The Monthly Letter

Issue No. 3 | September 2026

THE SEPTEMBER ISSUE: Get Out of the Room!

September is supposed to be the month everyone comes back. Back to school, back to work, and back to routine. And, if you love fashion like I do, September has always had a little more significance. The September issue is the big one: a new season, a reset, a look at what's coming next.

I managed to spend most of my September in new places. For a good chunk of the month, I was in India and the Maldives, very far from my desk and the little universe of fintech, compliance, AI governance, regulatory updates, calls and Slack messages that usually fills my days.

I did work more than I intended to, obviously. But I was away long enough to notice something that is much harder to see when you're sitting in the middle of your normal life:

Sometimes you need to get out of the room!

And I don't just mean go to the Maldives, although I can confirm that works. I mean the rooms we build around ourselves professionally. Compliance people spend a lot of time with compliance people. Lawyers talk to lawyers. Founders talk to founders. Engineers talk to engineers. Eventually everyone in the room knows the same acronyms, accepts some version of the same assumptions and gets very good at answering the questions that room knows how to ask. That's how expertise gets built, sure, but it's also how blind spots are formed.

FEATURE

Touching Grass: The Fintech Version

Spend enough time inside any organization and things that would look strange to an outsider start to feel completely normal. The report gets produced because we've always produced it, and no one thinks to question it. The control has six steps because somewhere along the way it acquired six steps - but can anyone explain why? Everyone knows a process doesn't work particularly well, but everyone has also learned how to work around it, so the process survives.

Then somebody new walks into the room and asks: Why do we do it this way?

I think we sometimes confuse that question with inexperience. An expert understands why things are complicated but an outsider doesn't understand all the context. The real world is messier than it looks from the outside. All true, yes, but experience creates its own problems. Once you've spent enough time learning how a system works, it becomes surprisingly difficult to imagine that it could work differently.

I've been thinking about this a lot in my work lately, particularly around AI governance. AI governance is increasingly being treated like a discipline unto itself, but in practice it sits across a bunch of disciplines that don't necessarily see the same problem.

Legal sees legal exposure. Model Risk sees performance and validation. Cybersecurity sees access, data and vulnerabilities. Engineering sees architecture and technical constraints. Compliance sees regulatory obligations and customer outcomes. The business sees the thing it's trying to accomplish. While no one is wrong, none of them have the whole picture either.

Here's a scenario I've been using lately: Your AI vendor hands you an independent validation report. Are you done?

It would be nice if the answer were yes. Someone independent looked under the hood - there are tests, findings, and a report you can put in the file. But what exactly was validated?

The report might tell you a great deal about the vendor's system. It doesn't necessarily tell you whether your institution is using that system appropriately. It doesn't tell you who has authority over the use case, what data you've allowed it to access, where human judgment is required, what happens when the vendor changes the model or whether anyone will be able to reconstruct the decisions you made when somebody asks eighteen months from now.

Newsflash: The vendor can validate its model, but it cannot govern your institution for you. That's the room problem in miniature.

Everybody can do a very good job governing the piece directly in front of them and still miss what is happening between the pieces. And this isn't only an AI problem. I've watched Compliance inherit responsibilities because nobody else knew where to put them. I've watched founders become the routing mechanism for decisions nobody formally owns. I've watched companies add controls to fix problems and then keep the controls long after anyone remembers the original problem.

The system makes sense from inside the room because everyone has learned how to operate inside it. Sometimes the most valuable thing you can introduce isn't another expert in the same room, but another room entirely.

🎙 RISK & REBELS

What Happens When AI Governance Meets the Real World?

The latest Risk & Rebels podcast guest is Joseph Cuanan, founder of ComplyGraph - and, full disclosure, someone I've also been spending a lot of time building with lately.

Joseph and I work together on the AIRE AI Governance Masterclass, so we agree on plenty. That isn't actually what makes the conversation interesting, though, because who wants to listen to two people just talk about how much they agree on? What I like about talking with Joseph is that he approaches governance from a different room than I do.

I tend to start with the institution: regulatory expectations, accountability, governance structure, evidence, controls and the uncomfortable question of what you would actually show an examiner.

Joseph spends much more of his time thinking about how governance gets operationalized in technology: workflows, evidence, systems and what happens when a beautiful governance framework has to survive contact with the people who actually use it.

Those perspectives overlap, but they aren't identical, and that's exactly why the conversation works.

We talk about what organizations are getting wrong as they rush to put AI governance structures in place, why having a framework isn't the same thing as having governance, and what starts to change when AI moves from generating an answer to actually taking action.

It's also a pretty good example of the theme of this month's newsletter: sometimes the interesting answer appears when two people come into the same problem from different rooms.

The new episode of Risk & Rebels with Joseph Cuanan is out now.

→ Watch on YouTube

→ Listen on Spotify

FIELD NOTES

Four Things I've Been Thinking About Outside the Room

1. “Independent validation” can create a false finish line.

I keep coming back to the AI vendor scenario for a reason, because it's going to become increasingly more important as regulators start digging deep into your AI governance programs. A strong independent validation report is useful. I for sure want to see it. I want to understand the methodology, the findings, the limitations and what happened afterward. What I don't want is for the existence of the report to become shorthand for “governance complete.”

Institutions still have to make their own decisions about appropriateness, ownership, authority, data, oversight, change, incidents and customer outcomes. They still need evidence that those decisions were actually carried out. Third-party assurance can inform institutional judgment, but it does not replace it.

2. “Human in the loop” is becoming one of my least favorite answers.

Not because humans shouldn't be involved. Quite the opposite, to be sure. It's because “there's a human in the loop” can sound like the end of a governance conversation when it should be the beginning of one. Which human? Where in the process? Looking at what information? With how much time? Can they disagree with the system? Do they have enough context to recognize when they should disagree? Can they stop what happens next?

As AI systems become more capable of taking actions instead of simply producing outputs, I'm increasingly interested in authority, not just presence. Putting a person somewhere on a workflow diagram doesn't automatically preserve human judgment.

3. Conferences are only useful if you let them surprise you.

I'm coming home from vacation directly into a fairly ridiculous fall calendar.

Fintech Is Femme Summits in San Francisco. Money20/20. Fintech NerdCon. AI governance events. Security events. Compliance events. Panels, workshops, coffees, dinners and more airport time than I care to calculate.

I've been to enough conferences at this point to know how easy it is to fly across the country, walk into a building containing thousands of interesting people, and spend three days talking to people you already know.

So I'm giving myself a rule this fall: Don't spend conference season only talking to people who already understand why the things you care about matter.

I want to hear what fraud teams are seeing that compliance isn't. I want to know what engineers think we're getting wrong about AI governance. I want to know what founders hear when banks say “risk appetite.” And I want to know what compliance teams are actually being asked to own as AI moves from experiments into real operations.

Which brings me to the last one.

4. The hallway is usually more interesting than the panel.

I say this as someone who is about to spend a considerable amount of time on panels. There is something that happens when the microphones turn off.

Someone tells you what they're actually worried about. A founder admits the thing that isn't working. A compliance officer tells you the policy is beautiful and nobody follows it. Someone disagrees with the consensus everyone politely nodded along with for the previous thirty minutes. Those conversations are usually the ones I remember.

So this fall I'm treating conference season partly as field research. If you see me somewhere, tell me the thing you wouldn't put on the conference slide.

That's probably the conversation I want to have.

BEHIND THE SCENES

I Left the Country. RayCor Did Not Disappear.

There is a certain irony in spending August writing an entire newsletter about what happens when the person who built something isn't there, and then leaving the country for a good portion of September.

Yes, I noticed it too.

Last month I wrote about trying to build RayCor into a company that is bigger and more durable than my individual capacity. I asked what would happen if the most indispensable person in an organization disappeared for 30 days. Then I went to India and the Maldives. Not for 30 days, let's not get carried away, but long enough to test the premise a little.

I still worked. I still took calls, set up meetings, responded to emails, and drafted proposals. There were things that still required me, and there are plenty of things I'm continuing to build so that fewer of them do. But distance is clarifying. It becomes much easier to distinguish between something that genuinely requires your judgment and something you've simply trained yourself to believe requires your presence. That's probably true for founders, executives and compliance officers alike.

Sometimes getting out of the room is how you find out whether you've accidentally made yourself part of the system.

ICYMI

🎙 Risk & Rebels: Joseph Cuanan

AI governance looks very different depending on which side of the table you're sitting on.

Joseph Cuanan and I spend a lot of time on different sides of the same problems, which made this one fun.

→ Watch on YouTube

→ Listen on Spotify

🤖 AIRE AI Governance Masterclass

Joseph and I have also been building something together. AIRE is designed for the people who are increasingly being told, “Congratulations, you own AI governance,” and then discovering that nobody has provided particularly good instructions for what that means in practice.

We built the Masterclass around the problems we're actually seeing: institutional ownership, agentic AI, human oversight, vendor governance, shadow AI, evidence and the increasingly important gap between having a framework and having a governance system that works.

→ Learn more about the AIRE AI Governance Masterclass

📍 See you out there

This fall I'm trading the Maldives for conference rooms.

I'll be speaking, moderating and generally asking too many questions at events across fintech, compliance, security and AI governance over the next few months.

If we're going to be in the same room, come say hello. Preferably in the hallway.

ONE MORE THOUGHT

There is a reason I don't think “get out of the room” means “ignore the experts.” Expertise matters enormously. I'd like to say I've built my career on it. But I think expertise is most useful when it remains curious enough to notice what it has stopped noticing.

The older I get, the less impressed I am by rooms where everyone has the answer. I'm much more interested in the room where somebody asks a question that changes the conversation.

So that's what I'm taking into this fall. Go somewhere you don't normally go. Talk to somebody who doesn't do what you do. Attend the session you would normally skip. Ask the engineer. Ask the fraud person. Ask the founder. Ask the person who joined six weeks ago and hasn't yet learned which questions everyone stopped asking.

And if somebody tells you that something has to be done a certain way because that's how it's always been done, maybe pull that thread a little.

What room do you need to get out of?

Hit Reply and tell me. Seriously. I'm curious.

Until next month…

If someone forwarded The September Issue to you and you enjoyed it, I'd love to have you join us. Every month I share one idea I can't stop thinking about, a few observations from the field and conversations with people making difficult decisions when the answers aren't obvious.

Christina
Founder & CEO, RayCor Consulting