The Speed That Runs Into a Wall

Of course it is faster to build without rules.

Anyone who tells you otherwise is selling something. Documentation costs time. Traceability costs architecture. Knowing where your data came from, what your model was trained on, why the system answered what it answered, all of it costs, and none of it shows up in the demo. The team that skips it ships months earlier. That is not a myth. It is true, and pretending it is not true is why so much writing about AI regulation convinces nobody.

So let me grant the whole point. Unregulated speed is real.

It is also a loan.

Here is how the bill arrives. Your product works. Your growth is good. And now you want the customers that are actually worth something: a bank, an insurer, a public agency, an industrial company with safety requirements. And their first questions are not about your features. Where did this answer come from? What data trained this model? Who can access what? Show us. Not tell us. Show us.

If you built fast without traceability, this is the moment you discover what you actually saved. Because now you rebuild it all backwards. Provenance that should have been captured at the source gets reconstructed from fragments. Documentation that should have accumulated gets written from memory, under deadline, by people who were not there. Everything you skipped comes back, except now it is harder, because the system already exists and was never designed to answer these questions.

The team that built it in from the start was never slower. They paid in advance. And paid in advance is cheaper, every time, because retrofitting evidence into a system is more expensive than generating it as you go. Rules slow down the start and speed up everything after, because they force the one thing the valuable markets will demand anyway: the ability to prove what you did.

This does not hold everywhere, and it matters where it stops. There is a world, the viral consumer world, where moving fast genuinely won. Products that took an entire market before any rulebook caught up, and the careful competitors simply lost. If that is your game, this chapter is not your chapter. But that is not the world I work in. My world is banks, industry, infrastructure, public sector, systems where a mistake has consequences beyond a bad review. In that world, nobody buys AI they cannot audit. The wall is not hypothetical there. It is the front door.

This is also, I think, the sane way to read the difference between how Europe and the United States approach the whole question, a debate that usually collapses into cheering for one side. Europe writes the rules in advance. You know what is required before you act, and you can build against it, at the price of slower adaptation when the technology moves. The American model runs more on courts and case law. You move first, and where the line actually sits gets discovered afterward, sometimes expensively, in litigation. Neither is simply better. They are two different places to put the uncertainty. One makes you slower up front. The other makes you unpredictable later. Which one hurts more depends entirely on what kind of business you are in, and for the regulated world, unpredictability is usually the worse poison.

Which points at something that gets lost in every complaint about European regulation. The problem with a rule is rarely that it is strict. A clear strict rule is something you can engineer against. You read it, you build for it, you move on. The expensive thing is unclarity. Years of not knowing what will be required, which is what Europe put its companies through while the AI rulebook took shape. Unclear strictness is the worst of both worlds: you carry the cost of compliance without knowing what compliance is. Predictability is the actual competitive resource here. A jurisdiction that gives its companies clear rules, even hard ones, is giving them something to build on. One that gives them vague ones, however mild, is giving them fog.

Now the objection from the technical side, because it is a good one. Provenance sounds fine until someone asks whether it is even possible. The foundation models everyone builds on were trained on a scrape of the internet. Nobody, including their makers, can fully account for what went into them. So is not the whole idea of proving where things came from theater?

For the base model's training data: yes, largely. You will not get that proof, and you should be suspicious of anyone who claims to offer it. But that is not the part of the chain your customer is asking about, and it is not the part you own. Your data. Your fine-tuning. Your retrieval sources. Your outputs, your decisions, who accessed what and when. That part of the chain is yours, it is fully traceable if you build for it, and it is precisely what the bank wants to see. You cannot prove the whole chain. You can prove your links in it. Own your part, document your part, and be honest about where your part ends. That is not theater. That is the difference between a vendor who gets into the regulated market and one who waits in the lobby.

There is a quieter payoff too, one that shows up later. Companies facing many markets and many rulebooks tend to assume they will need many product variants, one per regime, and the maintenance burden that follows. But the rulebooks largely ask for the same underlying things: know your data, trace your decisions, control your access, document your system. Build that foundation once, properly, and what varies per market is configuration, not product. The compliance base is not what fragments your product line. It is what saves you from fragmenting it.

So this is where I land. If you are building for the world where the valuable customers live, build like the audit is coming. Not because the regulator frightens you, but because the audit is just the formal version of the question every serious customer will ask anyway: can you show me? The speed you gain by skipping that answer is borrowed, and the lender is exactly the market you are hoping to sell to.

Loans like that have a way of being called in at the worst possible moment. Usually in the meeting you most wanted to go well.