Everyone's buying governance training. I keep wondering who's going to do the work.

Credit where it's genuinely due: AI governance has had a very good eighteen months. The EU AI Act moved from abstraction to enforceable obligation, PDPA conversations matured, and boards are being told, correctly, that AI accountability sits with them rather than with whoever bought the software licence. Training demand followed, and I should declare upfront that I've benefited from the wave directly. I teach governance frameworks and AIGP preparation. This is not a piece arguing against my own syllabus, however much the next few paragraphs may sound like one.

What the wave is quietly obscuring is a pattern I keep meeting in organisations I work with: governance maturity sprinting ahead of workforce capability, with the gap between them being mistaken for progress. I've sat in rooms where the AI risk register was genuinely sophisticated, classified systems, assigned owners, review cadences, the lot, while the average staff member in the same organisation could not reliably write a prompt that produced a usable first draft, never mind judge whether the output was safe to act on. The compliance framework was more advanced than the ability of anyone downstream to execute against it. A checklist nobody can carry out isn't governance. It's documentation of an aspiration, filed neatly.

I've stopped thinking of this inversion as anyone's laziness, though, and that concession took me a while. Look at the incentives from a leader's chair. Governance is bought in tidy units, certifications, frameworks, registers, and it produces artefacts a board can hold and inspect, in a risk language boards already speak. It is, bluntly, easy to buy and easy to show. Workforce capability is the opposite on every axis: slow, spread across hundreds of people, awkward to measure, and it produces no single artefact for a board pack, because its evidence is a thousand small behaviour changes nobody photographs. Given a fixed budget and a board asking "what are we doing about AI," which line item would you fund first? Most leaders answer the way the incentives point. Sitting in their chair, I suspect I'd have answered the same way, which is an awkward thing to admit while trying to sell you the other half.

Governance

Easy to buy, easy to show

• Bought in tidy units: certifications, frameworks, registers
• Produces an artefact a board can hold and inspect
• Speaks the risk language boards already speak

Capability

Slow, and awkward to measure

• Spread across hundreds of people
• Produces no single artefact for a board pack
• Its evidence is a thousand small behaviour changes nobody photographs

But the inversion has a cost, and it's a nastier one than mere waste. Governance frameworks quietly assume a workforce that can implement controls: staff who recognise when an output needs human review, who know what data can't go where, who can tell a model's confident answer from a correct one. Without those skills, the controls exist on paper and fail in practice, and that is the most dangerous configuration available, because the organisation believes it's protected precisely because the paperwork says so. Meanwhile the value side suffers just as much, since the productivity gains that justified the AI budget in the first place only ever arrive through capable daily use, not through risk registers, however elegant.

Both halves matter, and I want to be unambiguous about that, since I teach both and would rather not be quoted against myself. But if you forced me to bet on which gap costs a typical organisation more over the next two years, the governance gap or the capability gap, it isn't the governance one. That wave is already correcting itself. Nobody's wave is correcting the other.

If you take one thing: a sophisticated risk register plus an untrained workforce equals false confidence, filed in triplicate. Fund the capability half before the paperwork convinces you it isn't needed.