Treasury and the Fed just convened bank CEOs over a single AI model.

The question most boards are still asking is "which AI vendor should we standardize on — OpenAI, Anthropic, Google, or someone else." The question regulators are now asking is a different one. It has to do with what happens when the AI system underneath a regulated workflow changes — quietly, unilaterally, or under stress — and whether the institution using it can reconstruct the decisions it has already made.

Those are not the same question. A vendor-selection answer will not satisfy a regulator-posed one.

Three events, one pattern.

Consider what has happened in the last thirty days inside the AI industry. Not speculation, not forecasts — reported events, each independently verifiable.

These are not equivalent events. The first is a safety-motivated withhold. The second is a regulatory signal. The third is an infrastructure constraint expressed as an undisclosed change in model behavior. What they share is a single, uncomfortable property: every one of them happened to a customer who had standardized on a vendor.

Why vendor selection misses the point.

A board that has "standardized on Anthropic" or "standardized on OpenAI" or "standardized on Gemini" has made an operational choice that feels like a governance posture but is not one. Consider what the decision actually covers: the vendor's capabilities today, the vendor's pricing today, the vendor's terms of service today.

What it does not cover: the vendor quietly changing model effort to manage cost. The vendor withholding a class of model capability that was previously in roadmap. The vendor's compute-capacity curve diverging from peers in a way that turns into availability risk. The vendor becoming the subject of an emergency briefing by the US Treasury Department. All four of those events happened in the last five weeks.

None of them are failures of the vendor. In fact, the safety withhold and the compute discipline are both arguably responsible choices. But they are choices the customer does not control, cannot anticipate, and in most current deployments cannot even detect in real time.

That is the governance gap. It is not a vendor-quality problem. It is an architecture problem.

Questions for a board that wants to be defensible.

If the March–April sequence were isolated, it would be noise. It is not isolated. The pattern describes the actual conditions under which regulated AI deployments now operate — and it is the pattern, not any single event, that boards need a posture on. Three questions are worth putting on the agenda before the next meeting.

If the honest answer to any of these is "not cleanly," the governance gap is not theoretical. It is already priced into the risk posture of the institution, whether leadership has acknowledged it or not.

Infrastructure, not policy.

The temptation when governance gaps surface is to write a policy. Policies are useful and insufficient. The shift that regulators are signaling — and that serious operators inside banks, insurers, and critical-infrastructure operators are already moving toward — is from documentation to continuous execution-time assurance.

Practically, that means three things the organization must be able to do at the moment a decision is made, not after the fact. Bind the provenance of every AI-assisted decision to the inputs, the model state, the retrieval context, and the human authority that approved it — as a structured artifact, not a log line. Gate the authority so that decisions which exceed defined risk thresholds cannot be executed by an automated path without a named human in the loop. Detect the drift so that changes in model behavior — whether announced or silent — surface as operational signals before they surface as regulatory problems.

None of that replaces the model. The model is the reasoning engine. The governance layer is the infrastructure that makes what the model produces defensible inside a regulated environment. The two are separable by design, which is precisely the property that survives a compute-constrained vendor, a safety-withheld model, or a Treasury briefing.