Security theatre AI governance: why AI policies that look thorough fail to change actual practice in nonprofit organisations
Security theatre in AI governance describes governance that looks thorough without being thorough. Named by security researcher Bruce Schneier, security theatre AI governance risk is directly relevant to community organisations: AI policies, ethics statements, and oversight frameworks that exist on paper but do not change what staff actually do constitute performative compliance rather than genuine governance. The appearance of responsible AI use is produced for external scrutiny while internal behaviour remains unchanged. This behavioural risk connects to normalisation of deviance, diffusion of responsibility, and goodhart’s law in the NFH Governance and Accountability theme, and underpins the NFH Behaviour Risk Card framework for nonprofit and community organisations.
Security Theatre
Governance that looks thorough without being thorough. AI policies and ethics statements that exist on paper but do not change what staff actually do. Also covers Performative Compliance: governance performed for external scrutiny rather than internal behaviour change.
Security theatre AI governance: why AI policies that look thorough fail to change actual practice in nonprofit organisations
Definition
What is Security Theatre in AI Governance?
Security theatre describes measures that provide the appearance of safety or governance without meaningfully reducing risk. The term was coined in security research to describe visible but ineffective interventions, such as airport screening procedures designed to reassure travellers rather than detect threats. Applied to AI governance, security theatre describes policies, frameworks, and oversight structures that signal responsible practice without changing actual behaviour.
Performative compliance is the organisational expression of security theatre: governance activity directed at external audiences rather than internal risk management. An organisation that produces an AI ethics statement for its website, conducts an annual AI governance review for its board, and trains staff in responsible AI use has performed compliance. Whether those activities have changed how AI is actually used on a Tuesday afternoon under deadline pressure is a different question entirely.
The Governance Gap
The gap between what governance documents say and what organisations do is not unique to AI. Regulatory compliance research consistently shows that organisations calibrate their visible governance activity to the level required to satisfy external scrutiny, not the level required to address the underlying risk. AI governance is subject to exactly this dynamic, and the relative novelty of AI in community organisations means that external scrutiny is still low enough that the bar for performative compliance is very easy to clear.
Research Origin
Schneier (2003) developed the concept of security theatre through his analysis of post-September 11 security measures, arguing that many high-visibility interventions were designed to make people feel safe rather than to make them safer. The distinction between real security and the feeling of security is not a minor one: resources spent on theatre are resources not spent on genuine risk reduction, and theatre can actively suppress attention to real vulnerabilities by producing false confidence.
Power (1997) identified audit as a primary mechanism of performative compliance in modern organisations. Formal audit processes, he argued, are often better understood as rituals of verification than as genuine risk management. They produce reassurance and legitimacy for external audiences while leaving internal practice largely unchanged. The audit society produces auditable organisations, not necessarily well-governed ones.
Brunsson (1989) theorised the organisation of hypocrisy: the systematic gap between what organisations say, what they decide, and what they do. Organisations maintain legitimacy by producing appropriate talk and formal decisions, while operational action follows its own logic. This is not deception in the conventional sense. It is a structural feature of how organisations manage competing demands from different audiences.
In AI Contexts
How Security Theatre Shows Up With AI
AI governance theatre takes predictable forms. Organisations publish AI use policies that staff have not read. They conduct AI risk assessments that do not capture how AI is actually being used. They establish AI ethics committees that meet infrequently and review documentation rather than practice. They require staff to complete AI training modules that address compliance requirements rather than the specific behavioural risks that arise in their actual work.
Visible Governance, Invisible Risk
Each of these activities produces something reviewable: a document, a meeting record, a training completion log. Collectively they produce an organisation that can demonstrate governance to a funder, regulator, or board. None of them necessarily address the question of what happens when a frontline worker uses an AI tool to draft a case note at 4:30pm on a Friday. Security theatre AI governance risk is highest precisely where external scrutiny is lowest and operational pressure is highest.
Why It Matters for Nonprofits
The Specific Risk for Community Organisations
Community organisations face particular pressure to demonstrate responsible governance to funders and regulators. That pressure creates exactly the conditions Brunsson identified: the incentive to produce governance talk and governance decisions that satisfy external audiences, while operational practice adapts to the real constraints of time, capacity, and competing demands.
When Theatre Becomes Liability
Security theatre becomes a liability when something goes wrong. An organisation whose AI governance consisted primarily of a policy document and an annual board report has no substantive governance to rely on when an AI-assisted decision causes harm to a client or community. The documentation that satisfied external scrutiny during normal operations provides no protection, and may actively worsen accountability exposure, when an incident requires explanation.
Genuine AI governance for community organisations does not require sophisticated infrastructure. It requires that the governance activity that exists actually changes what people do. The test is not whether a policy can be produced. It is whether practice would look different without it.
Security theatre in AI governance describes governance that looks thorough without being thorough. Named by security researcher Bruce Schneier, security theatre AI governance risk is directly relevant to community organisations: AI policies, ethics statements, and oversight frameworks that exist on paper but do not change what staff actually do constitute performative compliance rather than genuine governance. The appearance of responsible AI use is produced for external scrutiny while internal behaviour remains unchanged. This behavioural risk connects to normalisation of deviance, diffusion of responsibility, and goodhart’s law in the NFH Governance and Accountability theme, and underpins the NFH Behaviour Risk Card framework for nonprofit and community organisations.
Observable Signals
What to Watch For
These patterns suggest security theatre may be shaping AI governance in your organisation. They are signals worth naming and discussing, not a definitive checklist.
- AI governance documentation is more detailed and more current than staff knowledge of it, suggesting the documentation is produced for external audiences rather than to guide internal practice.
- AI governance reviews focus on whether policies exist and whether training has been completed, rather than on whether actual AI use matches the policies or whether training has changed behaviour.
- Staff can describe the organisation’s AI governance framework when asked, but cannot describe how it affects their specific day-to-day decisions about using AI tools.
Security theatre AI governance: why AI policies that look thorough fail to change actual practice in nonprofit organisations
Security theatre in AI governance describes governance that looks thorough without being thorough. Named by security researcher Bruce Schneier, security theatre AI governance risk is directly relevant to community organisations: AI policies, ethics statements, and oversight frameworks that exist on paper but do not change what staff actually do constitute performative compliance rather than genuine governance. The appearance of responsible AI use is produced for external scrutiny while internal behaviour remains unchanged. This behavioural risk connects to normalisation of deviance, diffusion of responsibility, and goodhart’s law in the NFH Governance and Accountability theme, and underpins the NFH Behaviour Risk Card framework for nonprofit and community organisations.
External References
- Schneier, B. (2003). Beyond Fear: Thinking Sensibly About Security in an Uncertain World. Copernicus Books.
- Power, M. (1997). The Audit Society: Rituals of Verification. Oxford University Press.
- Brunsson, N. (1989). The Organization of Hypocrisy: Talk, Decisions and Actions in Organizations. Wiley.
Related Lexicon Entries
From theory to practice
Understanding the risk is the first step.
The NFH Toolkit gives your organisation practical tools to test whether AI governance is changing actual practice, not just producing documentation. The Behaviour Risk Cards name this pattern in language your whole team can use.
Not For Humans: Because AI’s greatest risk isn’t technical, it’s Human.