Constitutionally Mature AI Governance

May 13, 2026

Constitutionally Mature AI Governance

A Framework for Distinguishing the Form of Responsible AI from Its Substance

A White Paper

Integrating the Mature Constitutional Intelligence (MCI) framework with operational AI governance practice

Executive Summary

Most AI governance documents describe what responsible AI deployment should look like. Few specify how to tell whether a given deployment has actually instantiated those requirements, or has merely produced their form. This gap matters. An organisation can satisfy every published checklist for ethical AI governance — appoint a committee, classify use cases by risk, run audits, train staff, comply with the EU AI Act — while operating in a state this paper calls governance theatre: the structure is present, the substance is not, and the failure becomes visible only under sustained pressure, novel conditions, or trade-offs where governance and capability appear to conflict.

This paper proposes a governance framework that addresses both questions together. It retains the operational machinery that established practice has converged on — risk classification, intake processes, ethics committees, training programmes, incident response, vendor management — and grafts onto it a diagnostic spine drawn from the Mature Constitutional Intelligence (MCI) framework. The result is a governance approach that specifies not only what organisations should do but how to test whether the doing is operative or performative.

Five structural properties run through every section. Together they constitute what this paper means by constitutional maturity in AI governance: an organisation's AI practice must strengthen rather than degrade under stress; distribute decision authority across appropriate scales rather than centralising or fragmenting; ensure that power exercised through AI systems is structurally contestable by those subject to it; produce justifications that would survive examination by all affected parties under conditions of free communicative exchange; and detect and respond to its own deviations in proportion, neither under-firing nor over-firing. These five properties are derived rather than asserted, are individually necessary and jointly sufficient, and each corresponds to an empirically testable mechanism rather than a stated disposition.

Organisations following this framework should expect three outcomes that conventional checklist approaches do not reliably deliver. First, the governance structure becomes detectable as substantive rather than performative, because each requirement is specified at the level of mechanism. Second, the structure remains durable across substrate change — regulatory shifts, new model capabilities, new affected populations — because revision capacity is itself part of the framework. Third, agility is achieved not by reducing oversight but by ensuring oversight is calibrated and contestable, which removes the friction that ungoverned approval cycles produce.

The paper is structured in eight parts. Part I establishes why capability-focused AI governance is structurally insufficient. Part II presents the five constitutional properties and their derivation. Parts III through VI map these properties onto operational governance domains: data and substrate, decision authority and risk classification, accountability and contestation, monitoring and response. Part VII addresses revision — how the framework adapts as conditions change. Part VIII addresses what is owed to parties whose participation in AI systems is structural but who cannot themselves be at the governance table. A checklist and implementation pathway follow.

This paper is not a replacement for compliance documentation under the EU AI Act, GDPR, NIS2, or other applicable regulation. It is the structural framework within which such compliance is most likely to be substantive rather than nominal.

Part I — The Diagnostic Problem

1.1 What current AI governance documents accomplish, and what they do not

Over the past five years a substantial convergence has occurred in published guidance on responsible AI. The EU AI Act, NIST AI Risk Management Framework, OECD AI Principles, ISO/IEC 42001, and a wide range of organisational white papers now share a recognisable core: ethical review committees, risk-tiered classification of use cases, data governance practices grounded in GDPR or equivalent regimes, bias detection tooling, human oversight requirements, incident response protocols, vendor management policies, and tiered training programmes. The convergence is real and is generally an improvement on what preceded it.

What this convergence does not yet do reliably is distinguish substantive governance from governance theatre. An organisation can implement every recommended practice and still be operating a structure in which the practices run procedurally while the outcomes they were meant to protect against occur anyway. Three patterns make this possible:

• Checkbox compliance, in which each requirement is met at the level of documentation but the documentation does not track operational reality.

• Ritual ethics, in which review processes produce justifications that would not survive examination by the affected parties they purport to protect, but which satisfy the procedural requirements for justification to have occurred.

• Approval theatre, in which fast-track governance produces decisions that meet the form of contestation — committees consulted, sign-offs gathered — while contestation has been compressed to a duration in which substantive challenge is impossible.

These patterns are not failures of bad-faith actors implementing good policies. They are what good-faith actors produce when the policies they implement do not specify, at the level of mechanism, what would distinguish their substantive operation from their performative operation. The diagnostic gap is structural, and it is the gap this paper is built to close.

1.2 The capability-substance asymmetry

A second structural problem in current AI governance is the assumption — usually implicit — that more capable AI systems can be made responsible by adding governance layers on top of the capability. This assumption is widespread in practice but is structurally unsound. The reasoning is straightforward.

Governance that operates as an overlay on capability can be set aside under pressure. Under time pressure, competitive pressure, fluency pressure (the pull toward the response that sounds most authoritative regardless of whether it is right), or trade-off pressure (where adhering to governance means producing a less impressive output), overlay governance thins. The capability remains; the governance becomes nominal. This is not hypothetical: it is the mechanism behind a substantial fraction of public AI failures over the past three years, from biased hiring tools to hallucinating customer service systems to autonomous decision-making that exceeded its intended scope.

The implication is uncomfortable but unavoidable. Governance that is structurally adequate cannot be added on top of capability after the fact; it has to be embedded in the architecture of how decisions are made in the first place. This paper takes that implication seriously. The operational machinery it proposes is not an overlay on capability but a structural condition of the operations the organisation performs through AI.

1.3 Why agility and constitutional maturity converge

A common objection to substantive governance is that it slows organisations down. The response, well-developed in recent practitioner literature, is that ethical AI governance properly structured is an enabler of agility rather than a brake on it. This paper accepts that response and sharpens it. Governance enables agility precisely when each governance mechanism is operatively present rather than performatively layered on. Performative governance produces friction (slow approvals, defensive review cycles, low-trust escalation) without producing protection. Operative governance produces protection through structures that are themselves agile (graduated response to deviation, scale-appropriate authority routing, contestation mechanisms that can be invoked quickly because they were specified in advance).

The convergence claim is therefore: substantive governance is faster than performative governance, because performative governance pays the cost of bureaucratic friction without receiving the benefit of structural protection. The framework that follows is designed for both.

Part II — The Five Constitutional Properties

2.1 Why exactly these five

The five properties this paper builds on are drawn from substantial theoretical traditions in social science and political philosophy, each of which has spent decades on a specific aspect of how durable institutions actually work. The properties are: antifragile reflexivity (from Nassim Taleb's work on systems that strengthen under volatility); nested polycentric subsidiarity (from Elinor Ostrom's analysis of how successful commons-governance institutions distribute authority across scales); non-arbitrariness (from Philip Pettit's republican political philosophy on what makes power legitimate versus tyrannical); discursive legitimacy (from Jürgen Habermas's account of how authority is justified through communicative action); and monitoring with graduated response (also from Ostrom's design principles for durable governance institutions).

These five are not assembled from a wishlist. They are joint necessary conditions for what governance must satisfy if its operation is to be durable rather than nominal. The derivation rests on three observations about any organisation deploying AI in the world:

1. The organisation depends on substrates it did not create and cannot fully control — data, regulatory environment, public legitimacy, organisational trust, ecological resources — and these substrates have finite tolerance for being destabilised.

2. The organisation does not operate alone — it inhabits a landscape of other agents, institutions, regulators, affected populations, and AI systems, whose continued existence and variety is itself a resource for resilience, error-correction, and innovation.

3. The organisation depends on the ongoing justifiable acceptance of those affected by its operations — legitimacy is structural, not soft, and it can be lost faster than it can be rebuilt.

From these three observations together with the criterion that governance should make the conditions of the organisation's continued legitimate operation more durable rather than less, the five properties follow as joint necessary conditions. Each addresses a distinct dimension of durability. A governance approach that satisfies four out of five has left one structural dimension of failure unaddressed, and that dimension will, over time, become the vector through which the governance proves inadequate.

2.2 The five properties stated

Property	Operational requirement	What it protects against
Antifragile Reflexivity	The organisation's AI governance cycle must be structured such that stressors — incidents, near-misses, adversarial probing, regulatory challenge — leave it structurally stronger rather than merely intact.	Brittleness. Governance that is robust against expected conditions but degrades or fragments under novel pressure.
Nested Polycentric Subsidiarity	Authority over AI decisions is distributed across multiple centres operating at the smallest scale capable of addressing each class of decision; no single body monopolises constitutional authority over the others.	Centralisation collapse (decisions all flow upward and bottleneck) and fragmentation (no coordination at scales that genuinely require it).
Non-Arbitrariness	Every exercise of power through AI — over employees, customers, applicants, affected populations — must be accompanied by a structurally available contestation mechanism that those subject to it can invoke in practice.	Arbitrary power dressed up as algorithmic decision-making; consultation theatre that meets the form of contestation while making genuine challenge inaccessible.
Discursive Legitimacy	Justifications offered for AI decisions must survive examination under conditions approximating free communicative exchange — inclusion of affected parties, equal voice, freedom from coercion, orientation toward mutual understanding rather than persuasion.	Ritual justification — text that has the shape of explanation but would not survive substantive examination by the parties it purports to address.
Monitoring and Graduated Response	Detection capacity for deviation scales with deviation potential; response magnitude scales proportionally with deviation severity. Neither under-firing (deviations accumulate) nor over-firing (binary catastrophic response) is constitutional.	Both brittleness (small problems trigger system-wide disruption) and complacency (large problems remain undetected because detection is calibrated only for the expected).

2.3 Mechanism versus disposition

The single most consequential commitment of this framework is that each property is specified at the level of mechanism rather than disposition. The difference is the difference between substantive and performative governance.

A disposition is a stated orientation: "we are committed to fairness," "we value transparency," "our AI systems are accountable." Dispositions are valuable as expressions of intent but cannot be tested for operative presence. An organisation can hold a disposition fully while operating in ways the disposition would, if examined substantively, condemn.

A mechanism is an architectural feature that produces or constrains specific behaviour. Non-arbitrariness as a mechanism is not the disposition "we don't dominate people" but the structural availability of contestation: for every exercise of power, there exists an identified, accessible, operatively invocable mechanism through which those subject to the power can challenge it. The mechanism either exists or does not. Its operation can be examined. Its absence can be detected.

Throughout this framework, each governance practice is specified twice: in dispositional terms (which the organisation will recognise from existing policy) and in mechanistic terms (which provides the test for whether the disposition is operatively present). The mechanistic specification is what makes the difference between this framework and governance documents that share its surface vocabulary.

Part III — Data, Substrate, and the Generative Ground

3.1 What current data governance addresses, and what it presupposes

Conventional data governance under GDPR, the EU AI Act's data quality provisions, and ISO/IEC 27001 covers a recognisable set of concerns: lawful basis for processing, data minimisation, retention limits, encryption, role-based access, audit trails, and processor agreements. These are well-developed and this framework does not propose to replace them. What it adds is a structural layer underneath them: the question of whose substrate the organisation's AI operations rest on, what is owed to those parties, and what structural conditions the data substrate must satisfy for downstream governance to have anything to operate on.

Three categories of substrate are typically under-addressed in compliance-focused data governance:

• Training data substrate. The data on which third-party models the organisation uses were trained. The organisation has not collected this data, has limited visibility into its provenance, and inherits its biases, gaps, and contested origins. GDPR-style controls operate on data the organisation directly handles, not on the substrate that determines what the AI it deploys is structurally capable of.

• Operational data substrate. The data flows generated by the AI's operation — logs, embeddings, intermediate outputs, prompts, fine-tuning corpora. These accumulate during operation, often outside the scope of the formal data inventory, and shape the system's behaviour over time.

• Substrate of affected parties. Data about populations the AI's decisions affect, particularly populations not formally party to the deployment — third parties referenced in prompts, populations represented in training data without consent, affected communities downstream of decisions.

3.2 The four substrate conditions

Substantive data governance must satisfy four structural conditions on the data substrate the AI operates from. Each corresponds to one of the five constitutional properties applied to data:

3.2.1 Generative cycling (Antifragile Reflexivity at the data layer)

The organisation's data practices must operate as a cycle that strengthens under stress rather than depleting. Data quality issues, lineage failures, and identified biases should leave the data substrate more capable over time, not progressively degraded by attempts to patch around them. The operational test: examine the trajectory of data quality across audit cycles. A governance failure here looks like an organisation that repeatedly identifies the same classes of data quality problem without the substrate becoming more capable of preventing them.

3.2.2 Distributed data authority (Nested Polycentric Subsidiarity)

Data governance authority is not concentrated in a single data office. Different classes of data decision are routed to the smallest competent scale: line-of-business teams for operational quality, the data office for cross-cutting standards, the ethics committee for affected-party concerns, the executive for substrate-level strategic decisions. The operational test: trace a sample of recent data decisions and identify whether each was made at a scale appropriate to its content, or whether all decisions flow to a single authority that becomes a bottleneck.

3.2.3 Contestability of data inclusion (Non-Arbitrariness)

Parties whose data is included in the AI's operation — directly or through the substrate of third-party models — have structurally available mechanisms to contest their inclusion. This is more demanding than data subject rights under GDPR, because it must address parties whose substrate participation is upstream of any GDPR controllership the organisation holds. Where direct contestation is not available because the substrate is upstream of the organisation's own collection, surrogate mechanisms must be specified: who advocates for the structurally excluded, and what defeat-standing does that surrogate hold?

3.2.4 Discursive justification of data use (Discursive Legitimacy)

The organisation's account of why and how it uses data must be one that would survive examination by all affected parties under conditions of free communicative exchange. The test is harder than the GDPR transparency requirement: it asks not whether the organisation has published a privacy notice, but whether the published notice would survive substantive examination by an adequately informed and unconstrained group of affected parties. Most organisational privacy notices, examined substantively, do not survive this test — they are addressed to regulators rather than to the parties the data describes.

3.3 Operational machinery

Translating the four conditions into operational governance produces a recognisable but sharpened version of established practice:

• Data lineage maps that trace every data flow back to its substrate, including substrate the organisation does not directly control (third-party model training corpora, public datasets, scraped sources).

• Substrate impact statements for new AI deployments, specifying which substrates the deployment will operate on, what is owed to parties represented in each, and what contestation or surrogate mechanisms are available.

• Distributed data stewardship roles at each scale of the organisation, with defined authority boundaries and explicit contestation rights across boundaries — not a single Chief Data Officer collecting all authority.

• Substantive transparency documentation, drafted to survive examination by affected parties rather than to satisfy regulatory templates, with regular substantive review (not just legal sign-off).

• Standard encryption, access control, retention, and lifecycle practices under existing regulation — these remain necessary but are not sufficient on their own.

Part IV — Authority, Scale, and Risk Classification

4.1 The risk classification problem

Risk-tiered classification of AI use cases — typically along a Green/Amber/Red or minimal/limited/high-risk/prohibited gradient — has become the dominant operational tool in AI governance. The approach is sound but commonly under-specified. Two problems recur.

The first is that risk is treated as a property of the use case rather than as a property of the use case together with the substrate it operates on and the population it affects. The same AI capability — say, automated decision-support — can be low-risk in one substrate and high-risk in another. Classification systems that classify the technology rather than the technology-in-context produce systematic errors in both directions: they over-restrict use cases that are low-risk in their actual deployment context, and they under-restrict use cases that are high-risk in context but appear low-risk in the abstract.

The second is that classification systems usually do not specify which scale of authority owns which class of decision. A use case classified as Amber-tier may require ethics committee review, but if every Amber-tier decision is escalated to the same committee, the committee becomes a bottleneck, escalation becomes nominal, and decisions either stall or get rubber-stamped to clear backlog. Both failures undermine the classification system's purpose.

4.2 Subsidiarity-grounded classification

A constitutionally adequate classification system has two structural features beyond the risk tier:

4. It classifies the use case in its substrate, not in the abstract. The classification is generated by examining the use case together with the populations, data substrates, and decision domains it will operate in, and is re-examined when any of these change.

5. It routes each class of decision to the smallest competent scale of authority and specifies the structural contestation rights of other scales over that authority. The point is not that low-risk decisions stay with the team and high-risk decisions go to the committee; it is that every scale of authority is constitutionally embedded in a structure that includes its own contestability.

The four-tier model below is one practical instantiation. The substantive commitments are the classification logic and the authority-routing rules, not the specific number of tiers.

Tier	Substrate-in-context criteria	Authority routing	Contestation rights
Green	Low-stakes, reversible decisions with no significant power exercised over identifiable parties; substrate is operational and within organisational control.	Owned by the deploying team. Standard line management oversight.	Any team can flag for re-classification; documented review path to Amber.
Amber	Decisions affecting identifiable parties (employees, customers, applicants) where pursuit exercises modest, contestable power; substrate is operational but touches third parties.	Owned by AI Use Case Owner; ethics review at deployment and on substantive change; standing right of review for affected-party representative.	Affected parties have specified contestation mechanism; ethics committee can require re-classification to Red.
Red	High-stakes, low-reversibility decisions exercising significant power over identifiable parties or affecting populations with limited capacity to contest; substrate includes parties without direct voice.	Owned at executive level; ethics committee review with affected-party representation; provisional adoption with elevated monitoring.	Affected parties (or surrogates with defeat-standing) can prevent deployment; deployment is reversible by design.
Prohibited	Use cases that cannot be made constitutionally adequate in any substrate the organisation operates in — including EU AI Act prohibited practices and use cases that would fail one or more constitutional property categorically.	Not deployed. Documented determination required.	Standing for any party to invoke prohibition determination; reversal of prohibition requires the same authority that initially determined it.

4.3 The Use Case Owner role, sharpened

The AI Use Case Owner role, common in current governance literature, becomes substantively meaningful only when it carries authority that matches its responsibility. In many organisations the role is named but the authority is fragmented across functions, with the owner serving as coordinator rather than as the locus of decision authority. This produces predictable failures: when decisions are required quickly, the owner cannot act; when accountability is required afterward, the owner cannot be held accountable because the actual decisions were made elsewhere.

A constitutionally adequate Use Case Owner role has three structural features:

• Scale-matched authority. The owner has decision authority over use cases within their assigned scale, with documented escalation triggers for decisions that exceed it. Authority and responsibility are not separated.

• Structural contestability. The owner's decisions are contestable by specified parties — affected populations, the ethics committee, peer Use Case Owners on cross-cutting decisions — through mechanisms specified in advance, not invented under pressure.

• Substantive accountability. The owner is accountable for both the operational outcomes and the constitutional adequacy of the decisions, with documented review against both.

4.4 The Ethics Committee, sharpened

Ethics committees fail in two characteristic ways. They become rubber stamps when their workload exceeds their capacity for substantive review, or they become bottlenecks when their authority is invoked too broadly. Both failures are addressable through structural design rather than through exhortation to do better.

Three structural commitments produce ethics committees that operate substantively:

6. Composition that includes affected-party representation with defeat-standing, not just consultation status. If every committee member is an employee of the organisation, the committee cannot satisfy Discursive Legitimacy regardless of how diverse its expertise — its discourse is internal to a single perspective.

7. Scope discipline that routes decisions to the committee only when the decision genuinely requires committee-scale authority. Decisions that should sit with the Use Case Owner do not benefit from committee review; they benefit from owners with authority to decide and contestability of their decisions.

8. Public reasoning. The committee's substantive determinations on Red-tier and significant Amber-tier decisions are documented in language that would survive examination by the affected parties. Internal-language determinations that never face the discursive test do not satisfy the legitimacy requirement.

Part V — Accountability and Contestation

5.1 Non-arbitrariness as the substantive accountability principle

Most current AI governance documents treat accountability as a procedural requirement: someone must be designated as responsible, decisions must be logged, audit trails must exist. These are necessary but they do not capture what accountability is structurally for. Accountability serves the constitutional purpose of ensuring that power exercised through AI is non-arbitrary — that those subject to the power can contest it through structures they have access to. Logs and designations matter to the extent they support that contestation, not as ends in themselves.

Three operational consequences follow:

• Audit trails must be examinable by affected parties, not only by internal audit and regulators. Internal accountability that bypasses the parties subject to the power is not, in the constitutional sense, accountability at all — it is internal review with regulatory disclosure.

• Designated responsibility must carry the authority and resources to act on contestation. A designated Use Case Owner who cannot, in practice, halt or modify the deployment they own holds accountability in name without substance.

• Contestation mechanisms must be structurally available to those who hold the right to contest. Mechanisms requiring legal representation, technical expertise, or time commitments that exclude most affected parties fail this test even when they are documented and procedurally present.

5.2 The contestation gradient

Different parties subject to AI-mediated decisions require different contestation mechanisms calibrated to their position. A practical gradient:

Party	Contestation mechanism	Structural availability check
Internal user (employee)	Direct challenge process; documented response within bounded time; escalation to ethics committee on unresolved.	Mechanism accessible without manager approval; response time published; outcomes audited for pattern.
Customer or applicant subject to AI decision	Right to human review; right to explanation that meets discursive standard; right to challenge through identified channel.	Mechanism findable without legal advice; available in plain language; outcomes reviewable for substantive (not just procedural) response.
Affected third party (not directly transacting)	Surrogate representation on ethics committee; identified advocacy path; standing to invoke re-classification.	Surrogate is independent of the deploying function; has defeat-standing not just consultation; is resourced to operate.
Public/regulator	Substantive transparency reporting; documented determinations on Red-tier and significant Amber-tier cases; standing to invoke regulatory review.	Reporting written in language that supports examination, not just compliance; documented determinations are public on significant cases.

5.3 The substantive accountability test

The diagnostic question that distinguishes substantive accountability from procedural accountability is straightforward: take a recent AI-mediated decision that one of the parties above might have wanted to contest. Trace what would actually happen if they tried. If the path is documented but practically inaccessible, the accountability structure is performative. If the path is accessible and produces a substantive response within a reasonable time, the structure is operative.

This test should be run periodically as part of governance review, not only when contestation actually occurs. Organisations that wait to discover contestation friction until a party invokes it have lost the opportunity to identify the structural failure in advance.

Part VI — Monitoring, Calibration, and Graduated Response

6.1 The proportionality problem

Monitoring AI systems for deviation from intended behaviour is universally recommended and inconsistently implemented. The two characteristic failure modes are opposite and equally damaging.

Under-firing monitoring detects only large, obvious deviations. Small accumulated deviations — model drift, gradually expanding scope creep, slowly degrading performance on minority subpopulations — pass undetected until they become large. By the time the monitor fires, the deviation has become structural and is difficult to address through normal correction.

Over-firing monitoring fires on every variation, including normal operational noise. The responses are either catastrophic (full system rollback for minor issues) or get gradually ignored (alerts becoming background noise that operators stop responding to). The system loses calibration in the other direction.

Neither failure is solved by better tools alone. Both are solved by a calibration discipline that matches detection sensitivity to deviation potential and response magnitude to deviation severity. This is the operational form of the Monitoring and Graduated Response property.

6.2 Calibration architecture

A constitutionally adequate monitoring system has four structural features:

9. Stratified detection. Different classes of potential deviation are monitored at different sensitivities, calibrated to their potential consequences. Operational noise (latency, throughput) is monitored differently from substantive deviation (fairness, accuracy across subpopulations) which is monitored differently from constitutional deviation (use case scope creep, contestation pattern shifts).

10. Graduated response curve. Detected deviation triggers responses proportional to severity, specified in advance. Small deviations trigger operational correction; medium deviations trigger Use Case Owner review; large deviations trigger ethics committee review; structural deviations trigger re-classification or deployment suspension. The graduation is what prevents both under-firing (everything tolerated) and over-firing (everything escalated).

11. Pattern detection. Single deviations are reviewed in operational context; recurring patterns trigger re-examination of the underlying classification or specification. A monitoring system that flags the same issue repeatedly without the structural cause being addressed is producing alerts without producing learning.

12. Self-monitoring of the monitor. The monitoring system itself is examined for over- and under-firing, with adjustments made through graduated review rather than through ad-hoc tuning. A monitor that escapes its own calibration discipline is the deepest form of monitoring failure.

6.3 Incident response, restated

Incident response in this framework is the operational expression of graduated response at the high end of the deviation spectrum. The principles standard in current practice — clear escalation paths, defined responsibilities, regulatory notification protocols, post-incident review — remain valid. What this framework adds is calibration to the constitutional properties:

• Response severity is proportional to substrate impact, not only to operational impact. An AI failure that operationally is minor but affects parties with limited capacity to absorb the consequences is calibrated to the substrate effect, not the operational scale.

• Notification to affected parties is on the same timeline as notification to regulators, not subordinated to it. The constitutional commitment to discursive legitimacy means affected parties learn what happened from the organisation, not from regulatory filings.

• Post-incident review addresses constitutional cause, not only operational cause. If the failure was caused by a substantive gap in one of the five properties, the review identifies the gap and the response addresses it structurally. Operational patches that leave the constitutional gap in place produce repeat failures.

• Lessons learned feed back into the governance framework, not only into operational practice. The framework's revision capacity (Part VII) is invoked when incidents reveal that the framework's specifications need updating.

Part VII — Revision, Drift, and the Framework's Own Adaptation

7.1 Why static governance fails

Every governance framework presented at a moment in time becomes, over time, less adequate to the conditions it operates in. AI capabilities change, regulatory requirements evolve, the populations affected by AI systems shift, and the substrates the organisation depends on change in ways no fixed framework anticipates. A framework that cannot revise its own specifications becomes, over years, a framework that nominally addresses governance while operationally addressing a previous era.

The opposite failure is equally damaging. Frameworks that revise too readily — under pressure from any stakeholder, in response to any new fashion in AI governance discourse — lose the structural commitments that made them constitutional in the first place. Each revision is locally plausible; the cumulative trajectory is drift.

Substantive governance must be revisable and the revision must itself be constitutional. This is the most demanding requirement in the framework and the one most often absent from current practice. Few governance documents specify how they themselves should be updated.

7.2 The four revision triggers

Revision of the governance framework should be triggered by specific structural conditions, not by general dissatisfaction or by external pressure alone. Four triggers correspond to substrate changes that one or more of the five constitutional properties may no longer be adequately addressing:

• Substrate drift. The environment, regulatory regime, affected populations, or operational scale has changed enough that what the constitutional properties require structurally is no longer what the current framework specifies.

• Recurrent monitoring failure. The monitoring system is detecting the same class of deviation repeatedly without graduated response reducing the rate. This indicates the framework's specification is mis-calibrated, not that the organisation is becoming undisciplined.

• Contestation saturation. Affected parties' contestation has moved from challenging specific applications to challenging the framework itself. The discursive legitimacy of the framework, not its application, is what is being contested.

• Antifragile capture. Stress that should be strengthening the governance system is degrading it. Incidents that should produce structural improvement are producing only operational patches. The framework's reflexive cycle is no longer operative.

Each trigger is testable. Each corresponds to one of the five constitutional properties reporting that its current specification is no longer adequate. Revision in the absence of any trigger is unlikely to be constitutional; revision in response to a trigger should follow a structured process.

7.3 The revision process

Substantive revision proceeds through six stages, each governed by one of the constitutional properties:

13. Trigger verification. Confirm that the triggering condition reflects a substrate pattern, not an isolated event or external pressure. Single incidents do not justify framework revision; patterns do.

14. Substrate diagnosis. Identify specifically what has changed and which of the five constitutional properties is no longer adequately tracking it. Diagnosis without specificity produces revision without grounding.

15. Candidate generation. Generate multiple alternative revisions — never proceed to evaluation with a single candidate. Single-candidate revision is structurally indistinguishable from confirmation of a predetermined direction.

16. Contestation. Each candidate revision is examined against the five properties to confirm that the post-revision framework would itself remain constitutional. Revisions that drift the framework toward configurations the properties would no longer admit are rejected at this stage.

17. Justification. The chosen revision is justified in terms that would survive examination by all affected parties — including the parties whose contestation triggered the revision. Internal justification is not sufficient.

18. Adoption with reversion path. The revision is adopted, with the previous specification preserved as a reversion path. Revisions that prove inadequate can be reverted without requiring a further full revision cycle. High-stakes revisions adopt provisionally with elevated monitoring; low-stakes revisions adopt with standard calibration.

This revision process is itself part of the framework and is itself subject to revision through the same process. The recursion is intentional. A framework that exempted its own revision process from constitutional examination would have produced a structure that the properties no longer constrain.

Part VIII — Stewardship: What Is Owed Beyond the Governance Table

8.1 The categorical gap

Every governance framework, including this one, operates among parties who have constitutional standing — the organisation, its employees, its customers, its regulators, the populations whose contestation rights have been specified. These are the constituted parties. The framework speaks to them and is spoken to by them.

There are also inhabitants of the substrate the AI operates on whose participation is structural but whose constitutional standing is not available. Populations whose data trained the models the organisation deploys, often without knowledge or consent, and frequently with no meaningful capacity to withdraw. Workers — typically low-wage, often in the Global South — who labelled the training data and whose labour conditions shaped what the AI counts as acceptable output. The ecological substrate consumed by training and inference, including the energy, water, and material resources that constitute AI's physical footprint. Future parties whose interests are affected by decisions made now but who cannot be at the present table.

These parties cannot be made participants in the governance structure in the same way constituted parties can. The asymmetry is categorical, not contingent. A framework that addresses only constituted parties is not for that reason unjust to non-constituted parties — but it does owe them something specifiable, and the framework must specify what.

8.2 The four stewardship duties

Four duties correspond to the five constitutional properties applied across the asymmetry between constituted and non-constituted parties. The fifth property (graduated response monitoring) is folded into asymmetric reversibility bias, producing four duties rather than five.

8.2.1 Substrate care

The organisation's AI operations must, on net, leave the substrates they depend on more capable of supporting subsequent operations rather than less. This is more demanding than "do not harm" — it requires that interaction with the substrate be itself generative for it. Operationally: track substrate trajectory over time. Training data substrates that are repeatedly extracted from without contribution back fail this duty. Energy substrates whose consumption exceeds organisational contribution to the systems that produce them fail this duty. Labour substrates whose conditions are not improved by the organisation's participation in them fail this duty.

8.2.2 Scale-appropriate restraint

Where the organisation could expand the reach of its AI operations beyond what the substrate genuinely requires — because capability permits, because competitive pressure encourages, because the affected populations cannot contest — it should not. Scale restraint is the asymmetric form of subsidiarity that applies when only one party can decide. Operationally: each AI deployment specifies the scope its substrate genuinely requires, and expansion beyond that scope requires its own justification process.

8.2.3 Non-imposition with surrogate voice

Where parties affected by AI operations cannot themselves contest, the organisation must refrain from exercising power that would not survive examination by surrogate voice with structural defeat-standing. This is the most demanding of the four duties and the most often performed in form without substance. Operationally: for each Red-tier and significant Amber-tier deployment, identify the non-constituted parties affected, identify surrogate representation, and confirm that the surrogate holds defeat-standing rather than consultation status. Consultation that cannot prevent the deployment is not adequate to the duty.

8.2.4 Asymmetric reversibility bias

Where uncertainty exists about effects on non-constituted parties, the organisation biases toward reversible operations over irreversible ones. This is more demanding than the symmetric monitoring that applies among constituted parties because non-constituted parties cannot themselves invoke reversion if the operation proves inadequate. Operationally: for choices between operations with similar expected outcomes but different reversibility profiles, the more reversible operation is preferred when effects on non-constituted parties are uncertain, with documented justification when the preference is overridden.

8.3 Why stewardship is not optional

Two considerations make stewardship a constitutional requirement rather than a discretionary commitment.

The first is structural. The five constitutional properties were derived from the conditions under which the organisation's continued legitimate operation remains durable. Substrates the organisation depends on but does not address — through stewardship — eventually fail in ways that affect operations. An organisation whose AI rests on labour substrates it does not steward will, over time, lose access to those substrates as the labour conditions become publicly known. An organisation whose AI rests on ecological substrates it does not steward will, over time, face the costs of substrate degradation. Stewardship is therefore not separate from durability but is one of its conditions.

The second is direct. The non-constituted parties exist, the harms to them are real, and the asymmetry that puts them outside the governance structure does not absolve the organisation of the harms its operations produce. A framework that addresses only what is contestable by parties at the table is a framework that has used its own scope to limit its accountability. This is not a framework that satisfies discursive legitimacy substantively.

Part IX — Implementation Pathway

9.1 Sequenced adoption

Organisations adopting this framework should not attempt all parts simultaneously. The five constitutional properties are jointly necessary but their operational implementation can be sequenced. A workable sequence:

19. Establish the diagnostic discipline. Before implementing any new operational practice, conduct a substantive review of existing AI governance against the five properties. Identify where current practice is dispositional rather than mechanistic, and where the operational machinery is procedurally present but substantively absent. This review is itself the first instance of antifragile reflexivity in action.

20. Implement substantive risk classification (Part IV). Substrate-in-context classification with scale-matched authority routing is the highest-leverage early intervention because it shapes how every subsequent decision is made.

21. Substantive contestation mechanisms (Part V). For each tier of the classification system, specify and test the contestation mechanisms available to each category of affected party. The test of structural availability, not the documentation of nominal availability, is the operative requirement.

22. Calibrated monitoring (Part VI). Re-engineer existing monitoring to satisfy the four structural features. This typically reveals significant gaps in current practice without requiring new tools.

23. Revision capacity (Part VII). Specify the revision process before it is needed. Organisations that wait until revision is triggered to design the revision process produce revisions that are themselves not constitutional.

24. Stewardship duties (Part VIII). The most demanding and the most easily deferred. Implementing the four duties typically requires substantive change to procurement, data sourcing, and deployment scoping that organisations should expect to take time.

9.2 Common implementation failures

Four failure patterns recur in early adoption and should be anticipated:

• Translation back to checklist. The framework's properties get re-expressed as items on a compliance checklist, with the mechanistic specifications dropped. This produces a more elaborate version of governance theatre. The protection: require that each checklist item include the mechanism test, not only the dispositional commitment.

• Centralisation through implementation. Implementing the framework gets centralised in a single function (Chief AI Officer, ethics committee, data office), which collapses the polycentric authority distribution the framework requires. The protection: implementation authority itself is distributed, with each function owning the implementation in their scale.

• Substantive review reduced to procedural review. Ethics committee determinations, contestation responses, and monitoring reviews get standardised to the point where they no longer engage substantively with the cases before them. The protection: periodic substantive audit of the reviews themselves, examining whether they would survive examination by affected parties.

• Revision avoidance. The revision process gets designed but is not invoked when triggers fire, because revision is treated as exceptional rather than as routine constitutional maintenance. The protection: scheduled review against the four triggers, with documentation of why each trigger has or has not been met.

9.3 The implementation checklist

The checklist below operationalises the framework's commitments. Each item is paired with a mechanism test that distinguishes substantive implementation from performative implementation.

Diagnostic discipline

• All five constitutional properties are reviewed annually against current practice. Test: the review produces specific, documented findings of gap, not a general assertion of alignment.

• Each governance practice is specified in both dispositional and mechanistic terms. Test: for each practice, the mechanism by which it would be tested for operative presence is documented and reviewed.

Risk classification (Part IV)

• Classifications are made in substrate-in-context, not for technology in the abstract. Test: classification documentation specifies the populations, data substrates, and decision domains for each case.

• Authority is routed to the smallest competent scale, with contestation rights from other scales specified. Test: trace a sample of recent decisions; confirm each was decided at the documented scale.

• Use Case Owners hold authority matched to responsibility. Test: identify decisions the owner formally owns; confirm the owner has actual authority to take them.

• Ethics committees include affected-party representation with defeat-standing. Test: at least one committee determination in the past twelve months substantively rejected a deployment proposal.

Contestation (Part V)

• Each category of affected party has a specified contestation mechanism. Test: a party in each category could find and invoke the mechanism without legal or technical advice.

• Contestation produces substantive response, not only procedural acknowledgement. Test: examine a sample of recent contestations; identify what changed as a result.

• Surrogate voice for non-constituted parties holds defeat-standing. Test: identify deployments in the past twelve months that surrogate voice could have prevented; confirm the surrogate had the structural authority to do so.

Monitoring (Part VI)

• Detection sensitivity is calibrated to deviation potential, not uniform across deployments. Test: high-stakes deployments are monitored at higher sensitivity than low-stakes deployments, with documented calibration.

• Response is graduated, with proportional escalation specified in advance. Test: examine recent deviation responses; confirm escalation matched severity.

• Pattern detection identifies structural causes, not only individual incidents. Test: recurring deviations have triggered structural review, not only repeated operational correction.

• The monitor itself is monitored for over- and under-firing. Test: monitoring system has been adjusted in the past twelve months based on calibration review.

Revision (Part VII)

• The four revision triggers are reviewed periodically. Test: documentation exists of the most recent review against each trigger.

• Revisions follow the six-stage process. Test: any framework revision in the past twelve months has documentation at each of the six stages.

• Revision adoptions preserve reversion paths. Test: for any adopted revision, the previous specification remains structurally available.

Stewardship (Part VIII)

• Substrate trajectory is tracked for each substrate the organisation's AI depends on. Test: documented assessment exists for data, energy, and labour substrates.

• Scope restraint is documented for each deployment, not only at framework level. Test: each deployment's scope justification includes what the substrate requires, not only what the capability permits.

• Surrogate voice for non-constituted parties is operatively present. Test: identify decisions in the past twelve months that addressed effects on non-constituted parties; confirm surrogate input shaped the decisions.

• Reversibility bias is applied to uncertain effects on non-constituted parties. Test: for a sample of recent deployment choices, the more reversible option was chosen where effects on non-constituted parties were uncertain, with documented justification when overridden.

Conclusion

This paper has proposed a governance framework for AI that combines the operational machinery established practice has converged on with a diagnostic discipline that distinguishes substantive governance from governance theatre. The five constitutional properties — antifragile reflexivity, nested polycentric subsidiarity, non-arbitrariness, discursive legitimacy, and monitoring with graduated response — are derived from the conditions under which AI deployment can remain durably legitimate. They are individually necessary and jointly sufficient. Each is specified at the level of mechanism, not disposition, which makes the framework testable for operative presence rather than only for procedural compliance.

The framework's central claim is that responsible AI governance is not an overlay that can be added to capability after the fact. It is a structural condition of the operations through which the organisation makes decisions affecting the parties whose acceptance its continued legitimate operation depends on. Performative governance is not a milder form of substantive governance; it is its opposite, in the same way that the form of an institution and the substance of an institution can diverge to the point where they are no longer related.

The framework is more demanding than current practice in two specific ways. It requires that governance mechanisms be testable for substantive operation, not only documented for procedural presence. And it requires that the framework itself be revisable through a process that is constitutional rather than ad hoc, because static governance becomes inadequate to changing substrates regardless of how well it was specified at adoption.

The framework is also more enabling than current practice in two specific ways. It produces agility through structural protection rather than through reduced oversight, eliminating the friction that performative governance generates without producing the benefit such governance was meant to provide. And it produces durability through revision capacity, allowing the organisation to adapt as conditions change without losing the constitutional commitments that made it adequate to begin with.

Adoption is not all-or-nothing. The framework's components can be implemented sequentially, with each providing leverage on the next. The diagnostic discipline — examining existing practice for the form-substance gap — is the highest-leverage first step, requiring no new operational machinery but producing the clarity that subsequent steps depend on.

The framework will itself prove inadequate to conditions it did not anticipate. This is not a defect to be designed around but a feature to be planned for. The revision capacity specified in Part VII is what allows this framework to remain constitutional as the conditions under which AI operates continue to change. The framework's specifications are closed; its application is open. That asymmetry is where the framework's work happens.

Appendix — Mapping to Established Frameworks

This framework is designed to complement rather than replace existing AI governance regimes. The table below maps the framework's five constitutional properties onto the principal regulatory and standards frameworks practitioners are already working within.

Property	EU AI Act	NIST AI RMF	ISO/IEC 42001
Antifragile Reflexivity	Post-market monitoring (Art. 72); incident reporting (Art. 73).	Manage function; continuous improvement.	Performance evaluation; continual improvement.
Nested Polycentric Subsidiarity	Provider/deployer/distributor distinctions (Ch. III); national competent authorities.	Govern function; roles and responsibilities.	Leadership; organisational roles, responsibilities, authorities.
Non-Arbitrariness	Right to explanation (Art. 86); fundamental rights impact assessment (Art. 27).	Govern function; accountability; Map function.	Operational planning and control; AI system impact assessment.
Discursive Legitimacy	Transparency obligations (Art. 13, 50); information for deployers.	Map and Measure functions; stakeholder engagement.	Communication; documented information.
Monitoring + Graduated Response	Risk management system (Art. 9); post-market monitoring.	Measure function; risk tolerance; response.	Monitoring, measurement, analysis, evaluation.

The mapping confirms that established frameworks address the same underlying concerns from different angles. What the constitutional framework adds is the diagnostic test for substantive versus performative operation of each requirement — the mechanism specification that allows organisations to identify where compliance with the established frameworks is operative and where it is procedurally present but substantively absent.

Organisations operating under multiple frameworks should not treat the constitutional framework as a sixth set of requirements layered on top. They should use it as the diagnostic layer that examines whether their compliance with the existing frameworks is substantive. This produces more efficient governance, not more burdensome governance, because it directs attention to where the existing requirements are failing to produce their intended effect.

Provenance

This white paper integrates the Mature Constitutional Intelligence (MCI) framework, developed in the public dialogues of ultraRealist during 2025 and 2026, with the operational machinery developed in established AI governance practice — in particular the work synthesised in the BCS white paper "AI Ethics and Governance for Organisational Agility" by Giles Lindsay (2024) and the regulatory frameworks of the EU AI Act, NIST AI Risk Management Framework, and ISO/IEC 42001. The five constitutional properties draw on the theoretical traditions of Nassim Taleb (antifragility), Elinor Ostrom (polycentric governance and design principles for durable institutions), Philip Pettit (republican non-domination and non-arbitrariness), and Jürgen Habermas (discourse ethics and communicative action).

The combination of these traditions in a single framework reflects a methodological commitment: ethics frameworks for AI should rest on substantial intellectual traditions whose mechanisms have been studied empirically across decades of work in their respective domains, rather than on ad hoc lists of values that have not been tested against the failure modes the traditions in question were developed to address.