Voluntary Now, Expected Later

There is a reliable sequence in how commercial expectations harden, and it almost never runs through enforcement. Something appears as a voluntary framework. A few hundred organizations sign it. Procurement teams, who need a reference point rather than a law, start asking whether suppliers align with it. Within a couple of years the voluntary thing is a de facto requirement for anyone selling to a large organization, and no regulator ever had to act.

We are at the second step of that sequence for AI transparency. A voluntary code exists, roughly 190 organizations signed in its first weeks, and about half of them were small or recently founded firms. None of that is binding on anyone. All of it is the raw material from which a baseline gets built.

Why procurement does the work

The people writing supplier questionnaires are not lawyers looking for obligations, they are risk owners looking for something concrete to ask about. Before a published framework exists, they improvise, which is why early AI questions in tenders were vague and inconsistent. Once a named document exists with specific commitments in it, improvisation stops. The question becomes whether you align with the thing that already exists, because that is cheaper to ask and easier to score.

This is how information security went. Standards that began as voluntary became, through procurement rather than legislation, the price of bidding for serious work. Nobody made certification legally mandatory. It simply became the case that without it you were not in the conversation, and firms that treated it as optional discovered the change retrospectively, from the outside of a shortlist.

The window is the opportunity

The useful thing about being at step two is that it is the cheapest point to act. Commitments made while something is voluntary cost an afternoon of honest assessment. The same commitments made when a client is asking, with a deadline and a half-finished questionnaire open, cost considerably more and produce worse answers, because they are written to satisfy the form rather than describe the work.

There is also an asymmetry that favors acting early, and it is the same one that makes a review record valuable. Evidence of practice cannot be produced retroactively at any useful quality. A firm that has been running structured review for a year has artifacts with dates on them, tied to real engagements. A firm that starts in the week before a pitch has a policy document and an assertion, and the difference is visible to anyone who looks.

What not to conclude from this

None of it is an argument for signing everything available. A commitment you cannot evidence is worse than no commitment, because it converts a gap into a documented one, and a firm that signs a transparency code without being able to show what was checked on a specific piece of client work has made its position weaker rather than stronger.

The sequence that works is the unglamorous one: make the review real, then describe it. Teams reach for the describing step first because it is faster and feels like progress, and it is the step that produces nothing on its own. The order is the whole argument, and it does not change whether the framework in question is voluntary, binding, or somewhere in between.

Qonera is the AI governance platform for professional teams, built around a structured review and approval workflow in which the evidence of review accumulates automatically: sources audited, claims cited to the passages behind them, disagreement between independent models surfaced rather than resolved quietly, and named sign-off written to a tamper evident audit trail that exports for client assurance. Our own security and data commitments are published on the trust page. Voluntary frameworks are the early warning, not the obligation, and the firms that read them that way tend to be the ones with an easy answer two years later.