Back to the book

Reference

Source notes & references

Govern or Fail relies on public cases, regulatory records, company disclosures, published research, and cited standards. The notes below list the sources referenced in the book, with enough detail to locate and verify each one. Where evidence is vendor-sponsored or regionally scoped, that is stated so it can be weighed accordingly.

  1. [1]

    MIT Project NANDA, The GenAI Divide: State of AI in Business 2025, July 2025. The report states that despite $30–40 billion in enterprise GenAI investment, 95 percent of organisations are getting zero return, while 5 percent of integrated pilots extract measurable P&L value. It is based on a review of over 300 public AI initiatives, interviews with 52 organisations, and survey responses from 153 senior leaders.

  2. [2]

    RAND Corporation. Ryseff, J., De Bruhl, B. F., and Newberry, S. J. (2024), The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed: Avoiding the Anti-Patterns of AI, RAND Corporation, RR-A2680-1. The study is based on structured interviews with 65 data scientists and engineers, each with at least five years of experience building AI and machine learning models. The report finds that more than 80 percent of AI projects fail, roughly twice the failure rate of non-AI IT projects. A 2025 briefing update — Ryseff, J., and Narayanan, A., Why AI Projects Fail, RAND PT-A2680-1 — extends the original analysis.

  3. [3]

    Boston Consulting Group (2025), The Widening AI Value Gap: Build for the Future 2025, September 2025. Survey of more than 1,250 senior executives and AI decision-makers across nine industries and 25+ sectors. AI maturity is assessed across 41 foundational capability dimensions. The study finds 5 percent of companies qualifying as "future-built" (creating substantial AI value at scale), 35 percent as "scalers", and 60 percent as "laggards" with minimal revenue and cost gains.

  4. [4]

    McKinsey & Company / QuantumBlack, The State of AI in 2025: Agents, Innovation, and Transformation, November 2025. The survey reports 88 percent regular AI use in at least one business function and roughly one-third scaling at enterprise level. Survey conducted 25 June to 29 July 2025, n=1,993 respondents across 105 countries.

  5. [5]

    McKinsey & Company / QuantumBlack, The State of AI in 2025. The survey reports that 23 percent of respondents are scaling an agentic AI system somewhere in the enterprise and an additional 39 percent are experimenting with AI agents. It also notes that agent use is not yet widespread and is typically concentrated in one or two business functions rather than scaled across the enterprise.

  6. [6]

    Boston Consulting Group, The Widening AI Value Gap: Build for the Future 2025. The report documents that agentic AI accounted for approximately 17 percent of total AI value generated in 2025 and projects this share to reach approximately 29 percent by 2028. The report also notes uneven adoption: future-built companies allocate roughly 15 percent of AI budgets to agents, with significantly higher adoption rates than scalers or laggards.

  7. [7]

    Dataiku / Harris Poll, Global AI Confessions Report: CEO Edition 2026. The survey reports 62 percent board pressure to deliver measurable AI-driven outcomes and 80 percent of CEOs saying their role would be at risk if AI fails to deliver measurable business gains by the end of 2026. n=900 CEOs, fielded February to March 2026. Treat as vendor-sponsored survey evidence, not neutral academic evidence.

  8. [8]

    Dataiku / Harris Poll, Global AI Confessions Report: CEO Edition 2026. The report states that 96 percent of CEOs believe employees are using generative AI tools without approval, and 42 percent estimate that more than half their workforce is doing so.

  9. [9]

    Hochschule Luzern (HSLU) and ti&m, AI Maturity Study 2026: Wie setzen Schweizer Unternehmen KI um?, February 2026. The study assesses Swiss organisations across two dimensions, Strategy & Vision and Business Execution, grouping them into archetypes: AI Followers, AI Visionaries, AI Practitioners, and AI Leaders, with many clustered as Visionaries or Followers. Use as a regional mirror, not a global claim.

  10. [10]

    McKinsey & Company / QuantumBlack, The State of AI in 2025. The report identifies AI high performers as respondents attributing more than 5 percent EBIT impact and significant value to AI, and associates high performance with workflow redesign, KPI tracking, data infrastructure, and senior leadership ownership.

  11. [11]

    MIT Project NANDA, The GenAI Divide. The report identifies a learning gap: many GenAI systems do not retain feedback, adapt to context, or improve over time, which limits transition from pilot to durable value.

  12. [12]

    Volkswagen Cariad operating losses and launch delays. Cariad's segment operating losses are documented in Volkswagen AG annual reporting: FY 2022 operating loss approximately €2.1 billion, FY 2023 approximately €2.4 billion, with continued losses reported in FY 2024 results. Cumulative figures are derivable from those filings. Sources: Volkswagen AG, Annual Report 2022; Volkswagen AG, Annual Report 2023; Reuters, "Cariad unit sees 2.1 billion euros operating loss in 2022" (March 2023). Launch delays affecting the Porsche Macan Electric and Audi Q6 e-tron, attributed to Cariad software-development problems, are documented in Reuters, "Volkswagen plans job cuts, further launch delays at Cariad" (October 2023), and contemporaneous trade-press coverage of the Volkswagen Group's software programme between 2022 and 2024. Cariad restructuring announced in 2025 (approximately 1,600 role reductions) was reported by Handelsblatt in March 2025 based on Volkswagen confirmation; earlier 2023 restructuring plans of approximately 2,000 roles were reported by Manager Magazin and Reuters.

  13. [13]

    Arup deepfake-enabled fraud (Hong Kong, 2024). A Hong Kong finance employee at Arup transferred HK$200 million, approximately US$25.6 million, across 15 transfers to 5 accounts after a video call in which the other participants appeared and sounded like recognised colleagues but were later identified as deepfakes. The fraud was discovered through subsequent verification within the organisation. Sources: Arup public statement (May 2024); Hong Kong Police Force investigation reporting; CNN Business, "Arup revealed as victim of $25 million deepfake scam" (May 2024); World Economic Forum, "Cybercrime: Lessons learned from a $25m deepfake attack" (February 2025). This book frames the incident strictly as deepfake-enabled social engineering and verification failure, not as an autonomous AI incident. Stronger characterisations (such as every participant being a deepfake avatar) appear in some secondary retellings and are not adopted here.

  14. [14]

    Stanford Institute for Human-Centered Artificial Intelligence (HAI) (2025), Artificial Intelligence Index Report 2025, April 2025, eighth edition. The report cites the AI Incident Database, noting 233 AI-related incidents reported in 2024, a 56.4 percent increase over 2023. The Index aggregates and analyses data across technical performance, economic impact, education, policy, and responsible AI.

  15. [15]

    EU AI Act and related implementation timeline. Regulation (EU) 2024/1689 on harmonised rules on artificial intelligence (the AI Act), published in the Official Journal of the European Union on 12 July 2024. The Regulation entered into force on 1 August 2024. Prohibitions on unacceptable-risk systems applied from 2 February 2025. GPAI model obligations applied from 2 August 2025. The original enforcement date for high-risk system obligations was 2 August 2026. The European Commission's Digital Omnibus on AI (COM(2025) 627 final, published 19 November 2025) proposed to defer those obligations. The Council of the EU and the European Parliament reached provisional political agreement on the package in May 2026, confirmed by Member State representatives on 13 May 2026, with formal adoption and publication in the Official Journal expected before the 2 August 2026 deadline. Under the agreed text, high-risk obligations for standalone Annex III systems are deferred to 2 December 2027 and for product-embedded Annex I systems to 2 August 2028; the package also adds an Article 5 prohibition on AI-generated non-consensual intimate imagery and child sexual abuse material, and postpones the Article 50(2) watermarking obligation to 2 December 2026, while other transparency and deployer obligations continue to apply from 2 August 2026. These amendments take legal effect only on formal adoption and publication; if the package is not adopted before 2 August 2026, the original timeline applies as written. Readers should verify the enacted status at the time of reading. Specialist legal commentary: DLA Piper, Gibson Dunn, Hogan Lovells and similar publishers maintain ongoing coverage of the AI Act implementation track.

  16. [16]

    Moffatt v. Air Canada, 2024 BCCRT 149, British Columbia Civil Resolution Tribunal, decision dated 14 February 2024. The tribunal held Air Canada liable for negligent misrepresentation by its website chatbot regarding bereavement fares and rejected Air Canada's argument that the chatbot was a separate legal entity from the airline. The principle is stated narrowly in this book: under that fact pattern, misinformation from a website chatbot was treated as attributable to the company. Primary source: Civil Resolution Tribunal decision (Moffatt v Air Canada, 2024 BCCRT 149). Secondary coverage: BBC, "Air Canada must honour refund policy invented by its chatbot" (February 2024); Forbes, "What Air Canada Lost In 'Remarkable' Lying AI Chatbot Case" (February 2024); AI Incident Database, Incident 639.

  17. [17]

    MIT Project NANDA, The GenAI Divide. The report distinguishes high consumer/tool adoption from limited enterprise-grade production value, especially where tools lack workflow fit, context retention, or learning.

  18. [18]

    Boston Consulting Group (2025), AI at Work 2025: Momentum Builds, But Gaps Remain, June 2025. Third edition of BCG's annual AI-at-work survey, n=10,635 employees across 11 countries. The report finds that 54 percent of employees say they would use AI tools that have not been authorised by their company, with higher rates among Millennial and Gen Z respondents (approximately 62 percent).

  19. [19]

    MIT Project NANDA, The GenAI Divide. The buyer research highlights priorities including trusted vendors, deep workflow understanding, minimal disruption to current tools, clear data boundaries, ability to improve over time, and flexibility when things change.

  20. [20]

    McKinsey & Company / QuantumBlack, The State of AI in 2025. The report notes agent use is most commonly reported in IT and knowledge management, including service-desk management and deep research use cases.

  21. [21]

    Boston Consulting Group, The Widening AI Value Gap: Build for the Future 2025. The study assesses AI maturity across 41 foundational capability dimensions and identifies 5 percent of companies as "future-built", 35 percent as "scalers", and 60 percent as "laggards" with minimal revenue or cost gains despite substantial investment. See note [3] for full citation.

  22. [22]

    Boston Consulting Group, AI at Work 2025: Momentum Builds, But Gaps Remain. The report finds that 85 percent of executives report increased AI investment in 2025 versus 2024, while only 37 percent can demonstrate clear ROI from those initiatives. See note [18] for full citation.

  23. [23]

    Hochschule Luzern (HSLU) and ti&m, AI Maturity Study 2026. The management summary states that many Swiss organisations currently play more of a "Follower" role than a technological pioneer role, that strategic preparation and operational implementation both show significant need for action, and that current adoption focuses mainly on comparatively simple, low-risk "low-hanging fruit" use cases.

  24. [24]

    MIT Project NANDA, The GenAI Divide: State of AI in Business 2025, July 2025. The report identifies a learning gap: most GenAI systems do not retain feedback, adapt to context, or improve over time. It argues that this gap, rather than model quality alone, limits the transition from pilot activity to durable enterprise value.

  25. [25]

    McKinsey & Company / QuantumBlack, The State of AI in 2025: Agents, Innovation, and Transformation, November 2025. The report identifies AI high performers as respondents attributing more than 5 percent EBIT impact and significant value to AI, and finds that high performers are nearly three times as likely as others to report fundamental workflow redesign. It also finds high performers are more likely to have senior leaders demonstrating ownership and commitment to AI initiatives.

  26. [26]

    Dataiku / Harris Poll, Global AI Confessions Report: CEO Edition 2026. The report frames 2026 as an accountability era and argues that AI ownership is often claimed but not exercised. Treat as vendor-sponsored survey evidence, not neutral academic evidence.

  27. [27]

    MIT Project NANDA, The GenAI Divide. The executive summary reports that 60 percent of organisations evaluated enterprise-grade systems, 20 percent reached pilot stage, and 5 percent reached production; it attributes much of the stall to brittle workflows, lack of contextual learning, and misalignment with day-to-day operations.

  28. [28]

    RAND Corporation. Ryseff, J., De Bruhl, B. F., and Newberry, S. J. (2024), The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed, RAND RR-A2680-1. The report identifies five root causes for AI project failure including problem-definition errors, data inadequacy, and organisational misalignment. See note [2] for full citation.

  29. [29]

    Dataiku / Harris Poll, Global AI Confessions Report: CEO Edition 2026. The report states that CEOs are increasingly concerned about over-investing in the wrong AI vendors and that AI spending is under sharper ROI scrutiny. Treat as directional executive sentiment rather than independent benchmark evidence.

  30. [30]

    MIT Project NANDA, The GenAI Divide. The report's "learning gap" section distinguishes simple task usefulness from mission-critical enterprise use, where systems need memory, contextual adaptation, and iterative improvement.

  31. [31]

    Hochschule Luzern (HSLU) and ti&m, AI Maturity Study 2026. The study's adoption section hypothesises that AI adoption currently focuses across industries on "low-hanging fruit" use cases and that more difficult or riskier use cases are expected after initial successes.

  32. [32]

    McKinsey & Company / QuantumBlack, The State of AI in 2025: Agents, Innovation, and Transformation, November 2025. The report defines AI agents as systems based on foundation models capable of acting in the real world and planning and executing multiple workflow steps. It reports that 23 percent of respondents are scaling an agentic AI system somewhere in the enterprise, with an additional 39 percent experimenting, while noting that agent use is not yet widespread and is often limited to one or two functions.

  33. [33]

    MIT Project NANDA, The GenAI Divide: State of AI in Business 2025, July 2025. The report identifies a learning gap: many systems do not retain feedback, adapt to context, or improve over time, which limits their usefulness in mission-critical enterprise work.

  34. [34]

    Dataiku / Harris Poll, Global AI Confessions Report: CEO Edition 2026. The report describes the tension between AI as a daily operating partner and AI as a system leaders do not yet trust to act independently. Treat as vendor-sponsored survey evidence.

  35. [35]

    McKinsey & Company / QuantumBlack, The State of AI in 2025. The report identifies defined processes for how and when model outputs need human validation as one of the technology practices associated with AI value capture.

  36. [36]

    Model Context Protocol (MCP) and Agent-to-Agent (A2A) protocols. MCP is an open protocol initially proposed by Anthropic for connecting AI models to data sources and tools. A2A is an open protocol for inter-agent communication associated with Google and related contributors. Both moved under Linux Foundation governance in 2025 (MCP via the Agentic AI Foundation; A2A donated by Google) and have seen visible early production adoption, though the landscape continues to evolve. The MIT NANDA GenAI Divide report references MCP and A2A as part of the emerging infrastructure for distributed agent intelligence.

  37. [37]

    MIT Project NANDA, The GenAI Divide. The report attributes many stalled enterprise-grade systems to brittle workflows, lack of contextual learning, and misalignment with day-to-day operations.

  38. [38]

    MIT Project NANDA, The GenAI Divide. The report discusses MCP, A2A, and NANDA as emerging infrastructure for distributed agent intelligence and argues that learning-capable, deeply integrated systems are better positioned to cross the GenAI Divide. Treat this as early-market analysis rather than a settled standards map.

  39. [39]

    ISO/IEC 42001:2023, Artificial intelligence — Management system. International standard published by the International Organization for Standardization in 2023, available at iso.org/standard/81230.html. ISO describes ISO/IEC 42001 as a structured management-system standard for addressing AI risks and opportunities, balancing innovation and governance.

  40. [40]

    National Institute of Standards and Technology. Tabassi, E. (2023), Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. https://doi.org/10.6028/NIST.AI.100-1. The framework organises trustworthy AI risk management into four functions: Govern, Map, Measure, and Manage. NIST describes the framework as voluntary, technology- and sector-agnostic, and notes explicitly that it is "neither a checklist nor an ordered list of steps." Companion publications include NIST AI 600-1 (Generative AI Profile, 2024) and the AI RMF Playbook.

  41. [41]

    Stanford Institute for Human-Centered Artificial Intelligence (HAI), Artificial Intelligence Index Report 2025. The 2025 edition documents a persistent gap between recognition of responsible AI (RAI) risks and substantive action against them across major model developers and enterprises. See note [14] for full citation.

  42. [42]

    EU AI Act implementation, deployer obligations, and post-market monitoring. See note [15] for the full Regulation (EU) 2024/1689 citation and Digital Omnibus status. The Chapter 10 reference covers high-risk-system obligations including logging and record-keeping (Article 12), human oversight (Article 14), technical documentation (Article 11), information provided to deployers (Article 13), and the specific obligations of deployers (Article 26), together with provider post-market monitoring (Article 72).

  43. [43]

    Boston Consulting Group, AI at Work 2025: Momentum Builds, But Gaps Remain. The report finds that 13 percent of organisations have deployed AI agents that are integrated into broader workflows; 56 percent are using agentic AI experimentally, in pilots, or under direct human supervision; 31 percent have not yet implemented AI agents in any form. See note [18] for full citation.

Figures and regulatory timelines reflect the sources available at the time of writing. Vendor-sponsored surveys are labelled as such and should be read as directional rather than independent evidence. Readers are encouraged to verify the current enacted status of any regulation at the time of reading.