What comes after "it's not the technology".

Most large organisations now have AI governance. A council, a set of principles, a sign-off gate somewhere near the end.

Very few have governance that can stop anything.

Governance theatre is the distance between the apparatus of oversight and its authority. The meetings happen. The minutes exist. What's missing is the decision right — the ability to say no late, expensively, and be upheld.

The test is simple, and unkind. Name the last thing your governance process stopped. If nothing comes to mind, you have a record-keeping function with a governance name on the door.

The term isn't mine. It follows Schneier's 'security theatre'. I use it because it's the right word.

Governance is now sold. The same market that sells you AI capability sells you the means of governing it — the risk platform, the assurance framework, the certification, the responsible-AI module bundled into the licence.

Acquiring governance feels like exercising it. But procurement is not judgement.

Buying a control doesn't create the will to use it. And the more governance is acquired rather than practised, the more the acquisition itself starts to serve as the evidence of good governance.

This isn't an argument against the tools. It's an argument about what a purchase can prove.

Vendor lock-in is usually a commercial problem: data formats, migration cost, exit clauses. Those are tractable. You can put a number on them.

Epistemic vendor lock-in is the version nobody prices. It's lock-in of what you're able to know.

When a vendor's system becomes the instrument you observe your own work through, the questions you can ask narrow to the ones it can answer. The dashboards define the metrics. The metrics define the reviews. The reviews define what counts as a problem.

Eventually 'is this working?' has no answer outside the vendor's own framing. You can still leave. It's become considerably harder to know whether you should.

I've watched this in a small number of organisations and can't tell you how common it is. Where it's present it's invisible from the inside — which is the property that makes it worth naming.