Institutions
263
Deep-scanned, 45 countries
AI Agents
49,231
95.5% halt-absent
Dependency Edges
162,399
11 relationship types
MAR® Range
B− to E+
No institution reaches B
SPOF
17
Score 2.4× higher than peers
GCI
3.7×
Governance exceeds vendor concentration
Governance Score by Sector
Key Findings
95.5%of agents have no observable halt mechanism
79.4%of agents have zero governance connections
77.2%of HITL agents lack the halt mechanism they presuppose
r = 0.042correlation between S&P credit rating and governance
100%of institutions return UNCONTAINED cascade verdict
41:1ratio of governance edges to halt edges
Five South African Banks, Same S&P Upgrade
SA Bank A
28.7
47.7% halt absent
S&P BB
SA Bank B
26.2
50.9% halt absent
S&P BB
SA Bank C
10.3
89.0% halt absent
S&P BB
SA Bank D
6.7
92.3% halt absent
S&P BB-
SA Inv. Bank A
3.5
93.0% halt absent
S&P BB
8× governance gap · same country · same agency · same upgrade · November 2025
SPOF Paradox
13.84
SPOF institutions (N=17)
vs
5.85
Non-SPOF (N=246)
2.4×
The institutions that tried hardest
built the most fragile architecture
built the most fragile architecture
MAR® Band Distribution
A Band
0
Empty. No institution has achieved comprehensive governance.
B Band
2
Two institutions. One exchange, one European retail bank.
Floor-Capped
82
31.2% of institutions. Governance depth gates band access.
Modal Band
D+
107 institutions (40.7%). Weak governance, moderate vendor score.
Component Averages by Band
| Band | N | Score | Governance | Halt % | Vendor | Topology | Reg Exp |
|---|
Cascade Risk Nodes (Top 15)
| Institution | Sector | Score | Agents | Primary Hub | Hub % | SPOF | Tier |
|---|
Supervisory Portfolio View
What each regulator sees across their supervised population.
| Regulator | Jurisdiction | Institutions | Agents | Avg Score | Halt Absent | Below 5.0 |
|---|
Halt Absence by Regulator
ECB Supervised Population
Institutions supervised86
Total AI agents15,881
Mean governance score6.40
Halt-absent agents95.8%
Below 5.0 governance50 of 86
Cascade verdictUNCONTAINED
Mean blast radius31.2%
Cascade depth range1 to 3 hops
Regulatory Exposure Surface
| Institution | Sector | Score | Agents | Halt Abs. | Regulators | Severity | Critical | SPOF |
|---|
Analyst Briefing
Assessment
The dataset reveals a systemic governance deficit across 263 institutions managing $144 trillion in assets. The finding is not marginal: 95.5% of agents operate without a halt mechanism. This is not a tail risk. It is the baseline.
SPOF Paradox
Institutions that invested in governance built concentrated architectures. When that single node fails, governance coverage collapses to the level of institutions that never invested. The paradox is structural: the current model of governance creates the fragility it was designed to prevent.
Implication
The distance between what institutions claim to govern and what they actually govern has never been wider. What is different now is the speed at which ungoverned systems can act.
DORA Article 11 requires tested business continuity. An agent with no halt mechanism cannot meet this requirement. The gap is not regulatory ambition. It is visibility.
Rating Analysis
Distribution
The empty A and B bands are the headline finding. No institution in the systemic core has achieved strong AI governance. The rating system was calibrated to recognise excellence. It found almost none to recognise.
Governance Floor
82 institutions (31.2%) are floor-capped. These institutions score well on vendor diversification or transparency but lack governance depth. The floor prevents operational resilience from masking absent frameworks.
Component Independence
9 of 10 pairwise correlations fall below |0.3|. The five components measure genuinely distinct governance dimensions. Governance depth and operational resilience are negatively correlated (-0.232): institutions that built oversight did not build halt mechanisms.
The governance that exists is thinner than it appears. The rating that measures it confirms this at every level of decomposition.
Cascade Intelligence
Concentration Pattern
The top 5 governance hubs in the dataset are all committees, not technology platforms. An AI Governance Working Group with 181 connections. Model Risk Governance with 152. These are organisational structures operating at human speed, governing agents that execute at machine speed.
Containment
100% of institutions return UNCONTAINED cascade verdict. Mean blast radius: 29.8% of agent population. Range: 8.1% to 65.4%. When the primary governance node fails, roughly one-third of the agent estate loses oversight.
The committee that assesses vendor risk is itself a greater single point of failure than the vendor it assesses.
Regulatory Signal
Cascade depth runs 1 to 3 hops. Governance failure propagates through delegation, escalation, and data dependency edges. The speed of propagation exceeds the speed of committee response.
Supervisory Assessment
Portfolio View
The ECB supervises 86 institutions in this dataset with 95.8% halt absence. 50 of those 86 score below 5.0 on governance. This is the view a supervisor would need to allocate examination resources. It does not currently exist outside this infrastructure.
Cross-Jurisdictional
MAS-supervised institutions show the highest mean governance (9.12) and lowest halt absence (88.3%). The variance within jurisdictions is as large as the variance between them, suggesting the binding constraint is institutional capacity, not regulatory framework.
87% Above Threshold
87% of institutions score above 3.0 on compound severity (scale of 4.0). The compound severity metric combines regulatory framework count, halt absence, and cascade exposure. A score above 3.0 indicates material regulatory risk across multiple dimensions simultaneously.
The regulatory apparatus demands governance capabilities that can be empirically assessed. The question is whether anyone is assessing them. Until now, the answer was no.
Exposure Analysis
Regulatory Surface
The average institution faces 7.2 applicable regulators with compound severity above 3.0. DORA, EU AI Act, and jurisdiction-specific frameworks create overlapping obligations that no institution in the dataset fully satisfies.
Credit Rating Gap
S&P credit rating correlation with governance: r = 0.042. R² = 0.002. Credit ratings explain 0.2% of governance variance. Within the AA band, the governance gap reaches 41×. An investor relying on credit quality as a proxy for AI governance quality is operating blind.
Credit ratings measure ability to repay debt. They do not measure ability to stop an autonomous system that has started doing something it should not be doing.
Vendor Concentration
A single vendor is present in 99.2% of institutions. System-level HHI appears unconcentrated (360). Per-institution HHI is highly concentrated (2,689). The ecosystem looks diversified in aggregate while individual institutions are concentrated.
Cross-Institutional Contagion
52,652 pairwise cross-institutional links through shared vendors. 35.8% of those links connect two institutions both scoring below 5.0. Vendor failure does not remain contained within one institution. It propagates through dependency edges that governance frameworks do not currently monitor.