The Enforcement-Specification Failure Diagnostic: A Taxonomy for Distinguishing Governance Control Failures in Autonomous AI Incident Management

When an autonomous AI system causes a governance failure, the organisation must answer a question that most incident management frameworks do not ask: was this a failure of governance control enforcement, or a failure of governance control specification? An enforcement failure occurs when a governance control existed and was correctly specified but was absent, bypassed, or inoperative at the point of failure. A specification failure occurs when the governance controls operated as designed, but the design was insufficient to prevent the failure. These two failure types require categorically different remediation responses. Conflating them produces corrective and preventive action (CAPA) plans that address the wrong problem, consume governance resources on symptoms rather than causes, and leave the organisation exposed to recurrence. This paper introduces the Enforcement-Specification Failure Diagnostic (ESFD) as a named, structured taxonomy for distinguishing between these two failure types in AI governance incident management. It demonstrates that the major existing incident management frameworks, ISO/IEC 42001:2023, the NIST AI RMF, ISO 31000, and the regulatory incident management requirements under APRA CPS 230 and the EU AI Act, do not require this diagnostic distinction to be applied to AI governance incidents. It proposes a diagnostic protocol for applying the taxonomy, a typology of the four diagnostic outcomes that result from applying it, and a set of remediation principles calibrated to each outcome. It argues that the ESFD is not a refinement of existing incident management practice but a structural addition: the distinction between enforcement and specification failure is a necessary precondition for governance frameworks to improve from their own failure experience.