An engineer raises a concern. Maybe the workflow edges across a vendor restriction. Maybe a high-stakes use case has appeared without real approval. Maybe an internal experiment has quietly become customer-facing. The concern moves upward through the expected channels. Everyone is serious. Everyone is professional. Nobody wants to say something incorrect.
And somewhere in that sequence, the organization reveals that it does not merely lack a final answer. It lacks a person with enough authority and enough understanding to say stop — not like this.
That's the Compliance Black Hole. Not the absence of rules. The absence of usable gravity. The rules exist. The concern exists. The danger exists. The connective tissue between the danger and someone with the power and knowledge to act on it does not exist.
The organizations that end up with this problem are not organizations that didn't try. They are organizations that tried to govern by committee, by policy, by process — and found that governance by committee produces governance that nobody owns.
An engineer brings a concern to a committee. The committee discusses. The committee requests more information. The engineer provides more information. The committee discusses. The concern has now traveled through three meetings and nobody in the room is the person who can stop the thing. Everyone agrees it is worth reviewing. Nothing has been stopped.
This pattern has become more dangerous in the AI era because a lot of AI governance still has the mood of advance paperwork for a future reckoning. Organizations know regulation is coming. They know lawsuits are coming. They know that entire categories of decisions will not be defensible in hindsight with the model helped as the explanation. And yet many of those same organizations still behave as though the dangerous phase begins later — after the industry has had time to settle, after the regulators have provided clearer guidance, after someone else has figured out what best practice looks like.
It does not begin later. It begins the first time something questionable keeps moving because everyone in the room assumed someone else understood it well enough to hold it. The first time an unapproved workflow stays in production because the approval meeting was scheduled for next week. The first time we should review this is treated as equivalent to this has been reviewed.
The review is not the stop. The review is the thing that precedes the decision. If the workflow continues operating while the review is ongoing, the review is advisory, not governance.
The counter-move is not more policy documents. It is named people who have been given real authority and who have been told, explicitly, that they are expected to use it. An organization that can name the person who stops things — their role, their authority, their relationship to the teams building the workflows — is an organization that can govern. An organization that cannot name that person has governance as a social norm rather than as an organizational structure.
The Black Hole forms in the space where that naming has not happened. The fix is to do the naming before the space opens up. And if the space has already opened up, do it now — in the meeting where you're realizing you should have done it earlier, which is the meeting where the naming is most valuable and most uncomfortable.
The moment someone asks who is the person, not who is the committee — that's the moment the Black Hole starts to close.