The substance curve: why governance looks complete before it works

A conceptual model, version 0.1. It describes a shape, not a dataset. Nothing here is a plot of collected data and it should not be read as one. Figures cited below are other people’s measurements, given with sample size and sponsor so you can weigh them. The closing section sets out what would have to be gathered to test whether the shape is real.

Two measures of the same thing

The available evidence on AI governance measures whether an artefact exists. Almost none of it measures whether the artefact does anything, and the few figures that come close are the interesting ones.

• IBM Institute for Business Value, June 2026, with Oxford Economics, surveying 2,000 C-level technology executives across 33 countries and 19 industries: 77 per cent report AI adoption outpacing their governance capabilities, two-thirds report being held accountable for AI systems they do not fully control, and 11 per cent believe they are ready for the scale of agent deployment they expect by 2027. Respondents recorded an average of 54 agent incidents in the preceding year.
• The same study found that organisations embedding control directly into AI systems experienced 25 per cent fewer incidents than those relying on manual governance processes. That is the closest thing in the public evidence base to a measurement of the distinction this model rests on.
• Grant Thornton, 2026 AI Impact Survey: 78 per cent of business executives lack strong confidence that they could pass an independent AI governance audit within ninety days.
• Credo AI, State of AI Governance 2026, surveying 371 senior leaders: 60 per cent of organisations deploying AI across multiple departments, against 4 per cent governing it at scale. Worth reading as a vendor-sponsored survey, since the sponsor sells governance software.

Assurance practice separated these decades ago. Design effectiveness asks whether a control could work. Operating effectiveness asks whether it did work, over a period, on the real population. The distinction is not new, and that is the point of using it: an audit committee already knows what it means.

The trap in measuring it

The obvious approach is a survey. Ask a team to rate what is documented, ask it to rate what is practised, and subtract. It is cheap, it scales immediately, and it measures nothing.

Asking one respondent both questions measures the same opinion twice. The difference is a measure of candour rather than of governance, and it inverts: teams willing to report a large gap are usually the ones paying closest attention, so the instrument would flatter the careless and punish the honest. Where the object of measurement is the distance between perception and reality, perception cannot be the only instrument.

So the model rests on three evidence sources kept apart and never substituted for one another.

• Claimed. What the organisation believes to be true of itself. Gathered by self-assessment. Fails through over-claiming under evaluation.
• Documented. That an artefact exists which satisfies the level descriptor and covers the population. Gathered by artefact review against a named, dated, version-controlled document. Fails when the artefact exists and is inert.
• Demonstrated. That the control altered an outcome at the point of action. Gathered from delivery telemetry across an observation window. Fails when the telemetry is incomplete or the control is gamed to satisfy the measure.

The curve plots the second and the third. The distance between them is the substance gap, and it is the only one of the available comparisons that needs evidence nobody is currently collecting.

The shape

Documented governance is cheap. A policy can be written in a fortnight, and it climbs steeply and plateaus near the top of the scale. Demonstrated governance is expensive, because it requires behaviour to change at the point of action, so it stays flat long after the documentation is complete and only climbs late.

Plotted against time since agents entered production delivery, the two lines diverge, reach a maximum separation, and then either converge or do not. Five phases, each with a signature you could look for rather than an impression you could form.

1. Unwritten. Both low. Agents are in production and no artefact names them. Merge records carry no origin field at all.
2. The paper surge. Documented climbs hard. Policy, framework and board reassurance land inside a quarter. Attribution fields appear and carry the same default value on most records.
3. Peak divergence. The widest gap. Review approval rate at or near a hundred per cent, review duration showing no relationship to the size of the change under review, zero recorded constraint violations and no evaluation events either.
4. The reckoning. An incident, an audit finding, a regulator, or the first honest measurement. Documentation does not fall. Confidence in it does.
5. The fork. Two branches, covered below.

The fork is the point

A hype cycle asserts that everything eventually reaches the plateau. This model does not, because the more common response to being caught is to write another policy.

On the convergence branch, demonstrated governance climbs to meet documented. Enforcement events start appearing in the record. The rate of changes amended or rejected at review rises above zero. Declared scope narrows, so that out-of-scope work becomes visible rather than impossible. It is slow and expensive and it is the only real destination.

On the entrenchment branch, control count rises, enforcement events stay at zero, and the gap widens rather than closes. Documentation reaches the top of the scale while practice sits near the bottom. A trajectory model where everybody arrives is a sales curve rather than an argument, so this branch is drawn as prominently as the other.

Why this needs the whole population

Assurance samples because evidence has historically been costly to gather. Common non-statistical guidance tests a handful of instances per control, with the number driven by control frequency, risk and tolerable deviation rate.

The weakness is arithmetic rather than a matter of opinion. For a population of N control instances containing a single failure, a sample of n missing that failure has probability (N − n) / N. A control firing on 250 working days, tested 30 times, gives 220/250, so an 88 per cent chance of missing one failure. Move to 365 instances and it is 92 per cent. At 1,000 instances it is 97 per cent. The figure is not a finding and needs no citation, but it is meaningless without stating N.

Agent-assisted delivery emits a complete machine-readable record, which removes the constraint that made sampling necessary. The model assumes measurement across every case in the window rather than a sample of it.

Why this is not a hype cycle

The hype cycle is the obvious comparison and a useful one, because its weaknesses are documented and avoidable. Dedehayir and Steinert, writing in Technological Forecasting and Social Change in 2016, sought evidence for hype cycles in Gartner’s own technology databases and reported incongruences with Gartner’s published trajectories. Steinert and Leifer went further, applying Popper’s falsification logic and arguing that the model’s general approach may be rejected where contrary data can be observed. The recurring criticisms are a dependent variable nobody can operationally define, no mathematical formulation, and a pattern asserted rather than measured.

Both axes here are defined by things already being measured, on the same five-level scale: artefact review on one line, and on the other a set of falsification tests computed from delivery records. A position on the curve is therefore a claim someone can check and dispute on evidence, rather than a matter of taste. That principle is the same one behind the test bench, moved up a layer: a control that has never been attacked is a record of intent, and a trajectory that cannot be contradicted is a picture.

Others are arriving at the same place

This is not a lone observation and should not be presented as one. Grant Thornton has named the same distance the AI proof gap, reporting that most executives cannot show how AI decisions are made or who is accountable for the outcome. Others working in AI governance are making a closely related argument, that a policy is not a control and that the count of frameworks in an organisation says nothing about what happens at the point of action. The observation is becoming common ground.

What remains uncommon is an instrument. Naming a gap is not the same as measuring one, and the work that matters now is the descriptors, the tests and the reliability figures rather than the observation itself.

What would falsify it

Honesty section, kept current. The model makes two claims: that documented governance rises faster than demonstrated governance, and that the gap widens before it closes. It is wrong if, across a cohort measured over time, demonstrated scores rise at or above the rate of documented scores, or if the gap does not widen at all during early adoption.

Settling that needs longitudinal data: the same organisations measured on both series across at least three annual cycles. None of it exists yet. There is no tested level descriptor behind this, no measured inter-rater reliability figure, and no line of real telemetry. Until there is, this is a model of how the failure works, offered to be argued with. The moment it appears with a data citation underneath it, it will have to have earned one.

Figures verified against the originating publication rather than secondary coverage, on 28 July 2026. Figures that could only be traced to aggregator sites have been removed rather than attributed.