Field Guide
06
Market and trends
4 min read · Chapter 6 of 10
Who holds the power
- Examiners and sector regulators hold the most power over banks, insurers and lenders, and it's shifting. US bank supervisors narrowed their guidance and made it unenforceable, while Canada's widened it to AI across banks and insurers, and the EU accepts bank governance for most AI Act duties.
- Courts in discovery and class certification have the most practical power over companies using AI in decisions about people, because they force disclosure of how a model was designed and tested: Workday, UnitedHealth, Cigna, Humana.
- State attorneys general are the most active US enforcers on AI decisions: Massachusetts against Earnest, Texas against Pieces Technologies, and AG-only enforcement in the Colorado, Connecticut and Texas statutes.
- Enterprise buyers' procurement teams hold the most day-to-day power over B2B AI vendors. Their questionnaires and AI addenda decide deals faster than any law, and they increasingly ask for certificates.
- Labs and clouds hold the clock: retirement dates, aliases that move silently, weights and training data they won't share. A deployer can negotiate notice and evidence.
- The governance team holds the approval pen, and its power depends on what US bank guidance calls "organizational standing and influence to effect any change". Where it's slow, the business routes around it.
- Security teams own the discovery telemetry and so hold the real list of shadow AI, while governance owns the register. I'd expect turf fights.
- Certification bodies and analysts decide what a certificate means and who makes the shortlist, and insurers are starting to set terms of their own.
US federal agencies lost power over disparate impact in 2025-2026, and the EU gained it on paper from August 2026, with high-risk enforcement still more than a year away.
Tailwinds and headwinds
These are the forces I'd expect anyone in AI governance to watch over the next couple of years, and each one helps some players and hurts others. The suites that already hold a budget line come out ahead on most of them, and the reasons to spend are moving from compliance deadlines toward customers and boards.
Tailwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| Companies are moving AI agents into production, nearly half of larger ones already in one 2026 survey, and each agent needs an owner, limits and a record. | ServiceNow, IBM and Microsoft, which hold the register and the workflow; security vendors with agent identity and runtime controls (Palo Alto Networks, Cisco, SentinelOne, Check Point); AWS and Google, which meter guardrails per call | Governance specialists without runtime data (Credo AI, Holistic AI, Saidot); registers built around models instead of use cases and agents |
| Enterprise customers ask every AI vendor for proof, and a certificate is becoming a condition of the sale. | Vanta and Drata; accredited certification bodies (Schellman, BSI); AI vendors that certify early | AI startups without evidence, whose deals slow down; standalone governance platforms, since vendors buy compliance automation instead |
| Courts and state laws now reach decisions about people and the vendors that score them, and in June 2026 a court held Workday can be directly liable for its screening tools. | Bias auditors and assurance firms (Holistic AI, the Big Four); platforms with rule packs for state laws (OneTrust, Truyo, Credo AI); HR and lending vendors that can show their testing | HR, lending and tenant-screening vendors (Workday, Eightfold, SafeRent); employers and lenders deciding in many states |
| Boards and investors expect AI oversight, and 83% of the S&P 500 named AI as a risk in their 2025 filings. | Suites that produce board reporting (ServiceNow, IBM, OneTrust, AuditBoard, Diligent); Big Four assurance (PwC, Deloitte, KPMG) | Companies whose disclosures promise more control than they have |
| The EU's transparency duties apply now, and Canada's model risk rule for banks and insurers and the EU's high-risk duties both arrive in 2027. | Suites with EU rule packs (OneTrust, IBM, SAP); EU specialists such as Saidot; the Big Four; bank model risk vendors in Canada (SAS, ValidMind) | Providers of high-risk systems for hiring and credit, which carry the conformity work; deployers with EU customers |
Headwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| US federal agencies stepped back from AI rules, and Washington is pushing to override state AI laws, though as far as I know none had been overridden by early October 2026. | Model providers, which face fewer rules on how models are built; suites that sell to boards instead of deadlines | Bank model risk vendors selling generative AI validation (SAS, ValidMind); bias auditors; specialists selling on US compliance |
| Buyers get AI governance inside platforms they already pay for, and Gartner sizes the dedicated category at under half a billion dollars in 2026. | ServiceNow, IBM, Microsoft, OneTrust, SAP, AuditBoard; AWS and Google for runtime controls | Independent specialists (Credo AI, Holistic AI, Monitaur, Airia, Saidot, Truyo), which become acquisition targets; buyers at renewal once the register sits inside a suite |
| The EU pushed its high-risk deadline to December 2027 and extended lighter rules to mid-sized companies. | Providers and deployers, which get time and lower costs; suites that sell on board risk instead of deadlines | EU-focused specialists such as Saidot; consultancies and the Big Four, which sold readiness for 2026; certification bodies' near-term demand |
| The median security budget didn't grow at all in 2026, and AI governance often has no budget line or single owner of its own. | Suites that already hold a budget line (ServiceNow in IT, OneTrust in privacy, AuditBoard in audit, Microsoft in its bundles) | Standalone platforms that need a new line; security vendors' governance upsell when the money sits in IT |
| AI is starting to draft the questionnaire answers and evidence that services charge for, and allegations that one compliance startup sold near-identical audit reports raise doubts about cheap certificates. | Compliance automation with accredited audit partners (Vanta, Drata); accredited bodies (Schellman, BSI); buyers | Questionnaire services and consultants billing by the hour; low-cost certification sellers |
The one thing I'd watch is whether the suites start pricing per agent, because that's where agents in production would turn into governance revenue.