The vendors are building the receipt: what your board should read in the first audited AI risk-factor section

Picture a risk committee on a Sunday call — a real time slot, because the people who sit on these boards in the Gulf and in North America are increasingly on opposite sides of the same weekend. The construction that follows is illustrative; it is assembled from patterns, not a report of any real meeting, institution, or deployment.

The head of the agentic-AI program has fifteen minutes and a good deck. The pilot works. A claims-triage chain, a reconciliation chain, a servicing chain — each running against a frontier model behind an enterprise agreement, each showing a cost line that makes the CFO lean forward. The last slide is the ask: move three of these to production this quarter, expand the contract, name a frontier provider as strategic.

The audit committee chair, who has read a few hundred prospectuses in a long career, asks one question, and it is not about the model.

The company behind this — the one we are about to make strategic — is reportedly weeks away from filing to go public. When it files, its risk-factor section becomes the first thing this counterparty has ever written about itself under securities-law liability. Before we make it strategic, I would like to read what its own lawyers make it disclose. Can we hold the expansion until we have read both documents side by side — the pitch, and the risk factors?

That is the whole memo. Everything below is why that instinct is correct, what the second document will say that the first one cannot, and the question the board has to answer for itself because no supervisor is going to answer it for them.

THE OPERATOR'S MAP · Chapter: The AI Boardroom · Episode 1. This article is the first episode of a weekly series for the people who have to run AI rather than admire it — five chapters, one per domain, advancing together each week: agent controls (Ship AI), the open-source stack (Sovereign Stack), governance (The AI Boardroom), evaluation (Beyond the Benchmark), physical AI (Twin & Machine). This chapter teaches AI governance. Every technical idea is restated in plain terms as it arrives.

Terms that matter this episode

• Registration statement / risk factors — the disclosure document a company files before selling shares publicly; its risk section is drafted to be complete about what can go wrong, because omissions carry liability.
• Warranty — what a vendor contractually stands behind. In AI contracts, model behavior is almost never warranted.
• Concentration risk — the exposure created when many critical processes depend on one supplier.
• Model risk — the risk that a model is wrong, misused, or behaves differently than assumed; banks have had formal rules for it for over a decade.
• Frontier provider — one of the handful of companies training the most capable AI models.
• Second line of defense — the risk function that independently checks the business; independence is its entire value.

What an S-1 discloses that a vendor pitch is built to hide

Start with the genre difference, because it is the part boards routinely underweight. A pitch deck and a registration statement describe the same company and are written to do opposite jobs.

A pitch is a selling document. Its author is incentivized to state the upside and to leave the failure modes as an exercise for the buyer. Nothing in it is attested; nobody is personally liable if it turns out to be optimistic. A registration statement — an S-1 in the United States, and its equivalents elsewhere — is the inverse. Its risk-factor section is drafted by securities counsel whose professional exposure runs the other way: a material risk left undisclosed is not a marketing miss, it is a basis for liability. The document is engineered to be complete about what can go wrong, because completeness is the defense. The financial statements behind it are audited. The signatures on it carry personal accountability.

This is why the coming wave of frontier-lab filings matters to a board that will never buy a share of the stock. It is the first time enterprise-AI risk gets described by the seller, under legal compulsion to be complete about it. Every governance deck you have been handed for two years has been the pitch. The risk-factor section is the first version written by someone whose job is to enumerate the downside.

Consider what a frontier lab's risk factors will, on any plausible drafting, have to concede. Concentration of revenue and of compute — dependence on a small number of hyperscale providers for the infrastructure the models run on. Accumulated losses at a scale that has no precedent in enterprise software: the figure reported for one lab's 2025 net loss is on the order of forty-two billion dollars, and the reported preliminary second-quarter 2026 revenue of eleven and a half billion dollars sits against that — both figures single-source and self-reported as of this writing, not audited numbers you have seen in a filed statement, which is precisely the point of waiting for the filing. Model behavior that is, in the drafters' own defensive language, novel, rapidly evolving, and not fully predictable. Litigation and intellectual-property exposure on the training data. Safety and security incidents, disclosed because non-disclosure is the actionable path.

There is a way to read that section that a director should insist on, because the section has a grammar and the grammar is the disclosure. Risk factors are written in a hedged, conditional voice — "we may be unable to," "there can be no assurance that," "our models may produce outputs that." Boards trained on marketing prose tend to discount that grammar as lawyerly reflex. Read it the other way. Every "we may be unable to" is a capability the vendor has specifically declined to warrant, chosen from an infinite set of things it could have warranted and did not. The absence of a warranty is the signal. When the pitch deck says "enterprise-grade reliability" and the risk factors say "our models may generate inaccurate, biased, or harmful outputs and we may be unable to prevent or correct such outputs," those are not two moods of the same claim. They are the marketing department and the general counsel disagreeing in public, and the general counsel is the one under oath. A director's job is to read the disagreement and price it.

The other document in the filing worth a director's time is the discussion of how the business is run and financed — where the concentration of compute suppliers, the customer concentration, and the loss trajectory are laid out as operating facts rather than as risks. Risk factors tell you what the vendor will not stand behind; the operating discussion tells you how fragile the machine producing your critical workflow actually is. A board that reads only the headline valuation has read the least informative number in the document.

Hold that last cluster against something you have already been told to rely on. The revised interagency model risk management guidance of 17 April 2026 — Fed SR 26-2 and OCC Bulletin 2026-13, issued jointly by the Federal Reserve, the FDIC, and the OCC — puts generative and agentic AI outside its scope on the ground that these models are "novel and rapidly evolving." When the vendor's own securities counsel reaches for language to describe the reliability of the same product, they will land somewhere structurally identical: novel, evolving, not warranted to behave. The supervisor and the seller are going to describe the same property in the same terms, from opposite motives — the supervisor to defer specifying controls, the seller to disclaim reliance. A board that reads those two sentences next to each other has found the exact seam it is being asked to build across.

The concentration question underneath

Read the risk-factor section for what it discloses, and you are still only halfway. The harder question is the one the disclosure implies rather than states, and it is the question a board is uniquely placed to ask because it is the only body in the institution that sees the whole dependency at once.

The question: how much of your critical workflow now depends on one — or a very small number of — frontier providers, and who provides the independent check on that dependency?

The first half of that question is now on the supervisory radar in its own right. Moody's, in a baseline note dated 10 August 2026, framed vendor concentration in AI as a systemic dependency — the observation that when many institutions route their critical processes through the same handful of providers, the failure of one provider stops being an idiosyncratic operational risk and becomes a correlated, system-level one. That is a rating agency describing your agentic-AI supply chain in the vocabulary it usually reserves for interbank exposure. Boards should read it as permission to ask the concentration question out loud, because someone whose job is to price risk has already asked it.

The second half is where it gets uncomfortable, and it is the part almost no board deck surfaces. The tooling that would let you verify your frontier provider — the evaluation and observability layer, the machinery that produces the numbers you would use to hold the model to account — is consolidating into the same companies whose models it exists to check.

Count it from the record rather than from impression. A synthesis published 20 August 2026 tallied eight evaluation-and-observability acquisitions in fourteen months — the assurance layer being bought, piece by piece, by the model labs and hyperscalers themselves. Cite the count from that synthesis; several individual deals in the tally are separately verifiable and at least one attribution in it is not, so a board that wants to name a specific transaction should confirm that transaction on its own before relying on it. The synthesis's own finding is the sharper one for your purposes: the overwhelming majority of these acquisitions bought observability — the ability to record what an agent did — while a large minority of enterprises remained blocked on quality, the ability to determine whether what the agent did was correct. Its one-line thesis is worth reading into the minutes verbatim: observability records what happened, not whether it was right, and nobody owns agent-behavior validation.

Put the two halves together and the concentration risk has a shape most boards have not drawn. It is not only that your workflow depends on a few providers. It is that the layer you would use to independently check those providers is being absorbed into those providers. If your model comes from one corporate parent and your model-assurance tooling comes from the same parent, the independence of the check is a fiction, and independence of the check is the entire reason the second line of defense exists in your own institution. You would never let the desk that books the trades also own the system that reconciles them. The AI supply chain is quietly arranging exactly that, and it is arranging it through acquisition, one assurance vendor at a time.

There is a concrete way for a board to turn this from an unease into a measurement, and it is worth putting into the risk committee's standing agenda rather than leaving to a one-off review. Ask for four numbers.

1. The share of the institution's critical or customer-affecting workflows that terminate, at any hop, in a single frontier provider — the correlated-failure exposure Moody's is describing, sized for your own estate.
2. The substitutability of each such dependency: for how many of those workflows is there a tested fallback to a different provider or to an open-weight model that could carry the load, and how quickly.
3. The provenance of your assurance stack — which of the evaluation, observability, and validation tools you rely on to check the models are owned, directly or through a parent, by a company whose models you are checking.
4. Whether the record your own agents produce would let you answer the accountability question — which agent took an action, under whose authority — without reconstructing it after the fact from logs that were never built to carry authority.

Those four numbers are the concentration position, and unlike the valuation on the front of the prospectus, they are numbers only the institution can produce about itself. A board that has them can govern the dependency. A board that has only the vendor's deck is governing the pitch.

Who supervises what you have bought

A board director's next reflex is the correct one: if this is a systemic dependency with a compromised independent check, who supervises it? The honest answer, market by market, is that the supervisor has deferred, and the deferral is not an exemption — it is an obligation handed back to you.

In the United States, the interagency model risk guidance did not merely put agentic AI out of scope. Footnote 3 of the shared guidance — the same joint document behind Fed SR 26-2 and OCC Bulletin 2026-13 — returns the determination of appropriate governance and controls for out-of-scope systems to the banking organization itself. The framework that would have specified the controls was withdrawn; the responsibility for having controls was left exactly where it was. And the promised next step — a request for information that would begin consulting on an AI-specific framework — had, on a Federal Register check re-run on 24 August 2026, still not been published. That is a dated, checkable observation, and its consequence runs against the comfortable reading: the specification is further away than "guidance is coming" suggests, which lengthens the period in which each institution is deciding for itself.

The rest of the map rhymes. Colorado's first-in-the-nation comprehensive AI act was repealed and narrowed before it ever took effect, so a board should strike it from any live control narrative that still cites it. The NAIC's model examination instrument for insurers was renamed at its August 2026 summer meeting to the AI Risk Evaluation Supplement, with a public comment window opening in September — a cadence, not yet a binding standard. In India, the Reserve Bank issued a consolidated rulebook on 31 July 2026 that repealed hundreds of older circulars, and the flagship technology-risk directions in it do not mention AI at all; the AI layer lives entirely in an unissued draft. In the Gulf, the picture is quieter still: aside from Qatar's mandatory central-bank AI guideline, the region's supervisors have issued advisory expectations rather than binding control specifications, which leaves a Gulf board with the same self-supervision burden and less cover for it. Across the markets your institution most likely operates in, the supervisor of your AI dependency is, functionally, your own board.

Now set that vacuum against what the vendors are doing inside it, because this is the detail that should most change how a board reads the moment. The labs are supervising themselves ahead of any regulator, and they are publishing the receipts.

The clearest instance landed 18 August 2026, when a frontier lab self-published an operational account of how it is pacing its own development. It described pausing its largest frontier reinforcement-learning run and holding it; a rule that an alert must fire within thirty minutes; and — the line a CFO should not miss — a containment cost priced at roughly twenty percent of the supervised inference compute being monitored, with the caveat that it varies substantially. That is a vendor building a containment control into its own operations that no regulator has required of it, and pricing the control as a line item. Read it the way you would read a counterparty voluntarily posting collateral: it tells you the counterparty believes the risk is real enough to pay for containing it. The board's follow-up question writes itself. Our provider is spending a fifth of its monitored compute to contain a risk it will not warrant away in its filing — is our own control plane anywhere near that maturity, or are we relying on the provider's?

And the market has already noticed the gap and started selling into it. In the same week, two independent governance control planes launched — one out of India on 21 August and one out of the UK on 22 August, each an authority-and-provability layer that sits in the agent's execution path and issues a verifiable record of what each agent was permitted to do. Their customers are all self-reported and neither has disclosed a production reference, so treat the launches as market signal rather than proof of adoption. But the signal is unambiguous, and the founder of one of them put the board's own problem more crisply than most board decks do: enterprises cannot move agents to production because they cannot prove what an agent was allowed to do. Provability has become the ticket to production, and vendors are now selling the ticket. A note for the minutes: where these vendors use the phrase "kill switch," that is their marketing, not a regulatory requirement — no supervisor in your markets mandates one, and the term should not be laundered into a control obligation it is not.

So the board sits in a precise position. The supervisor has deferred and handed you the obligation. The provider is voluntarily building — and pricing — the very containment its filing will decline to warrant. And a market has appeared to sell you the accountability layer, which means the gap is now real enough to have a price. The one thing none of those three parties will do is own the accountability for you. Whether you build the evidence layer or buy the receipt, the signature at the bottom of the control is still yours.

What would make this argument wrong

Four things could break this, and a board is owed them at full strength rather than in the weakened forms that are easy to wave away.

The specific filing may not come, or may not come from the lab now being discussed. The trillion-dollar valuation and the timing are, as of this writing, a single-source report of an ambition, not a priced deal or a filed document — and the ambition should be read as exactly that. If that particular lab does not file, the specific risk-factor section this memo anticipates does not materialize on schedule. But the genre argument does not depend on which lab files first; it activates the moment any frontier provider your institution relies on puts an audited risk-factor section on the public record, and the infrastructure layer of this market has already begun doing so. The board should prepare the reading, not bet on one issuer's calendar.

The risk factors may turn out to be boilerplate. Securities counsel writes to a template, and much of what I have described will arrive in the flat, defensive prose of every technology prospectus. That is a fair objection and it changes less than it appears to. Even boilerplate names the dependencies — the compute concentration, the accumulated losses, the behavior it will not warrant — because omitting them is the actionable path. The concentration question does not need the S-1 to be eloquent. It needs the S-1 to exist, so that the disclosure is attested rather than pitched.

The supervisor may fill the vacuum sooner than the record suggests. The interagency request for information could publish, the consultation could run, and a framework specifying exactly these controls could arrive. In that world, a board that built the evidence layer early merely built it early — which is the cheapest of all the ways to be wrong, because the cost of building early is a design constraint absorbed while the estate is small, and the cost of building late is retrofitting attribution into workflows already in production.

The strongest objection cuts the concentration thesis directly, and it deserves the last word here. A large enterprise reported on 20 August 2026 that it had cut its coding-model costs by fifty-six percent for a roughly two-percent quality decline by routing most queries to open-weight models and reserving a frontier model for the hard ones — a live, in-production demonstration that you can route away from a single frontier provider and blunt the concentration risk directly (the figures are self-reported). If that is repeatable, the dependency is a choice, not a fate, and this whole memo overstates the trap.

Except that the escape route runs straight back through the layer whose independence is in question. You cannot responsibly publish "fifty-six percent cheaper for two percent worse" without an evaluation harness that measures the two percent — and the evaluation harness is exactly the assurance layer that the fourteen-month acquisition wave has been consolidating into the providers. The way out of concentration is real, and it is gated by the one capability the market is busy absorbing into the incumbents. A board that wants the escape route has to own, or independently source, the measurement that makes it safe. Which returns the argument to where it started: the accountability is yours, and the evidence layer that discharges it is the thing you cannot let your provider also own.

The board move this quarter

None of this argues that the institution should slow its agentic-AI program. The programs are where the operating leverage is, and the concentration risk is a reason to instrument the dependency, not to abandon it. The move is narrower and it is a governance move, which is why it belongs to the board rather than to the build team.

Task risk and counsel to read the counterparty's own attested risk-factor language the moment it reaches the public record — as the primary source on what the vendor will and will not stand behind, read against the pitch that has been driving the expansion. Map the concentration on both faces: which frontier providers your critical workflows depend on, and whether the assurance tooling you rely on to check them shares a corporate parent with them. And decide build-versus-buy on the evidence layer with the one fact held steady — that whichever you choose, the accountability for what your agents did, on whose authority, and whether you can prove it, does not transfer with the contract.

The vendors are building the receipt because they have understood something their filings are about to make explicit: in a market where the supervisor has deferred and the seller will not warrant the product, the only durable asset is the record that survives the question. That record is the product now. The board's job is to make sure the institution owns its own copy.

What to ask your team

Questions to carry into your next AI review. None requires a technical background; all of them have answers your team either holds or does not.

1. Has anyone here read an AI vendor's contractual warranty language next to the deck that sold the deployment — and reported the gap upward?
2. What share of our customer-affecting workflows terminate, at any hop, in a single AI provider?
3. Have we ever actually run our fallback — not planned it, run it — and timed how fast it carries the load?
4. Which of our AI evaluation and monitoring tools are owned, directly or through a parent, by companies whose models they check?
5. If our primary provider doubled prices next quarter, what happens to the unit economics of everything we automated this year?

The series

This is Episode 1 of The Operator's Map. Next week, this chapter teaches how an AI examination actually runs — what the supervisor asks first. The other four chapters advance the same day — the hub at /series holds the map.