In the ashes of Terra, we stopped trusting the whitepaper and started reading the multisig. Brussels has just handed the AI industry a new multisig to read โ and almost nobody in the crypto news cycle is looking at the keys.
While attention was pinned to ETF flow tables, the European Ombudsman opened an inquiry into the European Commission's appointment of Jim Hagemann Snabe โ chairman of Siemens' supervisory board, former chairman of A.P. Moller-Maersk โ as its informal "AI envoy." On its face, the story reads like a slow-motion ethics seminar: watchdog prods executive, executive says nothing, nothing happens. That reading is wrong.
Strip the names away and what remains is an architecture problem. A public body appointed an individual to influence public policy. That individual's primary employer is a directly regulated entity under the very rulebook in question. The appointment was not competitively posted. No conflict-of-interest declaration has been published. No recusal protocol has been published. No mandate has been published.
That is not a scandal. That is a schema โ and the schema has a hole in it.
To understand why this inquiry matters, you have to understand what the European Commission was trying to buy with the appointment.
The EU AI Act is not a single law that switched on. It is a phased deployment. Prohibited-practice bans took effect first. General-purpose AI (GPAI) obligations for model providers followed. The high-risk system obligations โ the ones carrying actual technical documentation, conformity assessment, and post-market monitoring burdens โ are still rolling out. Every one of those phases requires delegated acts, implementing guidance, harmonized standards, and classification thresholds. Those thresholds decide whether a company spends six figures or eight on compliance.
That is where an "AI envoy" becomes interesting. An envoy is not a regulator. An envoy is not a commissioner. An envoy is an informal, unpaid advisor who gets a seat at the table where the agenda is set โ before the formal text exists, before lobbyist registration kicks in, before anyone files a disclosure. In governance terms, it is the closest thing to an admin key you will find inside a parliamentary system.
Siemens, meanwhile, is not a bystander. It is one of Europe's flagship industrial AI players โ digital twins, the Xcelerator platform, deep partnerships with NVIDIA and Microsoft across industrial metaverse and simulation workloads. It is also, unambiguously, in scope of the AI Act. Its own products and its customers' deployments are shaped by the classification rules the envoy would help frame.
Based on my audit experience, I look for the same three things in every governance structure: who holds the keys, what the keys open, and what happens when a keyholder has a reason to turn the key the wrong way. Here the answers are: an individual, the agenda-setting layer of EU AI policy, and nothing structured.
Failure one: "informal and unpaid" is a procedural bypass, not a safeguard.
I want to be precise, because the comfortable version of this story is that unpaid equals harmless. That is false. Compensation is a proxy for accountability, not for influence. The most consequential positions in any protocol are frequently the uncompensated ones โ multisig signers, core developers, foundation directors. Nobody pays them. Everybody answers to them.
In the 2017 Bitcoin.com primary token sale, I ran a static analysis of the distribution logic and found a centralization risk buried in the multisig wallet structure. The sale documentation presented decentralization as an outcome of distribution math. The contract presented something different: a small set of addresses with upgrade authority. Nobody had paid those signers either. Payment was never the mechanism of control. Key possession was.
The same read applies here. An unpaid envoy who pre-shapes the Commission's AI agenda has, functionally, upgrade authority over the direction of the rulebook. Whether that authority is compensated is a bookkeeping question. Whether it is disclosed, scoped, and revocable is a governance question. Only one of those two questions has been answered, and the answer is no.
Failure two: there is no enforced recusal, and there is no ledger to check.
My 2020 Uniswap V2 governance sessions turned out to be useful training for reading EU institutions. The question that reliably terrified new users was not impermanent loss. It was: who can change the rules after I deposit? The answer โ a multisig, a timelock, a governance vote โ mattered far less than the visibility. Traders could tolerate concentrated control if they could see it. They could not tolerate invisible control.
EU AI governance right now is the invisible kind. If the envoy participates in a discussion touching Siemens' compliance posture, what happens? Is there a written recusal? Who records it? Is the record public? On-chain, an abstention is a transaction: observable, timestamped, attributable. In the Commission's advisory layer, an abstention is a rumor.
That asymmetry is the entire story. The AI Act is being built to impose auditability on AI systems โ documentation, logging, traceability, human oversight. Meanwhile the human oversight of the AI Act itself has no logging requirement. We are writing the most demanding transparency regime in the world for models, and exempting the humans who write it from the same standard.
And capacity compounds the problem the way blob space does. Post-Dencun, blob capacity looked effectively infinite until rollups filled it; the constraint arrived not when usage spiked but when the architecture had already been locked in. Oversight capacity behaves identically. It looks adequate until you appoint insiders to supervise themselves, and by then you are issuing guidance rather than building guardrails.
Failure three: the teeth are soft, and soft teeth set the precedent.
The European Ombudsman does not fine anyone. It does not void appointments. Its toolkit runs to findings of maladministration, recommendations, and in rare cases special reports to Parliament. This is a soft fork โ a rules change that nodes are free to ignore. Historically, Ombudsman recommendations carry reputational weight and are often followed. But "often followed" is not "enforced."
Which means the deterrence value here is entirely reputational, and reputational deterrents only work if the reputational cost exceeds the policy benefit of the appointment. For a Commission that believes it is losing an AI race, the benefit of an industry-friendly envoy may well exceed a paragraph of criticism.
Notice what a soft outcome would teach. If the inquiry closes with a recommendation and no structural change, the precedent is that informal advisory roles are the safe harbor for exactly this arrangement. The next appointment โ clean tech, quantum, semiconductors โ copies the pattern. Precedent in governance is code. Once it ships, forks get harder.
The comparison that names the problem: shadow governance.
I want to run this through the DeFi layer, because the analogy is clarifying rather than cute.
For two years I have argued that "liquidity fragmentation" as a diagnosis is largely a manufactured narrative โ a framing VCs and product teams use to justify new aggregators, new intents layers, new routers. The fragmentation is real; the claim that it is the binding constraint is not. The binding constraint is that fees accrue to whoever owns the routing layer, and new products need a story to justify capturing that layer.
EU AI governance has its own manufactured narrative. The story is: Europe is losing the AI race, therefore it must be pragmatic, therefore it must bring industry insiders into the policy layer. The first two clauses may be true. The third does not follow. Bringing an insider into the advisory layer does not make Europe faster; it makes the rulebook's authorship less contestable. That is a distinct outcome wearing the costume of a competitiveness measure.
Once you see it that way, the crypto-adjacent framing becomes unavoidable. Advisory positions that confer directional influence over public policy โ without dividend rights, without liability, without disclosure โ are the governance analogue of a token that pays nothing but confers control. I have said this about DAO governance tokens for years: non-dividend equity with no enforceable claim is a claim on the next buyer, not on the protocol. Informal policy advisors are the same shape. The value is in being there before the rule is written. The exit is the rule itself.
Here is the part I think the AI press has missed, and the part the crypto press has been slow to claim.
The contrarian read is not "the EU is captured." It is that the probe itself is the strongest evidence the EU's governance architecture is functioning โ and that the likely remedy will be worse than the disease.
Two claims, unpacked.
First: the inquiry exists. Nobody had to leak it to a tabloid. A European institution's own oversight mechanism looked at an appointment and asked for the paperwork. Compare that to jurisdictions where the equivalent appointment would never surface, or where the oversight body would be defunded before it could ask. From a governance-design standpoint, the Ombudsman's involvement is the timelock firing. It is evidence of a working check.
Second, and more uncomfortable: the likely corrective is a conflict-of-interest declaration form. A checkbox. A PDF. Perhaps a voluntary register. That is not a fix; that is theatre with a filing deadline. Declarations do not prevent capture. They document it after the fact. We know this because we already ran the experiment โ in crypto, and it failed.
In the ashes of Terra, we learned the difference between disclosure and verifiability, and we learned it at a cost most of us still feel. A team can disclose a token allocation and still control supply. A foundation can publish a multisig address and still operate under an unwritten agreement among signers. The Terra mechanisms were visible to anyone who read them. That was a comprehension failure, not a disclosure failure โ disclosure without a legible, verifiable standard.
The EU is now one form away from replicating that exact failure mode at the level of AI policy.
What would actually fix this is boring and structural: a published mandate with enumerated scope. A mandatory recusal protocol with a public log. A term limit. In other words, an attestation layer. Not a promise โ a record.
The irony is thick enough to cut. This industry spent a decade arguing that disclosure is not the same as verifiability, and that "trust me" is not an architecture. It is now watching a regulatory bloc rediscover that lesson in slow motion โ while the same industry's own DeFi governance remains a live example of the pattern it should be criticizing.
So here is where I land, and what I will be tracking.
I am not watching for a resignation. I am watching the format of the outcome. A decision with structural recommendations is a different animal from a closed inquiry with a note. The format tells you whether the Ombudsman treated this as an isolated appointment or as a design flaw. If it is the latter, the read-across to other envoys โ clean tech, semiconductors, quantum โ becomes the real story, because that tells you whether the "informal advisor" channel is a one-off or the Commission's default method of importing industry preference into the pre-legislative layer.
I am watching whether a conflict-of-interest registry appears, and whether it has teeth: mandatory recusal, public logs, term limits. A register without a recusal log is a guestbook.
I am watching whether the AI Act's own implementation guidance holds the standard it imposes. If the rulebook demands logging and human oversight from models but not from the humans who write the rules, that tells you which way the simplification agenda is actually cutting.
And I am watching the talent market. If "industrial executive becomes unpaid public AI envoy" survives this inquiry intact, it becomes a career path โ and once a governance pattern becomes a career path, it stops being a policy choice and starts being infrastructure.
In the ashes of Terra, we learned that the thing worth auditing is never the marketing. It is the key schedule. Brussels just published a key schedule with one name in it and no rotation policy. Whether the Ombudsman writes the rotation policy โ or just a memo โ is the whole question.
So: when a governance layer has no logging requirement for its own operators, what exactly is it governing?
