The Classification Cascade

Ethan Mollick, associate professor at the Wharton School of the University of Pennsylvania and author of “Co-Intelligence,” wrote a piece in The Economist with a headline that landed hard across the business world: the IT department is where AI goes to die.

He is right. But he is naming the symptom, not the disease.

The disease is a classification error. And it happened before the IT department ever got involved.

The Classification Error

Somewhere in the first quarter of every company’s AI story, an executive asked the obvious question: “Who handles this?”

AI is technology. Technology belongs to IT. The answer wrote itself.

That single classification decision - AI is technology, therefore IT owns it - cascaded into a governance structure that systematically prevents AI from producing value. Not because IT is incompetent. Because IT is doing exactly what it was designed to do: minimise risk, standardise tools, ensure compliance, control costs.

The IT department did not kill AI. A category error at the executive level triggered a governance cascade that killed it. IT was the weapon. The executive classification was the hand that pulled the trigger.

The error is specific and identifiable. The classification was made by what AI IS (technology) rather than what AI DOES (augments human decision-making across every function). This is the structural equivalent of sending a new doctor to the IT department because they use electronic medical records. The tool category is correct. The functional classification is catastrophically wrong.

The Cascade

Trace the chain of consequences.

AI projects lose momentum. Implementation takes too long.

Why? Because IT applies standard procurement, security review, and integration protocols. The same protocols used for ERP systems and CRM platforms. The same approval workflows that took 18 months to clear a new database vendor.

Why those protocols? Because all technology is managed this way. IT has a governance framework built over decades for a specific purpose: managing technology risk. AI was classified as technology. Therefore AI inherits the framework.

Why that classification? Because the first executive to encounter AI asked “what department handles new tech?” The default answer is IT. No other department has the structural mandate to evaluate, procure, secure, and deploy technology.

And underneath that: the classification was made at the category level rather than the capability level. AI was sorted by what it IS (a technology product) rather than what it DOES (amplifies human judgment, automates workflows, generates creative outputs, processes language). The category demanded one governance path. The capability demanded an entirely different one.

Five levels. One root cause. A single question asked at the wrong level of abstraction produced a cascading governance failure that costs enterprises billions in unrealised AI value.

The De-Weirding Problem

Mollick’s argument goes deeper than “IT is the wrong department.” He identifies the psychological mechanism: de-weirding.

The dominant instinct across the corporate world is to de-weird artificial intelligence. Sand down its strange edges. Turn it into a familiar productivity tool. Make it legible to existing management frameworks. Slot it into existing processes with existing KPIs and existing reporting structures.

This instinct is understandable. It is also destructive.

The de-weirding impulse produces a specific failure: companies default toward automation rather than augmentation. When leaders see 30% productivity gains, their instinct is to cut 30% of workforce. What is hard - and requires genuine imagination - is asking: what becomes possible when a single programmer can write 100x more code?

No vendor can answer that question, Mollick argues. No consultant has a playbook. The hard strategic work of reimagining what an organisation could become is precisely the work that de-weirding allows companies to avoid.

The IT department is the institutional embodiment of de-weirding. Its mandate - standardise, secure, control - is the operational expression of the instinct to make AI familiar. When AI arrives in IT, it gets de-weirded by default. It becomes “another tool in the tech stack” rather than “a capability that might restructure how every team works.”

The firms that smooth out AI’s oddities will veer toward automation and layoffs because that is all they can see. Those willing to sit with the discomfort of a technology nobody fully understands can find ways to make their people and organisations capable of things that were impossible a year ago.

The classification error is not just administrative. It is existential. It determines whether AI becomes a cost-reduction tool or a capability multiplier.

Why the Immune System Is Not the Enemy

Here is where most commentary on this topic goes wrong.

The response to “IT kills AI” is typically “take AI away from IT” or “bypass IT governance.” This is a category error of its own. The IT governance function exists for genuine reasons. Remove it entirely and you get chaos.

The biological parallel is precise and instructive.

Your immune system exists to protect you from foreign bodies - bacteria, viruses, parasites, damaged cells. It distinguishes self from non-self and destroys what does not belong. This function is essential to survival. Without it, every infection would be fatal.

But the immune system can also attack beneficial foreign substances. Autoimmune diseases occur when the system fails to distinguish threats from nutrients. The mechanism for tolerance - the ability to accept beneficial non-self - breaks down.

In the body, immune tolerance is maintained through two mechanisms:

Central tolerance: During development, immune cells that would attack the body’s own tissues are eliminated before they mature. The system is trained, at the point of origin, to recognise what belongs.

Peripheral tolerance: Outside the development organs, regulatory T cells (Treg cells) actively suppress immune responses against beneficial substances. They maintain tolerance in real-time by distinguishing genuine threats from harmless or helpful foreign material.

The organisational parallel:

Central tolerance is what happens when AI is classified correctly from the start. If the executive team classifies AI as “capability” rather than “technology” at the point of entry, it never routes to IT governance. The immune system never encounters it as a foreign body. This is the GP’s structural advantage - you make the classification directly.

Peripheral tolerance is what mature organisations need to develop: governance mechanisms that can distinguish AI uses that genuinely threaten security and compliance (and should be blocked) from AI uses that augment capability (and should be cultivated). Regulatory T cells for AI adoption.

The goal is not destroying the immune system. The goal is teaching it to distinguish threats from nutrients.

Two Models: Pathogen vs. Microbiome

The GP Structural Advantage

If you run a 5 to 25 person company, you do not have an IT department.

This is not a weakness. It is a structural immunity to the Classification Cascade.

You do not have the cascade because you make the classification directly. When AI arrives, you - the founder, the operator - decide what it is and where it goes. You can classify it as capability from day one. You can skip the governance structures that would slow experimentation. You can let every team member experiment and learn from the results weekly.

The data supports this. Only 29% of organisations see significant ROI from generative AI, despite individual productivity gains of 5x across the workforce (Writer / Workplace Intelligence, 2026 Enterprise AI Adoption Survey). The structural profile of that 29%: fewer silos, faster approval cycles, and decision-makers who classify AI directly rather than routing it through governance frameworks designed for a different function. The structural advantage IS the absence of the immune system that kills AI in larger organisations.

The GP's AI advantage is not technological. It is organisational. The absence of the classification cascade is worth more than any model upgrade. Speed of integration beats capability of tool.

Gartner places 2026 in the “Trough of Disillusionment” for enterprise AI. 57% of leaders who reported AI failures said they expected too much, too fast. But the failure mode is not “AI cannot deliver.” The failure mode is “governance prevented AI from being tested long enough to learn what it can deliver.”

You are structurally immune to that failure mode. Unless you infect yourself.

The Governance Import Tax

The danger for the founder-operator is not that AI is hard. It is that you import enterprise governance before you need it.

Name the cost: The Governance Import Tax.

The Governance Import Tax is the measurable delta between your current speed-of-integration advantage and the reduced speed that results from importing governance structures designed for organisations ten times your size.

The moment you:

• Create an AI committee with approval authority
• Require formal procurement review for AI tool adoption
• Hire someone whose primary function is AI governance rather than AI capability
• Impose centralised prompts managed by a single team
• Require security review for every new AI use case regardless of risk level

…you have voluntarily installed the immune system that kills AI in enterprises. You have imported the Classification Cascade into an organisation that was structurally immune to it.

Many growing businesses make this mistake. They import enterprise-scale processes before they need them - and in doing so, eliminate the structural advantage that was producing their superior returns. The governance that makes sense at 500 employees is a tax at 15 employees. The review process that prevents catastrophic errors at scale prevents learning at startup speed.

Countermeasures: What to Build Instead

The answer is not zero governance. Shadow AI is a real risk: only 36% of companies have formal AI governance frameworks in place (Zylo), leaving the majority operating without structural safeguards. Data leaks, hallucinated outputs in client-facing materials, vendor lock-in, and regulatory exposure are live risks for the ungoverned majority.

The answer is proportional governance - enough structure to prevent genuine harm, not enough to prevent learning.

The 1-Page Operating Agreement

Replace the enterprise AI policy (typically 20-40 pages) with a single page that answers four questions:

1. What data can never go into AI systems? (client financial data, medical records, passwords, proprietary algorithms)
2. What outputs require human review before external use? (anything client-facing, anything legal, anything financial)
3. What is the escalation path when AI produces something concerning? (who to tell, what to do)
4. What is the experimentation freedom? (everything not listed above is open for experimentation)

This takes 30 minutes to write and covers 90% of real risk.

Team-Level Experimentation Freedom

Every team member can adopt, test, and integrate AI tools for any task not covered by the four questions above. No approval required. No procurement process. No IT review. The constraint is the operating agreement, not a gate.

Weekly 15-Minute Learning Sessions

One question per week, answered by everyone: “What did you try with AI this week, and what did you learn?” This produces institutional learning without institutional bureaucracy. Discoveries propagate. Failures are shared before they compound.

Proportional Security Review

Low-risk uses (internal summarisation, drafting, analysis, brainstorming): no review. Medium-risk uses (client communication drafts, published content, financial projections): human review before deployment. High-risk uses (automated client interactions, financial transactions, regulatory filings): full review with explicit sign-off.

The gradient matters. Treating all AI use as high-risk produces the enterprise failure mode at GP scale.

Founder’s Direct Attention

The single most important governance mechanism for a 5-25 person company: the founder actively uses AI systems themselves. Not delegated to a team. Not managed through reports. Direct, daily use that builds intuition about what AI can and cannot do in this specific business context.

This produces something no governance framework can substitute: judgment born from direct experience. When the founder understands AI’s capabilities and limitations firsthand, governance decisions become precise rather than defensive.

One Diagnostic

Ask this question at your next team meeting:

If a team member found an AI tool that would save them 5 hours per week, how many approvals would they need before they could start using it?

If the answer is zero (within the operating agreement boundaries): you have preserved your structural advantage.

If the answer is one: you have minimal governance. Watch whether that single gate creates a bottleneck.

If the answer is more than one: you have begun importing the Classification Cascade. The immune system is installed. The clock is running on your structural advantage.

The classification error is reversible. But only if you catch it before the cascade completes.