The market that law will make

There is a comforting story people tell about how good ideas win. A better way of doing things appears, its advantages are self-evident, buyers recognize the value, and adoption follows in a smooth curve as the market rewards the superior product. It is a nice story, and for a certain class of trust infrastructure it is almost entirely false. Audited financial statements, safety certification, environmental testing, data-protection compliance — none of these industries was summoned into existence by customers who woke up one morning wanting them. They were summoned by law, and by the liability that law made unavoidable. The demand came second. The requirement came first.

This distinction matters more than it sounds, because it changes how you read the timing and the size of a market. If you believe accountability infrastructure spreads because buyers appreciate it, you will forecast a gentle diffusion driven by return on investment, and you will be wrong about both when it arrives and how much of it arrives at once. Trust markets do not diffuse. They snap into being on a deadline. Understanding that is the whole of understanding where the market for decision accountability is going.

How trust markets are actually made

Consider the auditor. The independent audit of a company's accounts is now so embedded in commercial life that it reads as a natural feature of capitalism, like double-entry bookkeeping. But the modern audit profession did not grow because managers craved an outside party to check their numbers; managers, on the whole, would prefer no such thing. It grew because the law came to require it — because a series of failures and frauds made the unverified account intolerable, and legislatures responded by making the audit mandatory for whole categories of company. The demand for auditors is, to this day, overwhelmingly a legal demand. Repeal the requirement and the market would not vanish, but it would contract to a fraction of itself overnight. The service is bought because it must be.

The pattern repeats wherever trust has been industrialized. Safety certification — the tested-and-marked reassurance that a boiler will not burst or a wire will not ignite — became a market when liability and regulation made the uncertified product a risk no manufacturer, insurer, or retailer would carry. Environmental testing became a market when discharge and contamination became legal exposures rather than externalities. Data-protection compliance became a market, and a large one, when statutes attached real consequences to mishandling personal information; the privacy officer and the compliance vendor are children of the regulation, not of a spontaneous corporate conscience. In each case the sequence is identical. First something goes wrong badly enough, or often enough, that responsibility must be assigned. Then the law or the courts assign it. Then a market appears to supply the evidence that responsibility was discharged. Virtue is not the engine. Liability is.

What all these markets sell, underneath the particulars, is the same thing: an examinable record that someone can be made to produce when they are called to account. The audit is a record of the numbers. The certificate is a record of the test. The compliance file is a record of the safeguard. The good being traded is not safety or accuracy in the abstract — it is defensibility, the ability to show, to a party with the power to impose costs, that you did what you were supposed to do and can prove it.

Why the same forces are turning toward machine decisions

Now watch the same forces gather around automated decisions. I want to be careful here, because this is a domain where confident specifics are usually wrong and often invented. I am not going to tell you that a particular statute mandates a particular record by a particular date. I am going to argue about direction, and the direction is not subtle.

The general movement of law and regulation as it approaches consequential automated decisions points consistently toward the same handful of obligations: that decisions affecting people be documented, that they be contestable, that records be kept and produced on demand, that a human account of what happened can be reconstructed after the fact. Different jurisdictions arrive by different routes and different vocabularies, but the vector is common — toward transparency, record-keeping, and the right to challenge. Regulators do not, in the end, ask machines to be wise. They ask their operators to be able to show their work.

Liability is moving in parallel, and liability does not wait for statutes. As automated systems take actions with real consequences — extending or denying credit, screening candidates, flagging claims, allocating care, steering machinery — the ordinary machinery of responsibility follows them there. When an automated decision causes a harm, the question a court, a regulator, or a counterparty asks is the oldest one there is: what happened, on what basis, and can you prove it. An operator who can answer has a defense. An operator who cannot has a loss. That asymmetry, repeated across enough disputes, is exactly the pressure that made the unaudited account and the uncertified boiler untenable.

And behind the courts stand the parties who price risk for a living. Insurers and auditors do not need a regulator to tell them that a decision whose basis cannot be examined is a decision whose risk cannot be assessed. As they come to underwrite and attest to automated systems, they will demand what they have always demanded of everything else they cover — an examinable record, produced to their specification, as the condition of the coverage or the sign-off. The insurance argument and the assurance argument arrive at the same requirement from opposite ends of the room: before I stand behind this, show me the record.

No one bought fire insurance for the love of it; they bought it because the alternative became unaffordable — and accountability will be sold the day the indefensible decision becomes a liability nobody will underwrite.

What the record has to contain is not mysterious, and it is not a Summit invention; it is the shape any legal system already recognizes as evidence. It has to preserve what was actually known and considered at the moment of the decision — the real inputs, not a flattering reconstruction. It has to carry the rules that were in force at the time, so the question of whether the decision followed them can be answered without rewriting history. And it has to be reproducible enough that a skeptic can replay the decision and see for themselves, rather than being asked to trust a narrative composed afterward. A Decision Receipt with genuine provenance and the standing to be contested is not a product feature in search of a buyer. It is the coming legal requirement, described in advance.

What this means for the shape and the timing

If the market for decision accountability is made by law and liability rather than by voluntary appreciation, then it will not behave like a normal technology market, and forecasting it as one will mislead you in a specific direction: you will expect it too late and too small. Compliance markets do not ramp. They step. They are quiet, and then a deadline lands, or a precedent-setting case is decided, or a procurement requirement changes, and demand that was theoretical becomes mandatory across an entire category at once. The buyers were not persuaded. They were required. The curve that looked like a slow adoption S turns out, in retrospect, to have been a cliff with a date on it.

Three triggers tend to do the stepping. A compliance deadline converts a diffuse expectation into a hard purchase order with a calendar attached. A precedent-setting liability event — the first time an operator loses badly for being unable to account for an automated decision — reprices the risk for everyone watching, and everyone is watching. And a procurement requirement, once a large enough buyer or agency insists on examinable decision records as a condition of doing business, propagates the requirement down every supply chain that wants the contract. Any one of these can arrive faster than an ROI-driven model would predict, because none of them runs on ROI. They run on responsibility.

This is why the market for decision accountability will appear to arrive suddenly — the way compliance markets always do, which is to say the way that looks like an overnight surprise only to those who were pricing it as a matter of taste. It will not feel like buyers discovering they want examinable records. It will feel like buyers discovering they can no longer operate without them. The demand is being manufactured right now, in draft regulations and early disputes and the quiet recalculations of the people who underwrite risk, and it is being manufactured by the most reliable engine there is for creating trust markets: the moment someone is held responsible and has to prove they were not at fault. I have written elsewhere, in Admissible Reality and on the Warrant podcast, about what such a record has to be to earn its standing. The argument here is narrower and, for anyone weighing the market, more decisive: the demand is not a question of whether it will be wanted. It is a question of when it will be required — and requirements, unlike preferences, come with dates.

— Dispatches · Summit Cognitive