereignty. Jurisdiction moved from a slide in a security review to a reason to stop a contract.

Sources

• The Hacker News, July 24, 2026 — agent-builder flaw
• The Hacker News, July 24, 2026 — unattended agent at a national finance ministry
• The Register, July 22, 2026 — Ireland stalls cloud tender over digital sovereignty

AI voice disclosure

Laura and Arthur are AI-generated voices, produced locally on Modular’s own hardware. Story selection, reporting, and fact-checking are done by the Modular Technology Group team. Your data, your rules applies to our own production too.

If your team is pointing AI agents at real systems and nobody can say who owns them or what they may touch, book a conversation.

Your data, your rules.

The post The Modular Briefing, Episode 8: Who Gave It the Keys? appeared first on Modular Technology Group.

On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II, the third-party certification requirement that had been scheduled to start appearing in defense contracts on November 10, 2026, roughly four months out (DefenseScoop). Read the announcement closely: the suspension covers only the certification gate. DFARS 7012 still applies. The NIST 800-171 self-assessment still applies. For anyone bringing AI into the defense supply chain, that means less paperwork sitting on top of the same responsibility. Piping that data into someone else’s cloud model is still a risk you own.

What the suspension actually covers

Phase II is the part of CMMC where an outside assessor certifies you, meaning Level 2 assessments conducted by a C3PAO and the Level 3 assessments above them. That requirement is now suspended while a new CMMC Reform Task Force runs a 60-day review, and Phases 3 and 4 are frozen along with the program’s future implementation milestones. The stated reason is cost. The department wants to cut compliance expense and bureaucratic burden as part of a wider effort to streamline defense acquisition, and for a small contractor that is genuinely good news.

The review leaves the standing rules in place. DFARS clause 252.204-7012, which requires you to safeguard covered defense information and report cyber incidents, remains in force. So does the CMMC Phase I self-assessment: you still complete a NIST SP 800-171 self-assessment and upload your score to the DoD’s SPRS system. An inaccurate score can still create liability under the False Claims Act. The only thing removed from the calendar is the assessor’s visit. Every rule that assessor would have checked remains on the books.

What the pause means for how you handle CUI

The obligation follows the data, and it always has. Controlled unclassified information, CUI, carried the same obligations on July 14 that it carried on July 12, whether or not anyone is scheduled to check your work. Now consider where CUI actually goes when someone on your team pastes a spec or a contract excerpt into a public AI chat tool. It leaves your network and lands on infrastructure you cannot inspect, under retention terms you never negotiated. DFARS 7012 still expects you to report incidents involving that information, and you cannot report what you cannot see.

There is also the score you already attested. Your SPRS submission describes an environment where CUI stays inside defined controls. If CUI is quietly flowing into public tools, that submission stops being true, and the False Claims Act does not pause for a task force. The right response is simply to know where your data goes, and that is a thing you get to decide.

The private-AI answer for defense work

The same move that satisfies the standing rules also unlocks the AI you wanted in the first place: run the model inside a boundary you control. That can be your own environment, or a private one a partner builds and operates for you. When the model lives where the data lives, CUI never crosses into a system you cannot account for. This maps directly onto what survived the review. 7012 asks you to safeguard covered defense information; a boundary you control is the safeguard. The 800-171 self-assessment asks you to score your environment honestly; a contained environment is one you can score honestly and keep scoring honestly, review or no review.

You can move before the task force reports, and you can bring in help to do it. Modular Technology Group builds and runs private AI for contractors in exactly this position, and we own the whole stack. Your data, your rules, from dirt to desktop. Use the pause to get your AI inside your boundary, so that whatever comes back from the review, you are already standing where the rules point.

Your data, your rules.

The post The compliance gate paused. Your duty to your data did not. appeared first on Modular Technology Group.

Most companies did not decide to rent their AI. It happened one login at a time. A hotel is fine for a night, but you do not own the room, you cannot change the locks, and the nightly rate is whatever they say it is. Your business AI deserves a home you own, where your data stays yours and the bill does not surprise you.

How renting happens by accident

Nobody signs a lease with the whole company in mind. Someone in marketing starts a free trial to draft campaign copy. An engineer signs up with a work email because the tool saves an hour a day. Neither asks permission, because why would they? It is a free trial. Six months later there are a dozen seats spread across four departments, nobody owns any of them, and nobody can say what has been pasted into which chat window. There is no boundary because nobody ever drew one.

The moment you notice is usually mundane. A renewal notice arrives at a new rate, or a client’s security questionnaire asks where their information lives and the honest answer takes a week to assemble. So you decide to consolidate, and you discover that the prompts, the saved conversations, the custom workflows, the habits your team built are all inside someone else’s building. You can walk out, but you leave the furniture. That is the tell that you have been renting all along: leaving costs more than staying, and the landlord knows it.

What “owning the room” actually buys you

Start with the question your clients are already asking you: where does our data live? When you own the room, the answer is one sentence. It lives here, inside a boundary we control, and it does not feed anyone else’s model. That answer shortens security reviews and calms auditors, and it has the advantage of being simply true. No contract exhibit required.

The economics change too. Renting means metered billing, per seat and per token, at a rate set by someone who knows you cannot easily leave. Owning means the cost is mostly fixed. You know what the hardware costs and what running it costs, and the bill in month eighteen looks like the bill in month three. Budgeting becomes boring, which is exactly what budgeting should be. There is a quieter benefit underneath both of those: because the models sit behind an interface you control, you can change them without changing anything else. When a better open model ships, and they ship constantly now, you swap it in over a weekend. No migration project, no new vendor negotiation. The room stays the same. Only the furniture improves.

What it does not require you to give up

The usual objection is that owning means going without. It does not. The tools your team already likes (the chat interface, the document work, the code assistance, the meeting summaries) run just as well on infrastructure you control. Good UX is a software problem, and the software exists. Your people should not notice a difference, except that the question of where the data goes finally has an answer.

Owning also does not mean building from scratch. You would not pour your own foundation to own a house; you would hire a builder and hold the deed. The same trade exists here. A partner can stand up the hardware, run the models, keep everything patched and current, and hand you the keys. That is the work we do at Modular: your data, your rules, from dirt to desktop. You hold the deed. We keep the lights on.

Your data, your rules.

The post AI needs a home, not a hotel appeared first on Modular Technology Group.