Trust as Infrastructure: Why Governance Is How America Wins the AI Race (Part 2)

November 10, 2026

In Part 1, I argued that governance, risk, and compliance (GRC) works as an instrument for reducing variance in a high-rate, high-volatility world. Part 2 turns to the competitive question. The midterm verdict has changed the political terms on which American AI capital will be deployed, and the popular claim that lighter regulation is the way to outrun China deserves a harder look. My thesis is that the United States already leads on capital, so the scarce resource is no longer money. It is legitimacy: the public consent, investor confidence, and internal accountability that allow capital to become adopted, durable capacity. GRC is how an organization manufactures that legitimacy, and the firms and countries that build it first will compound faster than those that treat rules as friction.

The capital stack America has already built

Congress passed the CHIPS and Science Act in 2022 under President Biden. It included $39bn for manufacturing incentives, supplemented by an investment tax credit that now stands at 35% for projects that begin construction before the end of 2026. The Congressional Research Service notes that fiscal 2026 is the final year of Commerce appropriations for the program, and that Intel gave the government equity in exchange for its award, reported as a 9.9% non-voting stake. The program has therefore already evolved from grants into conditional ownership, which shows that Washington is willing to attach terms to capital.

Private capital has moved faster than public capital. PitchBook and the National Venture Capital Association report that US venture deal value reached $515.8bn through the third quarter, about 44% above the previous full-year record, with AI accounting for 82.7% of it, although AI’s share in the third quarter alone fell to 65.9%. Private equity put $45.7bn into US data centers in 2025, or 72% of the sector total, according to S&P Global Market Intelligence, driven largely by the $40bn Aligned Data Centers acquisition. Ropes & Gray reports that private credit now funds most early-stage data center development. The four largest hyperscalers are guiding to more than $720bn of 2026 capital spending, roughly triple the level of two years ago, according to The New York Times, and Alphabet and Meta reported negative free cash flow in the third quarter.

Capital layer	Latest figure	Source
CHIPS manufacturing incentives	$39bn; 35% tax credit for construction starting by end of 2026	CRS; Manufacturing Dive
US private AI investment, 2025	$285.9bn (China $12.4bn, Europe $20.9bn)	Stanford AI Index 2026
US venture deal value, through Q3 2026	$515.8bn, AI 82.7%	PitchBook-NVCA
Private equity in US data centers, 2025	$45.7bn, 72% of sector total	S&P Global Market Intelligence
Hyperscaler capex, 2026	More than $720bn	The New York Times, as reported
AI data center capex needed by 2030	$5.2tn baseline ($3.7tn to $7.9tn)	McKinsey

Stanford adds an important caveat: American private investment is 23 times China’s tracked figure, but Chinese government guidance funds deployed an estimated $184bn into AI firms between 2000 and 2023, and those funds sit outside the private total.

McKinsey warns that overbuilding risks stranded assets. The financing has also migrated from corporate cash flow toward outside capital, and the Bank for International Settlements observed on October 27 that hyperscaler bonds of ten years or more made up about 24% of corporate issuance at those maturities this year. My inference is that capital dependent on lenders is capital priced on perceived control.

What the midterm result changes

The Democratic wave described in Part 1 did not arrive in a vacuum. TIME’s pre-election reporting from Ohio shows how data centers became a campaign issue. Ohio hosts about 200 of them. A Gallup poll in May found that more than 70% of voters oppose an AI data center in their area; household electric bills in Ohio rose about 15% in a year and more than 66% over a decade; and a Bowling Green State University survey found nearly 80% of Ohioans support a moratorium.

Backlash indicator	Figure	Source
Voters opposing a local AI data center	More than 70%	Gallup, via TIME
Ohio household electric bill, past year	Up about 15%	TIME
Ohioans supporting a moratorium	Nearly 80%	Bowling Green State University, via TIME
Ohio local governments with moratoriums	More than 100	TIME
Data center broadcast advertising this cycle	$137.6m, 77% Democratic	AdImpact, via TIME

The post-election signals point the same way. GovCIO reports that Democrats won governorships in major data center markets, including Texas, Georgia, and Ohio; that Representative Zoe Lofgren is seeking the House Science Committee chair to continue oversight work; and that Representative Robert Garcia has signaled an aggressive investigative agenda at the Oversight Committee. In September, the House passed, 417 to 3, a bill requiring states to consider making large electricity users pay the added grid cost. S&P Global’s October analysis expects disclosure, transparency, and cost-allocation requirements to be more realistic than federal guardrails on data center growth. Meanwhile, Executive Order 14365 of December 2025 created a Justice Department task force to challenge state AI laws, yet Congress has not enacted preemption, and a Model Diplomat count, citing New York University, tallied 109 state AI laws and 28 data center statutes in the first half of 2026.

My reading, offered as judgment rather than forecast, is that the build-out continues on different terms. I expect ratepayer cost allocation, disclosure of counterparties and incentives, and congressional subpoenas reaching the AI supply chain. The 35% chip tax credit lapses for projects that start construction after 2026, which makes any extension a likely negotiating item in a divided Congress. Capital that arrives with transparent governance will clear faster than capital that does not.

Adoption is a governance problem

The strongest argument that governance creates competitive advantage comes from inside the firm. In the November to December Harvard Business Review, Das Narayandas of Harvard Business School describes organizations that approve AI systems formally but never grant them authority. Employees keep overriding the models because they remain personally accountable for outcomes. At a global bank, exceptions multiplied and temporary safeguards hardened into permanent steps, so the system never made most final decisions. He traces the same pattern through enterprise resource planning, automated credit scoring, and airline revenue management, showing that authority moved only where governance around the algorithm changed. UPS succeeded with its ORION routing system after it began measuring drivers against the prescribed route rather than their own history, making it professionally defensible to follow the algorithm. Aviation’s just culture offers the template: errors surface, and a clear boundary separates acceptable mistakes from misconduct.

For a CFO, this reframes the return on the capital described above. A $720bn capital program earns a return only if the systems it funds are allowed to decide. GRC is the machinery that makes that possible: decision-rights registers, logged and reviewed overrides, escalation thresholds, model monitoring and performance evaluations that do not punish people for following the system. Narayandas offers four questions to ask at approval, namely who loses discretion, who gains authority, who explains outcomes, and who absorbs transition risk. They read like control design.

The survey evidence is consistent, with the caveat that most of it shows association rather than causation. Deloitte finds that a ten-point increase in its AI governance index is associated with ten percentage points higher revenue growth among banks, yet only 13% of banks have reached the leading maturity stage. McKinsey’s 2026 AI Trust Maturity Survey of about 500 organizations found average responsible AI maturity rising to 2.3 from 2.0, with only about a third reaching level 3 in governance and agentic controls, and organizations with an explicit accountable function averaging 2.6 against 1.8 for those without one. BCG and MIT Sloan Management Review found that responsible AI leaders are twice as likely to realize business benefits.

Europe took the first step

The European Union’s AI Act is the most developed attempt to institutionalize this logic. Its penalties are tiered in Article 99.

Violation	Maximum fine	Source
Prohibited practices	EUR 35m or 7% of worldwide turnover	EU AI Act, Article 99
Other operator obligations	EUR 15m or 3%	EU AI Act, Article 99
Incorrect information	EUR 7.5m or 1%	EU AI Act, Article 99

As Part 1 noted, the Digital Omnibus deferred standalone high-risk obligations to December 2, 2027 and embedded systems to August 2, 2028, while transparency duties applied from August 2, 2026. The deferral occurred because harmonized standards were not ready, which is a lesson for American policymakers: a rule without assurance infrastructure creates delay, not safety. Europe also pairs regulation with capital. InvestAI aims to mobilize EUR 200bn, including a EUR 20bn fund for AI gigafactories. Yet Stanford puts European private AI investment at $20.9bn against $285.9bn in the United States, so regulation alone does not produce leadership. The finding I find most useful is that Stanford reports the EU is trusted more than either the United States or China to regulate AI effectively. Trust is a market asset, and Europe has claimed it.

Competing against rivals with fewer rules

The proposition that China wins because it regulates less misreads the competition. The Economist describes a state-coordinated model in which China’s five-year plan calls for AI-driven science, the government links datasets, models and computing power into a national stack, and XtalPi serves 17 of the world’s 20 largest pharmaceutical companies. That is heavy state involvement, not an absence of governance. Its advantage lies in coordinated data, compute, and direction. The American advantage is capital, open markets, and customers who can choose, and each of those depends on trust.

I see four channels through which American governance becomes an advantage.

• First, it lowers the cost of capital for a build-out that McKinsey sizes in the trillions, because lenders and insurers price control maturity.
• Second, it accelerates adoption, because the authority and accountability gap Narayandas describes is a drag no rival escapes.
• Third, it opens exports, since regulated buyers in Europe, in finance and in government, will require evidence of assurance.
• Fourth, it narrows loss events, and IBM’s 2026 data, cited in Part 1, shows that breach costs concentrate in ungoverned AI.

A single national baseline is preferable to the present patchwork, and I would anchor it on risk-management standards that firms can evidence, rather than on moratoriums. Voluntary frameworks such as the NIST AI Risk Management Framework offer a starting point. The risk on the other side is real: duplicative state rules raise costs for startups, and checklist compliance can replace judgment. The answer is proportionality, with obligations that scale with demonstrated risk.

Implementing GRC across the capital markets

For venture investors, governance belongs in diligence, particularly for companies deploying agents, where McKinsey finds controls are least mature.

For private equity and infrastructure sponsors, community consent, ratepayer cost allocation and incentive disclosure are now underwriting variables, as Ohio shows.

For corporate finance leaders, the work is an AI inventory, decision-rights mapping, override monitoring and incident playbooks, tied to scenario analysis of tariffs and power costs.

For public officials, the priorities are transparency requirements and assurance capacity before mandates.

Challenging the thesis

Three cautions apply.

• Governance does not rescue a mispriced asset: McKinsey flags stranded-asset risk, and the venture market is concentrated, with exits failing to keep pace with record deal value.
• Regulation can entrench incumbents who can afford compliance.
• And association in survey data is not proof that governance causes growth. The argument I defend is narrower: among firms and countries with comparable capital, the ones that make their systems trustworthy will deploy them faster and defend them better.

Closing thought

America does not need fewer rules to win the AI race. It needs rules, standards, and assurance that let $5.2tn of capital turn into systems that communities accept, lenders finance, and employees follow. The midterm result is a reminder that consent is revocable. GRC is how that consent is earned and kept.

Five questions to ponder

I would value your answers in the comments.

1. Is capital or public consent the binding constraint on your largest AI investment? Funding is abundant, yet local opposition has stalled projects that were fully financed.
2. What evidence of governance would you hand a regulator, a community, or a permitting body? Legitimacy is earned with documents and a track record, and it is needed before the capital can be deployed.
3. Are your lenders, sponsors, or investors asking about AI governance in diligence, and could you answer in numbers? The shift from narrative to evidence tends to arrive suddenly, at the worst moment in a transaction.
4. Which EU AI Act obligations apply to what you sell, and who owns the mapping? Fines run to EUR 35 million or 7% of turnover for the gravest breaches, and the clocks differ by product type.
5. The maturity studies show association, not causation. What internal measures would show your governance spending is changing outcomes? Without a baseline, a board cannot tell investment from theatre.

Sources: The Economist, September 19 and November 7, 2026 (as in Part 1). Harvard Business Review, November to December 2026, Das Narayandas. TIME, November 9, 2026 (Ohio data center reporting). Congressional Research Service, R49031, July 14, 2026. Manufacturing Dive, CHIPS Act award tracker. Stanford HAI, 2026 AI Index Report. PitchBook-NVCA Venture Monitor, Q3 2026. S&P Global Market Intelligence, May 12, 2026, and October 13, 2026. Ropes & Gray, Infrastructure Market Report, October 2026. McKinsey, The cost of compute, and State of AI trust in 2026. Deloitte, Banking on Trust. BCG and MIT SMR, Responsible AI. GovCIO Media, post-midterm outlook. Bloomberg Law, June 8, 2026. Universal Asset Owners, hyperscaler Q3 analysis (citing BIS). Model Diplomat, mid-2026 state AI laws. EU AI Act Article 99, artificialintelligenceact.eu. European Commission, InvestAI.

AI-assisted insights, supplemented by 25 years of finance leadership experience.