Conway's Law doesn't care about your AI strategy.

In 1967, Melvin Conway observed that organisations design systems which mirror their own communication structure. The observation has since been validated empirically — most rigorously by Forsgren, Humble, and Kim in Accelerate, which found that loosely coupled architectures correlate strongly with high delivery performance, and that the organisations achieving them had deliberately restructured their teams to match the architecture they wanted, not the architecture they had.

Conway's Law is not an argument against ambitious AI architecture. It is an argument about sequence. The architecture your AI strategy describes will be built. It will then be operated by the organisation that built it — and that organisation will, over time, build integrations, workarounds, and dependencies that reflect its own communication structure. An architecture designed for a unified platform, built by a fragmented organisation, will fragment. The process is gradual, invisible in any individual decision, and essentially irreversible without a deliberate reorganisation.

The Target breach of 2013 is instructive here — not because it was an AI failure, but because it was a security failure caused directly by the gap between Target's stated security architecture and the organisational structure that operated it. The architectural standard said one thing. The communication structure — which vendor had access to which network segment, which team owned which monitoring alert — said another. The gap between them is where the attackers moved for 15 days undetected.

How Conway's Law manifests in enterprise AI

The Target breach investigation, documented in the Senate Commerce Committee's 2014 report, established that attackers entered through a third-party HVAC vendor's credentials and moved laterally through Target's network to the point-of-sale systems. The network segmentation that should have prevented this was defined in the security architecture. It was not reflected in the access control structure the vendor management team had actually implemented — because the vendor management team and the security architecture team had no formal communication structure that would have surfaced the discrepancy before it became a breach.

In enterprise AI, the equivalent pattern is pervasive. The AI strategy describes shared feature stores, unified data governance, centralised model registries, and consistent risk management across business units. The organisation implementing it has a data engineering team, an ML platform team, several business unit analytics teams, a risk and compliance function, and a vendor management function — none of which have formal communication structures that would naturally produce the unified architecture the strategy describes. What they produce instead is what Conway's Law predicts: a collection of systems that mirror the communication boundaries between those teams.

The resolution that Accelerate identifies — and that the Target case illustrates in the negative — is the Inverse Conway Manoeuvre: designing the team and communication structure first, and then building the architecture that the resulting communication structure will naturally produce. This is not a cultural programme. It is an architectural design decision about which team owns which component boundary, and a governance decision about which communication paths are mandatory rather than optional.

The org chart test

The practical test for Conway's Law alignment in an AI architecture is simple and can be run in an afternoon. Draw the architecture. Then overlay the org chart. For each interface in the architecture — each point where two components communicate — identify which team owns each component. If the two teams do not have a formal, regular communication structure, that interface will accumulate technical debt as each team makes independent decisions about the component they own.

Any interface that crosses a vendor boundary without a formal technical governance relationship is at the same structural risk as Target's HVAC vendor access. The vendor owns one component. The internal team owns the adjacent one. They communicate commercially, not technically. The access control structure, the change management process, and the monitoring responsibility will each be defined by that commercial relationship — not by the security or data architecture.

The Inverse Conway Manoeuvre for AI platforms

Accelerate's finding is that the highest-performing organisations do not try to impose a desired architecture on an existing org structure. They redesign the team structure to match the architecture they want — explicitly, before the architecture is built, as a governance decision rather than an engineering one.

For an enterprise AI platform, the Inverse Conway Manoeuvre means three things. First: a named team that owns each component boundary in the target architecture. Not a function. Not a department. A team with a defined membership and a defined communication cadence with every adjacent team. Second: mandatory interface contracts between those teams — not informal agreements, but versioned documents that are change-controlled and reviewed on the same cadence as the architecture itself. Third: governance representation for the risk and compliance function at the interface level, not just at the policy level — because a compliance function that cannot read the system's outputs cannot govern the system's risk.