Pandemic-preparedness analogy for AI governance - readiness has no visible deliverable; the 48-hour boardroom question

David Chapman published a piece this week called "There will be another pandemic", and the most uncomfortable line in it is not about viruses. It is about us.

His account of the years before covid: a pandemic plan written by the US National Security Council in 2016, then dropped and forgotten. A strategic national stockpile emptied before 2020 and never fully restocked. The World Health Organization handed responsibility for coordinating the global response with a fraction of the resources the role required. None of this was secret. It simply never became urgent, because preparedness has no visible deliverable. Nobody cuts a ribbon on a warehouse of masks. Budgets follow salience, not expected value, and the crisis that never happens earns no one a promotion.

I keep returning to this in the context of AI governance, where most organisations are now in their pre-pandemic decade.

The analogy has limits, and it is worth being precise about them. An AI incident is not a pathogen; nothing replicates through a population on its own. What transfers is the funding psychology. Serious readiness looks boring before the crisis: standing capacity rather than a project assembled mid-incident, authorities pre-cleared rather than escalated through committees at the worst possible moment, escalation paths that have actually been exercised, and ongoing assurance that the system still does what the policy claims it does. None of that produces a deliverable anyone can photograph.

What most organisations have instead is a policy document. Chapman's point about plans applies directly: a plan is not a program for action, it is a resource you draw on during a crisis, and it is worthless unless it carries explicit triggers and people who already know what they will do when the alarm sounds. A thirty-page AI policy that has never been exercised is the 2016 pandemic plan left on the shelf.

So the question worth asking in any boardroom is not whether the governance framework exists. It is what fires in the first 48 hours of your AI incident, who is already authorised to act, and when you last tested any of it.

https://lnkd.in/gEYJe4dE