3 Traps That Make Compliance Theater Inevitable
AA-006: the Standards War
Top of the Series:
Previous:
Stop Buying Badges. Buy Evidence. You Donât Need No Stinkinâ Badges!
One badge, three meanings. The buyer hears âsafe.â The vendor hears âship.â The auditor hears âscope.â
*****â THE ARCHITECTS OF AUTONOMY*****
Research Binder: the receipts (citations + source notes) are compiled in a PDF at the bottom of this article.
đ§ Cold Open
You are in a windowless conference room that smells like burnt coffee and warm plastic. The projector fan is louder than the people.
Someone has a slide deck titled âAI Governance Readiness.â Someone else has a procurement deadline. Legal has a calendar invite called âEU compliance discussionâ that has been rescheduled three times. An engineer is here because they were told this meeting was about shipping.
A vendor rep puts a certification badge on the screen. Big logo. Clean typography. A little halo of credibility.
Procurement exhales. âGreat. So youâre certified.â
The rep nods. âYes, weâre certified.â
Legal asks, âCertified to what?â
The rep smiles like they have practiced this question. âISO.â
The engineer hears âISOâ and thinks âISO 27001.â The security lead hears âISOâ and thinks âaudit.â Procurement hears âISOâ and thinks âapproved.â
Legal asks again, slower this time. âCertified to what scope?â
The rep pauses. âOur management system.â
The room goes quiet.
Procurement is still smiling, but the smile is now contractual. The security lead is doing math. The engineer is doing a different kind of math, the kind where you count the number of places a sentence can hide a problem.
Someone says, âSo⊠this means you comply with the EU AI Act, right?â
The rep does not say yes. The rep does not say no but rather, âIt depends.â
The meeting ends with three action items and zero shared understanding. The badge remains on the slide like a sheriffâs star pinned to a costume.
The Standards War is not about standards. It is about who gets to define compliant.
Iâve been in versions of this room before, in real institutions with real consequences. The vocabulary changes. The incentives donât.
𧱠The Mechanism
Standards are supposed to translate governance into buildable structures. In practice, they often become a market language that people use as a substitute for evidence.
Here is how the machine works.
Standards define categories, controls, and documentation expectations.
Certification and auditing turn those expectations into gatekeeping.
Procurement turns gatekeeping into revenue and exclusion.
Marketing turns all of it into a badge.
Teams quietly learn the wrong lesson: âpass the auditâ replaces âreduce the risk.â
One example that makes it undeniable
A management system certification (like ISO/IEC 42001) can be real and valuable for governance. It still does not guarantee model-level outcomes. That gap is where compliance theater grows.
Hereâs what the gap looks like in practice. Teams run real tests, bias checks, red team scenarios, drift monitoring. Then the compliance tool does not accept any of that as evidence unless it is manually packaged. So people screenshot dashboards, paste results into documents, upload PDFs, and call it âaudit artifacts.â The work expands. The risk stays. That is compliance theater with a file attachment.
The incentive in one sentence
Defining compliant is cheaper than proving safety, and easier to sell than building evidence.
đ The Architects
Designers
Standards bodies and framework writers set the vocabulary. Their work is often serious, slow, and careful. The world they serve is fast, chaotic, and funded.
NIST AI RMF brings a risk management lens and emphasizes TEVV and evidence.
ISO/IEC 42001 offers a certifiable management system for AI governance, which is useful for process discipline.
OECD work on conformity assessment explains how trust marks become meaningful only when embedded in quality infrastructure.
Inspectors
Auditors, assessors, and the emerging algorithmic auditing ecosystem try to turn claims into verifiable judgments. Independent oversight fails fast when access is limited and incentives are misaligned.
Enforcers
Procurement, contracts, regulators, and courts decide what hurts.
Procurement has already started demanding AI governance evidence in RFP language, even when the standards discourse in public is still thin.
𧚠The Turn
The Standards War is not a debate about the best framework. The Standards War is the fight over who gets to define the test, who gets to sell the certificate, and who gets left holding the bag when reality shows up.
đž The Cost
Cost to individuals
People get harmed by systems that were âcertifiedâ in a way that never touched the risk that hurt them. The badge becomes a shield until discovery asks for receipts.
Cost to institutions
Organizations spend money proving compliance without improving controls. Teams take screenshots of dashboards, upload them into GRC tools, and call it evidence. The work expands. The risk stays.
Cost to the future
Small teams and new entrants get priced out by certification pressure. Large incumbents gain advantage because they can afford the committees, the consultants, and the audit cycles. The market slowly learns that âtrustworthyâ means âwell-resourced.â
The claims below are conservative and source-backed. Full receipts are in the Research Binder PDF at the end.
đ§Ÿ The Five Safe Claims (your citation-safe backbone)
Assurance cases are converging on system-safety patterns, but outcome evidence is nascent.
Third-party audits need access and independence to avoid becoming symbolic.
Trust marks can anchor assurance or enable theater, depending on scope, testing depth, and surveillance.
Crosswalks are approximate aids, not equivalence proofs.
Red teaming becomes audit-grade evidence only when structured and integrated.
The five claims above are conservative on purpose. Now comes the practical part.
In the Standards War, credibility collapses in three predictable ways. The audit becomes symbolic. The badge becomes theater. The crosswalk becomes a fake proof. The next three visuals are a fast diagnostic for spotting each failure mode before it becomes a procurement decision you have to live with.
If the audit isnât credible, the badge is just a costume.
Badge theater keeps winning because pricing is opaque. The easy-to-buy package is usually the easy-to-audit story. Deep assurance is quote-only and scope-dependent, which makes it hard to compare and easy to underfund.
And when the badge is vague, people reach for crosswalks to pretend the vagueness is solved.
Crosswalks are useful when they are relationship-typed and honest about gaps. Crosswalks become dangerous when theyâre used as equivalence claims. If you canât name the relationship type, you donât have a mapping. You have a sales story.
Download The Method (PDF):
A short field manual for turning standards talk into evidence, including the claims, the decision logic, scripts, and the scorecard.
That brings us to the antidote. You donât win this war by memorizing standards. You win by building evidence that survives contact with an auditor, a buyer, and a regulator.
If you want the underlying standards and audit literature behind this diagnostic, itâs in the Research Binder PDF at the end.
𧰠Autonomy Survival Kit
Three moves you can make this week
Build a one-page Standards Stack Inventory
List every framework, standard, and regulation you reference. Add scope per item: enterprise, product line, or specific workflow. If scope is missing, the standard is currently decorative.Start an Evidence Index that does not lie
Create an inventory of artifacts with owners, locations, review cadence, and last updated date. Examples include system description, inventory, risk register, TEVV plan, red team logs, monitoring outputs, change logs. Your new spreadsheet tool is designed for exactly this workflow.Download The Tool (Spreadsheet):
A practical working spreadsheet for turning standards talk into receipts, including the crosswalk, the evidence index, control links, and a 0â2 maturity scorecard you can update as the system changes
Relationship-type your crosswalks
Use four labels only: Equivalent, Partial, Related, No Match. Add assumptions. Highlight gaps. Stop implying compliance-by-osmosis. NIST explicitly treats crosswalks as approximate and context dependent.
Two moves for leaders
Make standards claims executable
New rule: no one is allowed to put âcompliant with Xâ in a slide unless it includes scope, control mapping, and evidence pointer.Upgrade procurement language
Ask for three things in every AI vendor review: scope statement, testing depth summary, and surveillance or re-assessment mechanism. If a badge has no surveillance, treat it as marketing.
One âtonightâ exercise (5 minutes, measurable)
Write one sentence for one standard you cite:
âThis standard forces us to do X control, producing Y evidence, reviewed every Z.â
If you cannot write that sentence, you are not using a standard. You are using a vibe.
đ Materials List (starter shelf)
NIST AI RMF 1.0 (SP 1270) and resources
ISO/IEC 42001:2023 overview page
OECD Digital Economy Paper on conformity assessment for AI systems
Hawkins et al. on assurance cases for ML (JSS, 2021)
Raji et al. Outsider Oversight (FAccT, 2022)
Closing stinger
Next case file: The Whistleblowerâs Dilemma (AA-007)
Every system eventually meets the person who sees too much.
Episode 7 is about the moment governance turns personal. The moment a âriskâ becomes a name, a timeline, and a choice. Do you report what you found, and bet your job on the organization doing the right thing? Do you stay quiet, and become part of the system you used to criticize? Do you try the middle path, and learn why middle paths tend to have cliffs.
Weâll map the real trap: most whistleblowing failures arenât caused by bad people. Theyâre caused by processes that were never designed to hear bad news, incentives that punish clarity, and a paper trail that vanishes right when it matters most.
If AA-006 was about badges and evidence, AA-007 is about courage and consequences. The receipts still matter. So does the human carrying them.
And if you want the practical counterweight to that dilemma, my upcoming book CollaborateBetter.us is built for exactly this problem: how to create teams and leaders who can hear the truth, act on it, and stay aligned when the pressure hits.
The case ends here.
The building starts now.
Letâs stress-test the Standards War together.
Comment with:
1. One AI vendor
2. Their strongest safety claim (copy/paste is fine)
3. Your role: buyer, builder, or both
Iâll reply with:
âą the single artifact that would prove it (or expose it), and
âą the exact procurement question to ask.
Bonus: If you want, add âRISK:â and name the failure you fear most (privacy leak, hallucinations, IP, bias, security, compliance).