Annual Publication  ·  2026

AI as Infrastructure: Governance, Power and Accountability in the Next Computing Era

How artificial intelligence is moving from software to infrastructure, why technical governance alone cannot keep pace, and what organisations need to build in response.

Read Publication
Introduction
Artificial intelligence has stopped behaving like a category of software. It is starting to behave like infrastructure.

A piece of software is something an organisation chooses to install, configure and, if it disappoints, remove. Infrastructure is different. It is the substrate other things are built on top of, the electricity grid, the road network, the payments rail, the cloud region, and organisations do not so much choose infrastructure as find themselves dependent on it, often before they have fully understood what that dependency means. Over the course of preparing this publication, in the applied work reflected across our case studies, our advisory services and our governance framework, we have watched artificial intelligence complete a similar transition inside the organisations we work with. It arrived as a tool bolted onto existing workflows. It is becoming the layer other workflows now assume will be there.

This publication sets out why that shift matters, and what it demands of governance. Its argument runs in two directions at once, and we think both need to be held together rather than examined separately. The first is that artificial intelligence appears to be democratising capability, placing tools of drafting, coding, analysis and synthesis into far more hands than owned them five years ago, while simultaneously concentrating the infrastructure beneath that capability into a strikingly small number of firms, data centres and supply chains. The second is that the governance response to this shift cannot be a purely technical one. A model card, a bias audit or a set of guardrails addresses the artefact in front of an organisation; it says very little about the ownership structure, energy demand, geopolitical exposure or systemic interdependency the artefact sits inside. Treating AI governance as a technical checklist, however well executed, is, we will argue, structurally incomplete.

We write this as a firm that spends its working life inside the gap between what organisations intend AI governance to achieve and what their governance actually produces when tested. That vantage point shapes what follows. This is not a neutral survey of the AI landscape. It is an argument, built from the academic literature on sociotechnical systems and algorithmic accountability, from current infrastructure economics, and from what we observe directly in engagements, that governing AI as infrastructure requires a different kind of governance than governing AI as software, and that most organisations, and much current regulation, have not yet made that adjustment.

What follows is organised in three movements. Sections one and two set out the infrastructural shift itself and the paradox of concentration beneath apparent democratisation. Sections three through six examine why governance built only on technical controls cannot hold that shift to account, and what evidence-based, human-centred governance looks like in practice. Sections seven through eleven turn to the infrastructure stack directly, compute, energy, workforce, regulation and industry, before section twelve sets out how we structure our own response to these findings, and section thirteen points toward the wider body of research this publication sits inside. Throughout, we have tried to reference our claims properly, in the tradition of the academic literature this publication draws on, so that readers can go and check the sources for themselves rather than take our word for it.

01 · From Software to Infrastructure
General-purpose technologies are recognised by one feature above all: everything else starts to depend on them.

Economists have a long-standing category for technologies that reorganise the economy around themselves rather than simply improving one part of it: the general-purpose technology, or GPT, steam power, electrification, the internal combustion engine, the internet (Bresnahan and Trajtenberg, 1995). Bresnahan and Trajtenberg's original criteria were pervasiveness across sectors, inherent potential for technical improvement over time, and the generation of "innovational complementarities", the property that a GPT makes innovation easier in the downstream sectors that adopt it. Artificial intelligence, and specifically the foundation models that now sit beneath a large share of enterprise software, meets each of these criteria with unusual speed. It is not confined to one industry, as our own work across banking, healthcare, government, manufacturing and retail makes clear. It has improved sharply on its own technical trajectory year over year. And it is already generating complementary innovation, new products, workflows and business models, in almost every sector it touches.

What distinguishes an infrastructural technology from a merely widespread one is dependency asymmetry: many depend on it, while it depends on very few. Electricity generation concentrated in relatively few power stations and grid operators, even as electrification transformed every downstream industry. The same asymmetry is now visible in AI. A small number of foundation-model providers, and an even smaller number of firms that own the compute those models are trained and served on, sit beneath a vast and growing surface of applications, copilots and agents built on top of them. We set out our own view of what a defensible AI lifecycle looks like precisely because that lifecycle no longer starts and ends inside a single organisation's IT estate, it starts somewhere upstream, in infrastructure an individual organisation neither owns nor controls.

Srnicek's account of platform capitalism is useful here, even though it predates the current generation of foundation models by several years. Srnicek (2017) describes platforms as infrastructures that position themselves as intermediaries between different groups of users, extracting and analysing the data that passes across them, and using that position to capture disproportionate value relative to the goods or services being exchanged. Foundation models extend this logic one layer further: they are not just intermediaries between buyers and sellers, but intermediaries between an enormous range of downstream applications and the underlying capability those applications depend on. Whoever controls the model, and the compute that model runs on, controls a chokepoint that did not exist in quite the same form in prior waves of enterprise software.

None of this is an argument against adoption, our own governance framework and technology implementation work exist because organisations should adopt AI, deliberately and well. It is an argument that adoption decisions made as though AI were ordinary software will systematically underweight a set of risks, supplier concentration, geopolitical exposure, energy dependency, systemic correlation of failure across an entire sector using the same handful of underlying models, that only become visible once AI is understood as infrastructure rather than application.

02 · The Great Paradox: Democratisation and Concentration
AI is putting extraordinary capability into more hands than ever, while quietly moving the infrastructure beneath that capability into fewer hands than ever.

Hold two facts side by side. The first is genuinely democratising: a solo founder, a junior analyst or a small local authority team can today produce work, drafting, coding, data analysis, design, that would previously have required a specialist team, simply by directing a general-purpose model. The second cuts the other way: the compute, energy and capital required to build and operate the models making that possible are concentrating at a pace with few precedents. Industry tracking of the four largest hyperscalers' disclosed and planned capital expenditure, Microsoft, Amazon, Alphabet and Meta, puts combined AI-related capex at roughly $725 billion for 2026, up around 77% from approximately $410 billion in 2025, with well over half of that spend going into power infrastructure and data centre buildout rather than chips alone (ValueAdd VC, 2026). Four companies now plan to spend, in a single year, a sum comparable to the GDP of a mid-sized advanced economy, on infrastructure that the rest of the economy will rent access to, rather than own.

We think of this as AI's great paradox, and it is the analytical spine of this publication: the more accessible AI capability becomes at the surface, the more concentrated its foundations become underneath. The metaphor we find most useful, developed across our own governance technology advisory work, is an iceberg. The visible portion, chat interfaces, copilots, coding assistants, the applications reviewed in our own AI platform reviews, is open, cheap and multiplying by the week. The submerged portion, the training runs, the specialised chips, the power purchase agreements, the proprietary data pipelines, is closed, capital-intensive and controlled by a strikingly small number of organisations. An organisation can build genuinely novel value on the visible ten percent of the iceberg while remaining entirely dependent on decisions made about the ninety percent it cannot see and does not influence.

This is not simply an economic curiosity; it is a governance problem, because concentration of this kind reproduces the dynamics Schumpeter (1942) described as creative destruction at a scale and speed that outpaces the institutions meant to hold it accountable. Schumpeter's insight was that capitalism's "perennial gale" of innovation continuously destroys old structures of production and replaces them with new ones, and that the process, left unexamined, rewards whoever currently controls the means of the new production most heavily. When the new means of production is compute itself, and compute is disproportionately owned by four or five firms operating across multiple jurisdictions, questions that used to belong to competition regulators start to belong to AI governance functions as well: who decides what the infrastructure is used for, on what terms, and answerable to whom.

It would be a mistake to read this as a story with a fixed ending. Open-weight models from a growing set of providers, sovereign compute programmes such as the UK's AI Growth Zones, and genuine competition between the hyperscalers all push back against pure concentration. But the direction of travel, more capital, more energy, more infrastructural interdependency per unit of visible AI capability, is not in serious dispute, and it is the reason we think AI governance now has to include infrastructure-level questions that a conventional model-risk framework was never built to ask.

03 · Why Purely Technical Governance Is Structurally Incomplete
A fair, explainable, well-tested model can still sit inside a governance failure that no amount of additional testing will fix.

This is where we want to make a claim that some technically-minded readers will resist: fairness metrics, explainability tooling and pre-deployment testing, while necessary, cannot on their own constitute AI governance, because the harms AI systems produce are frequently sociotechnical rather than technical in origin. Selbst et al. (2019) name the specific failure mode the "abstraction trap", the tendency of technical fairness research to abstract a model away from the social context it operates in, solve a mathematically well-defined fairness problem inside that abstraction, and then discover the solution does not transfer back into practice because the abstraction quietly discarded the parts of the problem that were actually social: contested definitions of fairness, the ripple effects of a decision on people who never interacted with the system directly, and the fact that a model deployed into a biased institutional process will often reproduce that bias regardless of how fair the model is in isolation.

The clearest empirical demonstration of this remains Obermeyer et al.'s (2019) analysis of a widely used US healthcare risk-prediction algorithm, published in Science. The algorithm itself was not crudely built; it used cost as a proxy for health need, which is a defensible modelling choice in isolation. The problem was sociotechnical: because less money is spent on Black patients with the same level of need, as a consequence of unequal access to care rather than any flaw in the model's mathematics, the algorithm systematically underestimated Black patients' clinical risk, reducing the fraction of Black patients identified for extra care from roughly 46.5% to 17.7% of what an unbiased selection process would have achieved. No amount of testing the model's internal fairness metrics against its own training data would have surfaced this, because the flaw lived in the relationship between the model and the healthcare system around it, not in the model's parameters. Suresh and Guttag (2021) generalise this point into a full taxonomy of harm sources across the machine learning lifecycle, historical bias, representation bias, measurement bias, aggregation bias, evaluation bias and deployment bias, and note that most of these sources originate before a single line of model code is written, or after the model has already shipped.

Dolata, Feuerriegel and Schwabe (2022) formalise the broader argument: algorithmic fairness has to be understood as a property of a sociotechnical system, the model, the data, the institutional process it sits inside, and the humans who interpret and act on its outputs, rather than a property of the model artefact alone. Millar (2020) frames the same idea from an engineering-ethics angle, describing "social failure" as a distinct category from technical failure: a system can perform exactly as engineered and still fail society, because the specification it was engineered against never captured the social outcome that actually mattered. Our own bias and fairness audits and explainability reviews are built around this literature deliberately, they examine the system in its institutional context, not only the model in isolation, and they feed into the wider risk classification and model governance work that determines how much scrutiny a given deployment actually receives.

Here we should push back on our own argument slightly: none of this is a case against technical governance tools. Bias testing, explainability methods and red-teaming remain necessary, and an organisation without them is worse off than one with them. The claim is narrower and, we think, more defensible: technical tools are necessary but not sufficient, and organisations that treat a clean bias-audit report as evidence of adequate governance have mistaken a component for the whole.

04 · From Ethics Theatre to Enforceable Governance
A principle without a mechanism to enforce it is not governance. It is a statement of intent an organisation has made to itself.

Jobin, Ienca and Vayena's (2019) systematic review of 84 AI ethics documents published by governments, companies and civil-society bodies found striking convergence around a small set of principles, transparency, justice and fairness, non-maleficence, responsibility, and privacy chief among them, but far less convergence on how any of these principles should actually be implemented, by whom, or with what consequence for non-compliance. That gap between principle and enforcement has a name in the critical AI-ethics literature: Munn (2023) calls it "ethics theatre," arguing that AI ethics has too often become a performance of ethical seriousness, codes of conduct, ethics boards, statements of principle, that is deliberately or accidentally decoupled from any mechanism capable of actually stopping a harmful deployment. Munn's sharper claim is that this decoupling is not always accidental: ethics theatre can function to defer harder regulatory intervention precisely by giving the appearance that self-governance is already working.

Png (2022) extends the critique geographically, arguing that AI governance principles developed almost entirely by Global North institutions get exported to the Global South largely unchanged, a pattern she terms "gatopardismo" after the Sicilian novel The Leopard's line that "everything must change so that everything can stay the same", cosmetic adaptation that leaves the underlying power structure, and who gets to set the rules, untouched. West, Whittaker and Crawford's (2019) AI Now Institute report on diversity in the AI industry supplies one structural reason this keeps happening: workforces building and governing these systems remain heavily skewed by gender and race, which the report argues is not incidental to the fairness failures those same systems go on to produce.

Formal regulation is the obvious answer to enforcement gaps, and the EU AI Act, Regulation (EU) 2024/1689, is the most ambitious attempt so far, using a tiered risk classification to impose binding obligations on providers and deployers of "high-risk" AI systems, including human oversight duties under Article 14 and post-market monitoring duties under Article 72. Wachter (2024) offers a valuable corrective to treating the Act as a finished solution, identifying specific loopholes and enforcement gaps in both the Act and the parallel AI Liability Directive proposal, including the reliance on largely self-assessed risk classification, and ambiguity over how liability attaches when harm results from a general-purpose model embedded inside someone else's product. Smuha (2021) frames the wider dynamic as a "race to AI regulation," in which jurisdictions compete to be first or most influential rather than necessarily most effective, echoing the earlier, less flattering "race to the bottom" dynamics observed in other transnational regulatory competitions. Yeung (2018) supplies the underlying critical vocabulary for all of this: "algorithmic regulation", governance conducted through the algorithmic system itself, rather than merely governance of it, carries its own risks of opacity and reduced contestability that a purely principle-based governance document will never surface.

Our own regulatory compliance, compliance gap analysis and regulatory advisory work exists specifically at this junction, translating a principle written in a policy document, an EU Regulation, an ISO/IEC 42001 management-system standard or a NIST AI RMF function into a mechanism that actually changes what happens the next time an AI system makes a consequential decision. Enforceable governance, in the sense we mean it, is governance that would survive Munn's challenge: could this decision be independently checked, and would checking it change anything?

The Assurance Gap

Boards are approving AI investment faster than they are building the oversight to match it.

Independent survey data from 2026 shows the same pattern from three separate angles: governance is acknowledged as the constraint on AI value, yet remains under-resourced relative to the pace of deployment.

Lack Confidence in a 90-Day Audit

%

Of senior leaders lack full confidence their organisation could pass an independent AI governance audit within 90 days.

Grant Thornton, 2026 AI Impact Survey
Boards With Clear Governance Expectations

%

Of boards that approved major AI investment have set clear AI governance expectations for that investment.

Grant Thornton, 2026 AI Impact Survey
AI Underperformance Attributed to Weak Controls

%

Of leaders say AI underperforms specifically because governance controls and compliance are not working as intended.

Grant Thornton, 2026 AI Impact Survey

See also our whitepaper on moving from AI governance to evidence and our case study on building AI assurance in a UK retail bank.

05 · Moving From Policy to Evidence
A policy describes what an organisation intends to do. Evidence is the only thing that shows it actually happened.

The distinction we draw throughout our AI assurance reviews and audit readiness work is simple to state and hard for most organisations to satisfy: a policy is a statement of intent, evidence is the record that the intent was actually carried out on a specific occasion. The NIST AI Risk Management Framework's Govern function makes this explicit, requiring that AI risk-related information, incidents, decisions, mitigations, be systematically recorded and maintained for accountability and traceability, not simply described in a policy binder (National Institute of Standards and Technology, 2023). ISO/IEC 42001, the first international management-system standard for AI, extends the same logic into a certifiable structure that an independent body can audit against (International Organization for Standardization, 2023). In UK financial services, the Prudential Regulation Authority's SS1/23 imposes model risk management principles that function the same way for banks using AI and machine learning models, requiring ongoing monitoring and validation evidence, not a one-off sign-off (Prudential Regulation Authority, 2023). The Institute of Internal Auditors' AI Auditing Framework applies the traditional Three Lines Model to AI specifically, treating continuous monitoring and independent assurance as the third line an organisation needs regardless of how good its first-line controls appear (Institute of Internal Auditors, 2024).

What this looks like in practice is consistent across every framework we work with: testing and validation records showing a model was assessed before deployment and after material updates; decision logs tying specific AI-assisted outcomes back to the reasoning behind them; escalation records showing how a specific issue was raised, handled and closed, not merely that a channel existed; version histories recording when an underlying model changed and what reassessment followed; and board or committee minutes showing substantive scrutiny of AI risk rather than a single line of approval. Our AI monitoring services and performance monitoring work is built to generate exactly this kind of evidence continuously, as a by-product of operating a system, in the way financial controls generate an audit trail simply by being followed, rather than reconstructing it retroactively once a regulator, court or customer asks. When evidence does not exist and something does go wrong, our incident management work has to substitute reconstruction for record, which is slower, weaker, and considerably more exposed.

We saw this pattern directly in an engagement summarised in our case study on moving from AI policy to evidence at a UK retail bank: a governance framework that looked complete on paper produced almost no evidence trail once regulators asked specific questions about specific decisions. The gap was not a gap in intent. It was a gap in what the organisation's systems were built to record.

06 · Human Oversight in an Age of Automation Bias
A human sitting in the loop is not the same thing as a human exercising meaningful control over what the loop produces.

Central insight: human oversight that cannot practically disagree with the system it is overseeing is not oversight. It is a signature.

Article 14 of the EU AI Act requires that high-risk AI systems be designed so that natural persons can effectively oversee them during use, including the ability to decide not to use the system, to disregard, override or reverse its output, or to intervene to halt operation. This sounds decisive on paper. The empirical literature on how humans actually behave when placed in this role is considerably less reassuring. Dratsch et al.'s (2023) randomised study in Radiology found that when an AI decision-support tool offered an incorrect suggestion to experienced radiologists reviewing mammograms, the radiologists' own diagnostic accuracy fell to roughly the same level as the flawed AI suggestion, a striking demonstration of automation bias in a population specifically trained to exercise independent clinical judgement. If specialists with years of domain expertise defer to an incorrect AI suggestion at this rate, a generalist employee reviewing an AI-assisted outcome outside their core expertise is unlikely to do meaningfully better.

The UK Information Commissioner's Office is explicit that human review of an automated decision must be genuinely meaningful, not "a token gesture", the reviewer must have the authority, competence and time actually to change the outcome, and must be shown to have engaged with all the relevant available data, not simply the AI's summary of it (Information Commissioner's Office, 2026). Dignum (2020) frames the deeper design problem: human-in-the-loop arrangements are often specified as a safety property of the system rather than designed as a genuine locus of authority, which produces oversight that satisfies a compliance checkbox while doing very little to change what the system actually decides in practice.

We worked through exactly this distinction in our case study on turning human oversight into meaningful control at a UK private diagnostics provider, where the original oversight process gave reviewers formal sign-off authority but neither the usable information nor the practical time to exercise it, nominal approval standing in for real control. Our model governance framework, explainability reviews and AI champions programme are built around the same underlying requirement: oversight has to be resourced, informed and structurally capable of producing a different outcome, or it is not oversight at all.

This matters more, not less, as AI infrastructure concentrates. When a handful of foundation models sit beneath a large share of an economy's decision-making, correlated automation bias across an entire sector, many organisations deferring to variants of the same underlying model in the same predictable way, becomes a systemic risk in its own right, not merely an organisational one.

07 · Governing the Infrastructure Stack: Compute, Energy and Sovereignty
The physical footprint of AI, the power stations, the water, the chips, the land, is now a governance question, not just an engineering one.

The International Energy Agency's Electricity 2026 report projects that global data centre electricity consumption will nearly double by 2030, reaching close to 945 terawatt-hours, roughly 3% of global electricity consumption, growing at around 15% a year between 2024 and 2030 (International Energy Agency, 2026). Within that total, AI-specific data centre electricity demand is the fastest-moving component: the IEA's Energy and AI analysis found that AI-related electricity consumption in data centres surged by roughly 50% in 2025 alone, and is projected to roughly triple by 2030 (International Energy Agency, 2025). Overall data centre electricity demand grew by around 17% in 2025. These are not projections from an AI-sceptical source; they are the base case of the agency responsible for global energy-system forecasting, and they describe a genuinely new category of infrastructure demand arriving inside an energy system that was not sized for it.

Governments have noticed. The UK's AI Opportunities Action Plan, published in January 2025, commits to expanding the UK's sovereign compute capacity at least twentyfold by 2030, established four AI Growth Zones to concentrate data centre and energy investment, created a Sovereign AI Unit in spring 2025, and has since committed a £500 million Sovereign AI Fund alongside a further £1.1 billion hardware plan to support UK chip and compute firms (UK Government, Department for Science, Innovation and Technology, 2025). Reading this alongside the hyperscaler capex figures above, a clear pattern emerges: the infrastructure layer of AI is being treated, correctly in our view, as a matter of national industrial and energy policy, not merely private-sector procurement, see our own coverage in UK AI regulation and regulatory updates.

For organisations that are not hyperscalers or governments, the overwhelming majority of the organisations we work with, this infrastructure concentration translates into a specific and underexamined governance question: vendor and supply-chain dependency at the infrastructure level, not just the application level. An organisation conducting due diligence on an AI vendor typically examines the vendor's model outputs, security posture and contractual terms. Far fewer examine the vendor's own upstream dependency on a specific cloud provider, chip supplier or energy market, even though a disruption at that layer, a chip export restriction, a regional power constraint, a single hyperscaler outage, can silently propagate through every application built on top of it. Our AI vendor assessments and governance technology implementation work increasingly treat this infrastructure-layer dependency as a first-class risk category, echoing the due-diligence discipline described in our case study on challenging an AI vendor before commitment for a Hampshire local authority.

Sustainability governance sits alongside this. An organisation that has never asked what proportion of its AI usage is powered by which grid, at what carbon intensity, has a live gap in its environmental, social and governance reporting that will not stay unexamined for long, given how quickly data centre energy demand is now moving into public and regulatory attention across utilities, construction and technology sectors alike.

The Infrastructure Curve

Capital and energy demand for AI are compounding faster than most governance functions have registered.

Figures drawn from hyperscaler capital expenditure tracking and the International Energy Agency's 2025 and 2026 reporting on data centre electricity demand.

Growth in Hyperscaler AI Capex, 2025 to 2026

%

Increase in combined planned AI-related capital expenditure by Microsoft, Amazon, Alphabet and Meta, from roughly $410bn to roughly $725bn.

Industry hyperscaler capex tracking, 2026
Surge in AI Data Centre Electricity Demand, 2025

%

Year-on-year increase in AI-specific electricity consumption within data centres during 2025.

International Energy Agency, Energy and AI, 2025
Annual Growth in Data Centre Electricity Demand

%

Projected average annual growth rate in global data centre electricity consumption, 2024 to 2030.

International Energy Agency, Electricity 2026
08 · Scaling AI Responsibly: From Pilot to Infrastructure Ownership
Most organisations are still governing AI as though it were a pilot, long after it has become part of how the organisation actually runs.

McKinsey's 2025 State of AI research, drawing on a global survey of enterprise respondents, found that only around 28% of organisations report the CEO holding direct ownership of AI governance, and only about one in five have meaningfully redesigned core workflows around AI rather than layering it onto existing processes (McKinsey & Company, 2025a). Fewer than one in five track AI-linked key performance indicators with any consistency. McKinsey's companion Superagency research puts a sharper number on organisational maturity: only around 1% of companies describe their AI rollout as fully mature, embedded in workflows and scaled across the organisation, even though the overwhelming majority report some level of AI use (McKinsey & Company, 2025b). Gartner's April 2026 research adds a resourcing dimension: organisations with successful AI initiatives are investing up to four times more in data and analytics foundations than those without, yet only around 23% of organisations report confidence in their AI governance maturity relative to the scale of their deployment (Gartner, Inc., 2026).

The pattern across all three studies is the same: organisations move AI from pilot to production far faster than they rebuild the operating model, ownership structure and KPI discipline that production scale actually requires. A pilot can survive on enthusiasm and a willing sponsor. Infrastructure cannot, it needs a named owner, a budget line, a monitoring regime, and a governance structure sized for the scale of dependency the organisation has actually taken on, which is precisely what our governance operating models and governance as a service work is designed to build.

We documented this transition directly in our case study on scaling AI beyond the pilot stage at a UK logistics and supply chain group, where governance, ownership and organisational capability all had to evolve at the same time a successful pilot moved into wider operational use, and where the absence of that evolution, not the underlying AI capability itself, was the binding constraint on safe scale. Our executive AI briefings and board AI briefings exist to close the ownership gap McKinsey and Gartner both describe, before an organisation discovers it the hard way.

09 · Workforce, Access and the Coming Capability Divide
Infrastructure without the skills to use it responsibly does not democratise capability. It just moves the risk downstream to whoever is least prepared for it.

UK parliamentary evidence presented to the House of Lords in April 2026 cited findings that roughly 84% of UK workers using AI at work have received no formal training in how to use it, leaving adoption running far ahead of competence (UK Parliament, 2026). Skillsoft's 2026 Workforce Readiness Report found that only around 24% of employees feel fully equipped to work effectively alongside AI tools, a striking gap given how widely those tools have already been deployed. Grant Thornton's 2026 AI Impact Survey adds an organisational-capacity dimension: only around 55% of CIOs and CTOs report that even half of their organisation's core applications are AI-ready, and just 40% feel well prepared to manage the privacy and security implications of the AI systems already in use.

This is the workforce expression of the great paradox described in section two. The tools genuinely are more accessible than they have ever been, a member of staff with no coding background can today direct a capable model through natural language, but accessibility of the tool is not the same as competence in its responsible use, and the gap between the two is where governance risk concentrates. An employee using a copilot without understanding its failure modes, its data-handling implications or the limits of its reliability is not exercising democratised capability; they are exercising unmanaged risk on the organisation's behalf.

We saw this concretely in our case study on preparing the organisation before Copilot deployment at a UK engineering and manufacturing group, where permissions, information hygiene and workforce readiness all had to be addressed before enterprise AI access was safely expanded across teams, deployment sequencing that, done in the wrong order, simply exports an organisation's existing data-governance weaknesses into a much faster and more consequential tool. Our training programmes are built around this sequencing problem directly, spanning workplace tools through the ChatGPT & Copilot, Claude and Gemini training assessments, agentic systems through our AI agents and multi-agent workflows assessments, and enterprise-wide capability through our enterprise AI and private and secure AI training assessments, alongside the underlying AI literacy, AI skills and training needs assessments that determine where an organisation actually needs to start.

Left unaddressed, this divide has a predictable shape: organisations and individuals with the resources to invest properly in training and governance will capture AI's productivity gains safely, while those without will either fall behind or adopt unsafely, and the infrastructure concentration described in section two means the second group has very little influence over the terms on which the underlying capability is offered to them in the first place.

The Capability Divide

Access to AI tools has outpaced the training needed to use them safely.

Workforce readiness data from UK parliamentary evidence, Skillsoft's 2026 research, and Grant Thornton's 2026 AI Impact Survey.

Workers Using AI With No Formal Training

%

Of UK workers using AI at work have received no formal training in how to use it responsibly.

UK Parliament, Hansard, House of Lords, April 2026
Employees Who Feel Fully Equipped for AI

%

Of employees feel fully equipped to work effectively alongside the AI tools already deployed to them.

Skillsoft, Workforce Readiness Report: AI Edition, 2026
CIOs Reporting Fewer Than Half of Core Apps AI-Ready

%

Of CIOs and CTOs report that fewer than half of their organisation's core applications are AI-ready.

Grant Thornton, 2026 AI Impact Survey
10 · Regulatory Divergence: Brussels, Washington, Beijing and London
There is no single global answer to how AI infrastructure should be governed, and organisations operating across borders now have to hold several answers at once.

The EU AI Act takes a tiered, risk-based regulatory approach, applying the heaviest binding obligations to systems classified as high-risk and banning a narrow set of "unacceptable risk" uses outright. The United Kingdom has so far taken a lighter-touch, pro-innovation stance, relying on existing sector regulators applying cross-cutting principles rather than a single AI statute, while pairing that approach with the aggressive sovereign-infrastructure investment described in section seven, a deliberate bet that speed of capability-building matters more, at this stage, than harmonised binding rules (see our coverage in UK AI regulation). The United States has moved through a patchwork of state-level rules and shifting federal executive guidance, with export controls on advanced semiconductors functioning as a de facto industrial-policy lever over AI infrastructure even where domestic AI regulation itself remains comparatively fragmented. China has pursued a state-directed strategy that combines significant restriction on public-facing content with active promotion of open-weight domestic models, a combination that has already begun reshaping global assumptions about how concentrated the foundation-model layer described in section two will ultimately remain.

Smuha's (2021) "race to AI regulation" framing is a useful lens for reading this divergence: each jurisdiction is competing not only to protect its citizens but to shape global norms, attract investment, and avoid ceding the infrastructure advantage described throughout this publication to a rival bloc. For a multinational organisation, the practical consequence is that "AI compliance" is not a single target to hit but a moving intersection of several regulatory regimes, each with different definitions of risk, different documentation requirements and different enforcement postures. Our regulatory advisory and compliance gap analysis work is built around tracking that intersection directly, and our regulatory updates and AI news coverage exists so that the organisations we work with are not discovering a regulatory shift after it has already changed what evidence they need to produce.

We would gently caution against reading any one jurisdiction's approach as simply "correct." The EU's tiered model produces clarity at the cost of complexity and, as Wachter (2024) shows, real enforcement gaps of its own. The UK's lighter touch produces flexibility at the cost of predictability. What all four jurisdictions share, and what this publication has tried to argue throughout, is that none of them yet fully treats AI's infrastructural characteristics, compute concentration, energy dependency, cross-border supply chains, as a first-class regulatory object in their own right, separate from the application-layer questions of bias, transparency and safety that current AI regulation is mostly built around.

11 · Industry Implications of AI as Infrastructure
Infrastructure-level dependency changes what "good governance" means differently in every sector we work with.

In banking and wealth management, infrastructure concentration intersects directly with existing model risk management obligations such as the PRA's SS1/23, raising the question of whether a bank's third-party model risk framework adequately captures risk that originates two or three layers upstream, at the foundation-model provider rather than the vendor in front of it. In insurance and fintech, the same dependency shapes questions of algorithmic pricing fairness and explainability that regulators are increasingly asking firms to answer with evidence rather than assurance. In government and local authorities, the stakes are different again: public bodies procuring AI capability are, in effect, procuring dependency on infrastructure they will never own, which is precisely the dynamic examined in our case study on challenging an AI vendor before commitment for a Hampshire local authority.

In healthcare, the sociotechnical governance failures described in section three, Obermeyer et al.'s (2019) healthcare algorithm bias finding chief among them, sit alongside the human-oversight and automation-bias questions from section six, given how directly clinical decision-support tools now touch patient outcomes; our case study on turning human oversight into meaningful control at a UK diagnostics provider sits at exactly this intersection. In education, infrastructure dependency raises questions about which institutions can afford genuine AI governance capability and which will simply adopt whatever a dominant platform provider offers by default. In legal services, the evidentiary standard raised by cases addressing AI-assisted decision-making makes the assurance gap described in section five a direct professional-liability question, not merely a reputational one.

In retail and hospitality, workforce-readiness questions from section nine dominate, as customer-facing and operational AI tools scale faster than frontline training typically keeps pace with. In manufacturing and construction, physical safety intersects with the infrastructure-stack questions from section seven, particularly where AI systems are embedded in equipment monitoring or site safety decisions with direct physical consequences; our case study on preparing the organisation before Copilot deployment at a UK engineering and manufacturing group reflects this directly. In technology and utilities, organisations sit closest to the infrastructure layer itself, and carry a correspondingly larger share of the direct compute and energy governance questions this publication has set out.

The through-line across all of these is the same one that opened this publication: infrastructure-level dependency does not remove sector-specific governance obligations, it adds a layer beneath them. Our full industries overview sets out how we adapt the same underlying governance framework to the specific regulatory and operational realities of each sector we work in.

12 · The INTAI Response: A Framework for Governing AI as Infrastructure
Everything argued above points toward one practical conclusion: governance has to be built at the same level AI now operates at, as infrastructure, not as software.

The INTAI Governance Framework is structured around five interlocking service areas precisely because no single discipline, technical testing, legal compliance, board oversight, monitoring, or change management, is sufficient on its own, for exactly the reasons set out in section three. AI Governance Strategy and Governance Framework Design establish the operating model and named accountability that sections five and eight showed most organisations still lack. AI Risk Assessment, AI Risk Classification, Bias & Fairness Audits and AI Regulatory Compliance address the sociotechnical and multi-jurisdictional dimensions described in sections three, four and ten. Executive AI Briefings, Board AI Briefings and our AI Champions Programme close the ownership and workforce gaps from sections eight and nine. AI Monitoring Services, AI Performance Monitoring and Governance Technology Implementation generate the continuous evidence described in section five, rather than reconstructing it after the fact.

We package the more repeatable parts of this into our Responsible AI Framework, our Model Governance Framework, our AI Lifecycle Framework, and a practical AI Governance Toolkit, AI Policy Library, AI Compliance Accelerator and AI Board Briefing Pack, so that an organisation does not have to build every part of an evidence-generating governance system from a blank page. Where an organisation needs to establish its starting position first, our Assessment Suite™ spans the full arc this publication has covered, from AI Readiness and AI Opportunity assessments at the discovery stage, through AI Governance, AI Risk and AI Vendor assessments at the governance stage, to Executive AI Maturity and Board AI Readiness assessments at the leadership stage, each built against the published assessment methodology set out in our assessment FAQs.

None of this is offered as a claim that governance alone resolves the infrastructure concentration described in section two, that is a question well beyond what any single advisory firm can answer, and one that competition regulators, energy policymakers and legislators are better placed to address than we are. What we can do, and what our full range of services is built to do, is ensure that the organisations we work with are not carrying that infrastructural exposure blind: that they know what they depend on, can evidence how they manage it, and can show, when finally asked, that governance was something they actually did rather than something they merely wrote down.

13 · Research, Knowledge and Continuing Inquiry
This publication is a single position, taken at a single point in time, inside a field that is still moving quickly.

We treat annual publications like this one as the top of a much larger body of work rather than a self-contained statement. Our Research & Reports and Whitepapers, including our companion whitepaper on moving from AI governance to evidence, go deeper into single questions this publication can only summarise, and our Case Studies, several of which are referenced throughout this piece, show the same arguments tested against real, anonymised engagement work rather than left at the level of theory.

Our University Research and Academic Reviews pages track the wider scholarly literature this publication draws on, the sociotechnical governance work of Selbst, Suresh, Dolata and Millar; the critical AI-ethics work of Munn, Png and Yeung; the platform and infrastructure economics of Srnicek and Schumpeter, because we think an advisory firm's obligation to that literature does not end at citing it once. Our Governance Academy and Executive Guides translate the same material into a form built for practitioners rather than researchers, and our Blog, Industry Analysis, Regulatory Updates and AI News keep the picture current between annual publications, given how quickly the regulatory and infrastructure landscape described in sections seven and ten continues to shift.

For teams that want to act on any part of this publication directly, our Templates, Checklists, Governance Policies and Downloads library, alongside our AI Glossary for readers newer to the terminology used throughout this piece, are built to be used, not simply read.

Conclusion
Infrastructure asks more of governance than software ever did. Most organisations have not yet updated their answer.

We opened this publication with a claim that we think the evidence assembled across the last thirteen sections has borne out: artificial intelligence has moved from being a category of software an organisation chooses to adopt, to being infrastructure an organisation depends on whether it has fully reckoned with that dependency or not. The great paradox at the centre of that shift, extraordinary democratisation of capability sitting directly on top of extraordinary concentration of the compute, energy and capital beneath it, is not a contradiction to be resolved. It is simply what infrastructural technologies look like at this stage of their development, as they have looked at earlier stages of electrification and networked computing before them.

What follows from that, and what this publication has tried to argue in as evidenced a way as we can manage, is that governance built only from technical controls, however well executed, cannot hold infrastructure of this kind to account. Selbst, Obermeyer, Suresh, Dolata and Millar all point to the same underlying claim from different angles: harm in sociotechnical systems originates in places a model card will never examine. Munn, Png and Yeung point to the same failure from the enforcement side: a principle without a mechanism is not governance, it is a description of good intentions. And the infrastructure economics gathered in sections two, seven and nine show why the stakes of getting this wrong are compounding, not stabilising, more capital, more energy, more workforce exposure, more cross-border regulatory complexity, arriving faster than most governance functions are currently resourced to absorb.

None of this is a counsel of pessimism. Every case study referenced throughout this publication, from a Hampshire local authority testing a vendor before commitment, to a UK diagnostics provider redesigning what oversight actually means, to a UK bank learning to produce evidence rather than policy, shows that the gap between AI governance as currently practised and AI governance adequate to infrastructure is closable, with the right sequencing, the right ownership, and the right evidence base built in from the start rather than assembled after something has already gone wrong.

That is the work we do. If this publication has argued its case well, the organisations that take AI's infrastructural character seriously now, in how they govern it, resource it, and hold themselves accountable to it, will be considerably better positioned than those that continue treating it as software a little longer than the evidence now allows. We would welcome the chance to help make that case for your own organisation directly: get in touch, or read more about our approach to find out how we work.

References & Sources

Full reference list, Harvard style.

This publication draws on peer-reviewed academic literature, established governance frameworks, regulatory texts, industry survey research and international-agency reporting. Sources are listed alphabetically by author. Links are provided wherever a stable, publicly accessible source exists.

01

Bresnahan, T.F. and Trajtenberg, M. (1995) 'General purpose technologies "Engines of growth"?', Journal of Econometrics, 65(1), pp. 83–108.

View source
02

Dignum, V. (2020) Responsible Artificial Intelligence: How to Develop and Use AI in a Responsible Way. Cham: Springer.

View source
03

Dolata, M., Feuerriegel, S. and Schwabe, G. (2022) 'A socio-technical view of algorithmic fairness', Information Systems Journal, 32(4), pp. 754–818.

View source
04

Dratsch, T. et al. (2023) 'Automation bias in mammography: the impact of artificial intelligence BI-RADS suggestions on reader performance', Radiology, 307(4), e222176.

View source
05

European Union (2024) Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act). Official Journal of the European Union.

View source
06

Gartner, Inc. (2026) Gartner Says Organizations With Successful AI Initiatives Invest Up to Four Times More in Data and Analytics Foundations. Stamford: Gartner, April 2026.

View source
07

Grant Thornton Advisors LLC (2026) 2026 AI Impact Survey Report: The AI Proof Gap.

View source
08

Information Commissioner's Office (2026) Human Review, Guidance on AI and Data Protection.

View source
09

Institute of Internal Auditors (2024) Artificial Intelligence Auditing Framework.

View source
10

International Energy Agency (2026) Electricity 2026 – Analysis. Paris: IEA.

View source
11

International Energy Agency (2025) Energy and AI. Paris: IEA.

View source
12

International Organization for Standardization (2023) ISO/IEC 42001:2023 – Artificial Intelligence Management System.

View source
13

Jobin, A., Ienca, M. and Vayena, E. (2019) 'The global landscape of AI ethics guidelines', Nature Machine Intelligence, 1, pp. 389–399.

View source
14

McKinsey & Company (2025a) The State of AI: How Organizations Are Rewiring to Capture Value.

View source
15

McKinsey & Company (2025b) Superagency in the Workplace: Empowering People to Unlock AI's Full Potential.

View source
16

Millar, J. (2020) 'Social failure modes in technology and the ethics of AI: an engineering perspective', in Dubber, M.D., Pasquale, F. and Das, S. (eds.) The Oxford Handbook of Ethics of AI. Oxford: Oxford University Press, pp. 442–461.

View source
17

Munn, L. (2023) 'The uselessness of AI ethics', AI and Ethics, 3, pp. 869–877.

View source
18

National Institute of Standards and Technology (2023) AI Risk Management Framework (AI RMF 1.0). Gaithersburg: NIST.

View source
19

Obermeyer, Z., Powers, B., Vogeli, C. and Mullainathan, S. (2019) 'Dissecting racial bias in an algorithm used to manage the health of populations', Science, 366(6464), pp. 447–453.

View source
20

Png, M-T. (2022) 'The critical roles of Global South stakeholders in AI governance', in Bullock, J. et al. (eds.) The Oxford Handbook of AI Governance. Oxford: Oxford University Press.

View source
21

Prudential Regulation Authority (2023) SS1/23 – Model Risk Management Principles for Banks. London: Bank of England.

View source
22

Schumpeter, J.A. (1942) Capitalism, Socialism and Democracy. New York: Harper & Brothers.

23

Selbst, A.D., Boyd, D., Friedler, S.A., Venkatasubramanian, S. and Vertesi, J. (2019) 'Fairness and abstraction in sociotechnical systems', in Proceedings of the Conference on Fairness, Accountability, and Transparency (FAT* '19). New York: ACM, pp. 59–68.

View source
24

Skillsoft (2026) Workforce Readiness Report: AI Edition.

View source
25

Smuha, N.A. (2021) 'From a "race to AI" to a "race to AI regulation": regulatory competition for artificial intelligence', Law, Innovation and Technology, 13(1), pp. 57–84.

View source
26

Srnicek, N. (2017) Platform Capitalism. Cambridge: Polity Press.

View source
27

Suresh, H. and Guttag, J. (2021) 'A framework for understanding sources of harm throughout the machine learning life cycle', in Proceedings of the 2021 ACM Conference on Equity and Access in Algorithms, Mechanisms, and Optimization (EAAMO '21). New York: ACM.

View source
28

UK Government, Department for Science, Innovation and Technology (2025) AI Opportunities Action Plan. London: DSIT, January 2025.

View source
29

UK Parliament (2026) Artificial Intelligence: Impact on Employment. Hansard, House of Lords, April 2026.

View source
30

ValueAdd VC (2026) Big Tech's AI Capex in 2026: Microsoft, Google, Meta, Amazon and the Spending Race.

View source
31

Wachter, S. (2024) 'Limitations and loopholes in the EU AI Act and AI liability directives', Yale Journal of Law & Technology, 26(3), pp. 671–718.

View source
32

West, S.M., Whittaker, M. and Crawford, K. (2019) Discriminating Systems: Gender, Race and Power in AI. New York: AI Now Institute.

View source
33

Yeung, K. (2018) 'Algorithmic regulation: a critical assessment', Regulation & Governance, 12(4), pp. 505–523.

View source

Client and engagement details referenced throughout this publication, via linked case studies, are illustrative composites drawn from patterns observed across multiple anonymised engagements, presented for illustrative purposes; they do not describe a single identifiable client, organisation or matter. Statistics are attributed to their originating source and reflect the populations, methodologies and reporting periods of the respective publications at the time of writing. This publication is provided for general informational purposes, reflects the views of INTAI at the time of publication, and does not constitute legal, financial or regulatory advice.

Scroll