Enterprise AI Part 2

In this week’s Data Diaries, Enterprise AI part 2, we move from measurement discipline to the governance layer that makes that discipline defensible to a regulator. Discipline alone will not satisfy the auditor, and enforcement turned operational.

The Senate killed the proposed 10-year state-AI moratorium on July 1, 2025, which retired “wait for Washington” as a strategy. State legislatures filled the gap.

California’s AB 2013 takes effect January 1, 2026, and SB 942’s operative date moved to August 2, 2026 after Governor Newsom signed AB 853 on October 13, 2025. Texas TRAIGA reaches up to $200,000 per uncurable violation and $2,000 to $40,000 per day for continuing violations. Illinois HB 3773 treats AI-driven employment discrimination — zip-code proxies included — as a civil rights violation.

The EU AI Act stacks on top: General-Purpose AI obligations have applied since August 2, 2025, the fines turn on August 2, 2026, and penalties climb to €35M or 7% of turnover for prohibited practices, €15M or 3% for most violations, and €7.5M or 1% for misleading information. Judge Alsup preliminarily approved Bartz v. Anthropic on September 25, 2025 — roughly $1.5 billion across 465,000-500,000 pirated works at $3,000 per book, with final approval landing May 14, 2026. The SEC’s Presto Automation order on January 14, 2025 cemented Section 17(a)(2) for AI-washing cases.

So what does this mean? Every one of those laws assumes a real human-in-the-loop, and human-in-the-loop may become one of the biggest governance illusions in enterprise AI. Modern AI systems do not just generate answers anymore; they increasingly classify risk, which means the system you govern also decides when governance should begin.

If your harness lets the model self-escalate, and your reviewer rubber-stamps the escalation, and your audit log only captures what the model chose to log, then you do not have oversight — you have theater. Would it be acceptable to have a junior employee who does not have a manager, who does not report to anyone? Absolutely hard pass no. And yet most enterprises ship agentic systems that do exactly that, right?

The Bartz outcome shows the cost runs operational. Unlicensed training data became a balance-sheet item overnight, and your indemnity clause now decides whether your vendor or your CFO eats the next one.

Now what should you do this quarter? Treat every agent like a junior employee with a manager, checkpoints, and reporting lines. If you run an agency, build ISO-aligned governance documentation as a service line. Your mid-market and enterprise clients need that dossier, and most of them cannot produce it themselves.

Mid-market leaders should push governance through procurement. Rewrite RFPs to require model cards, training-data provenance, structured logging, and customer audit rights, and wire the same requirements into your renewal cycle so the next contract closes the gap before a regulator opens it.

At the enterprise level, stand up the AI Council with a named owner, a documented escalation path, and a regulator-ready dossier that maps every production agent to a human accountable for its outputs. Appoint a Chief AI Officer if you have not, give the role budget authority, and connect it to legal, security, and the business units that ship the agents.

Wire structured logging into a database the agent updates in near real time, then audit those logs the way you audit a junior employee’s work product. My CEO and co-founder Katie Robbert says, and is correct in saying, that new technology does not solve old problems. The old problem here is familiar: a worker without a manager.

The new problem is that this worker runs 24/7 at machine speed, so the failure mode compounds in hours, not quarters. Real governance comes from good processes, treating machines like junior employees, and strong mechanisms for reporting and clear outcomes.

Next week, we walk the data-boundary layer that makes any of this auditable — where your training data and prompts actually live, and who else sees them.

Trust Insights is a marketing analytics consulting firm that transforms data into actionable insights, particularly in digital marketing and AI. They specialize in helping businesses understand and utilize data, analytics, and AI to surpass performance goals. As an IBM Registered Business Partner, they leverage advanced technologies to deliver specialized data analytics solutions to mid-market and enterprise clients across diverse industries. Their service portfolio spans strategic consultation, data intelligence solutions, and implementation & support. Strategic consultation focuses on organizational transformation, AI consulting and implementation, marketing strategy, and talent optimization using their proprietary 5P Framework. Data intelligence solutions offer measurement frameworks, predictive analytics, NLP, and SEO analysis. Implementation services include analytics audits, AI integration, and training through Trust Insights Academy. Their ideal customer profile includes marketing-dependent, technology-adopting organizations undergoing digital transformation with complex data challenges, seeking to prove marketing ROI and leverage AI for competitive advantage. Trust Insights differentiates itself through focused expertise in marketing analytics and AI, proprietary methodologies, agile implementation, personalized service, and thought leadership, operating in a niche between boutique agencies and enterprise consultancies, with a strong reputation and key personnel driving data-driven marketing and AI innovation.