A mid-sized health-technology company built a clinical-decision-support tool that reads patient data and hands attending clinicians a triage recommendation. The device carried a clean FDA clearance. Its core model was updated twice over eighteen months, and each update was logged correctly against the company's own change-control plan and reviewed exactly as the FDA framework required. A separate AI ethics committee, convened by legal, also reviewed the tool for bias and explainability, on a calendar built around the company's domestic product launches. Both teams did careful, well-documented work. Then the commercial team booked a sale into a hospital network in the European Union, and treated it as nothing more than a market expansion of a product that was already cleared.
The regulatory affairs team's mandate was scoped to FDA and did not extend to the EU AI Act. The ethics committee's charter did contain a line promising a review before any AI system entered a new regulated market, but the charter defined no trigger requiring the commercial team to notify the committee when a new sale was booked. A clinical-decision-support tool that influences patient triage sits squarely inside the category the EU AI Act's Annex III was written for, and should have gone through a specific high-risk classification determination before or immediately upon EU deployment. It never did, not because either team failed at the job it understood itself to have, but because the event that should have triggered that review, a new regulator's jurisdiction attaching to a system that already existed, fell in the seam between a team scoped to FDA and a team scoped to internal ethics policy. No one owned the seam itself.
The gap surfaced eight months later, when a routine due-diligence questionnaire from a prospective EU hospital system asked directly for the Annex III classification determination and its supporting file. None existed. From there the company had two options, both worse than doing the classification on schedule would have been: proceed without a documented determination and compound the exposure with every additional sale, or halt EU commercial activity while the classification is performed retroactively, which raises the harder question of what exposure already existed during the deployment window that had already run. Neither internal team had been negligent by the standard of its own mandate. The company was negligent by the standard a board is actually held to, which is whether a reasonable system existed to catch an AI system when it moved between two regulatory jurisdictions. It did not.
This is not a story about one company or one hospital network. FDA's move toward continuous competency assessment for generative AI medical devices, the EU AI Act's Annex III high-risk classification, EPA's shifting permitting posture for data-center power, and the Department of Energy's review of certain foreign-sourced bulk-power equipment are four statutory tracks with four different enforcement postures. Underneath all four sits one question, asked four times: does a defined AI system, touching a regulated asset, operate inside the boundaries the company approved and disclosed for it. A regulatory affairs team fluent in FDA, an energy-compliance team fluent in EPA and DOE, and a newly formed AI ethics or legal function tracking the EU AI Act rarely share a system of record. Each can be individually excellent at its own scope. None of them, alone, can answer the board's actual question, which is not whether any one file is compliant but which systems the company currently cannot certify as classified against every regulator that could reach them.
THE DECLARATIVE BOARD FAILURE PATTERN
A board that points to three competent, well-documented teams has declared that oversight exists. It has not built the one system whose job is to own the seam between those teams, the point where a system crosses from one regulator's jurisdiction into another's. That gap between declaring oversight and building it is the Declarative Board Failure Pattern, and it is harder to see than most governance failures precisely because every individual team involved can show its own file is clean. The failure is not in any team's work. It is in the absence of anyone assigned to ask whether a change event, a new market, a new vendor, a model update, reopens a classification question that a different team already closed under a different regulator.
The fix is not a fourth review layered onto the existing three. It is a single registry, owned by the risk function, that attaches a standing cross-reference to every material AI system and every regulator that could reach it, triggered automatically whenever a system changes in a way that matters: a new jurisdiction, a new vendor, a model update, a new deployment context. The registry does not require the CRO to become expert in FDA, EPA, DOE, and the EU AI Act simultaneously. It requires one function to own the question of completeness across all four, so that a change event gets routed to the right subject-matter team instead of falling into the seam between teams that each assumed someone else would notice.
A registry built this way is not a defensive paper trail assembled for a future plaintiff's attorney to read. It is what the next CRO, the next general counsel, the next board inherits and actually uses the day a system moves into a jurisdiction nobody on the current team has thought about yet. Built now, before any regulator or due-diligence questionnaire has reason to ask the question, it is conviction. Built only after the gap has already surfaced, it is simply the record of how late the system arrived.
Glenn E. Daniels II, Touch Stone Publishers