AI Governance: Nobody Opted In, and the Terms Moved Anyway

On 28 October 2026, Google made every live Search, Shopping and Performance Max campaign in ten countries, New Zealand among them, automatically eligible to serve ads inside AI Mode, its generative search surface. There was no new campaign to build, no opt-in screen, and no separate budget line. Nothing on the account side changed. The campaigns already running simply became eligible to appear inside a different surface, the moment Google moved the switch. That surface was not the one the original budget was approved against. Nobody who signed off on that budget was asked whether it should now reach there too.

Google's own announcement names Australia, Canada, India, Kenya, Malaysia, New Zealand, Nigeria, Pakistan, the Philippines and Singapore. Brazil, Mexico and the United Kingdom follow before the end of the year. It states that sponsored product listings inside AI Mode are already drawing click-through rates "already similar" to organic ones [1]. That document does not state the mechanism. For that, a reader has to go to a second, separate Google page, written for advertisers rather than for the press. In nine words of its own, that page says plainly that "advertisers don't need to create new campaigns or set up separate budgets" to show up with their ads in AI Overviews or AI Mode, and that existing Search, Shopping and Performance Max campaigns are automatically eligible to serve there [2]. That second page also carries two caveats the announcement omits entirely. Indonesia is eligible for AI Overviews only, not the full AI Mode surface. Pakistan is eligible for text ads only, not Shopping. New Zealand carries neither caveat on either document. Two trade outlets covering the story framed it plainly: advertisers "can't opt out" [3]. The next wave of markets, the United Kingdom and Brazil among them, is already scheduled for the current quarter [4].

AI Mode itself is Google's generative answer surface, the conversational layer that sits alongside, and increasingly ahead of, the traditional ten blue links. Google itself, quoted in The Hallucination Economy, put the scale of it this way at its own developer conference in May 2026: "Just one year after its debut, AI Mode has surpassed one billion monthly users," with queries it said were more than doubling every quarter since launch. That is Google's own figure, about Google's own product. No share of overall Search users or queries was ever supplied alongside it, then or now. The pattern repeats this week. Google states exactly what changed and precisely where, in its own words, on its own schedule. It leaves the reader to work out how much of anything that change actually touches.

That is the part worth sitting with before the ten-country list gets interesting at all. A marketing team approved a Search budget for a Search surface. A generative answer surface is a different reading experience, a different position on the page, and, per Google's own numbers, a different click-through profile. None of that was re-approved. It was switched on.

A Search ad and an AI Mode ad are not interchangeable placements wearing the same invoice line. A Search ad sits beside a ranked list the user is actively scanning. The user there is primed to compare. An AI Mode ad sits inside, or beside, a generated answer the user reads as a conclusion rather than a menu. That changes what trust the placement borrows and what tone the creative needs to earn it. A campaign written and approved for one context does not automatically read well, or even appropriately, in the other. Nobody on the vendor side is obliged to check that it does before switching the surface on.

The mechanism, not the map

Separate the finding from its geography and the shape becomes clear. This is a story about who controls the terms of an existing commitment, and when those terms can move without the other party's involvement. A business signs up to run a Search campaign. The platform, months or years later, decides that campaign now also serves somewhere else. The customer did not ask for this, and was not asked about it. In most cases, they will not notice until a line on an invoice or a dashboard shows traffic from a surface they never selected.

Picture an ordinary mid-sized New Zealand business running a modest, long-standing Performance Max campaign, approved eighteen months ago under a delegated authority limit that has not been revisited since. On 28 October, nothing in that business's own systems changed. No notification landed in anyone's inbox that named this specific switch. The campaign began serving somewhere new. The terms travelled with the account rather than with a fresh approval, and the marketing lead never signed them. It is the default outcome for almost any organisation, careless or not, that has not specifically built a process to catch exactly this kind of change.

That reading is an argued conclusion, not a settled legal one. Whether this constitutes a contract variation in the formal sense is a question for a contracts lawyer, not for this article. So is whether any New Zealand advertiser's terms of service with Google already anticipate exactly this kind of platform-side change. What is not in dispute is the practical shape of the event. Existing governance machinery already exists in most organisations to answer a question like this one: delegated authority limits on marketing spend, a standing review process for vendor-side changes. Whether anyone pointed that machinery at this change on 28 October, or the change simply happened underneath a budget nobody revisited, is the open question.

Alphabet executives reportedly told the company's Q3 2026 earnings call that AI Mode's monetisation was running behind what Google itself was spending to build it [5]. That frames this expansion as a move under commercial pressure as much as a product milestone. The claim comes from a single trade outlet, and Alphabet's own earnings call transcript was not directly reviewed for this article.

A second instrument, a different vendor

One day after Google's expansion took effect, a second vendor made a comparable move in a different register. On 29 October 2026, Mistral AI released the weights for Mistral Large 4 under what it calls the Mistral Ecosystem Open-Weight Licence, which the company itself describes as "a modified MIT license" [6]. Buried in that modification is a carve-out stated by Mistral in its own words: "businesses that operate a Model-as-a-Service offering must obtain a separate commercial license from Mistral" [6]. The model itself is substantial. It carries 52 billion active parameters inside a 1.05 trillion parameter total, with a 1.6 billion parameter vision encoder, trained on infrastructure Mistral describes as European [6].

Set beside Mistral's own page for its previous flagship, the shift reads as more than a wording change. Mistral Large 3 shipped, in the company's own words, under "the Apache 2.0 license," stated plainly for both the base and instruction-tuned variants, with no carve-out of any kind [7]. A reader who meets only the Large 4 announcement has no way to know the licence changed class at all. "Open weight" describes what you can download. It says nothing, by itself, about what you are permitted to do with it once you have it. The permitted uses moved between one flagship release and the next.

The practical sting is in who the carve-out actually reaches. An enterprise that downloads Large 4's weights and runs the model privately, behind its own firewall, for its own staff, is not touched by the Model-as-a-Service clause at all. The clause is aimed squarely at anyone who takes those weights and resells access to them as a hosted endpoint. That is the exact shape of a growing secondary market: smaller inference providers who undercut the frontier labs' own API pricing by running open weights on cheaper infrastructure. An organisation may have chosen Mistral specifically because a cheaper third-party host made the model viable on its budget. That host may now face a licensing conversation with Mistral it did not previously need to have. The cost or availability consequences land on the customer, even though the customer changed nothing at all.

This is not the same event as Google's. The mechanics are different: one is a platform-side eligibility switch on an existing advertising account, the other is a licence text attached to a new model release. But the shape underneath is the same. A vendor changed a term that governs an existing relationship, under a label, "ads," "open weight," that implies continuity. The change arrived through the vendor's own publication schedule, not through anything the customer initiated. Z.ai's GLM-5.3 moved from a permissive to a tailored licence in August. Mistral's own move here is the third time this series has tracked that exact shape, on a different vendor and a different licence pair each time. The pattern is becoming a category, not a coincidence.

The condition that sits underneath both findings is one this series has named before: a capability nobody provisioned, arriving inside a surface or a model somebody already signed off on. It reshapes what that signoff actually covers. Call it what it has been called here previously: a tool nobody provisioned. The ad-surface switch and the licence-class shift are both instances of the same governance gap, arriving from the vendor side rather than the user side.

New Zealand's own position

New Zealand sits cleanly on both of Google's documents, the announcement and the eligibility page, with no market-specific caveat of the kind attached to Indonesia or Pakistan. A direct search for New Zealand trade or business coverage of this specific event found none. The nearest results covered a different, earlier AI Mode feature launch and a general piece on AI-chatbot advertising from earlier in the year, neither of which names this rollout.

The first notice a New Zealand business gets of this change is unlikely to come from the trade press. It is more likely to come from a marketing or finance team member noticing an unfamiliar line in a Google Ads report, weeks after the switch already moved. No New Zealand regulator, government agency, or minister is engaged by either finding in this article. Google and Mistral are both private companies operating under their own published terms, and nothing here touches New Zealand government policy, procurement, or performance.

New Zealand's own exposure here is a function of scale rather than any local peculiarity. A smaller market with a thinner trade press watching global platform announcements is, almost by definition, slower to surface a change like this one in public commentary. That is precisely why the organisation's own internal watch matters more here than in a market where a dozen outlets would have covered the switch within a day of it happening. The gap this article is describing does not close because a market is small. If anything, it widens, because the external check a business might otherwise lean on is thinner to begin with.

Finding the clause before it finds you

The practical answer to a vendor-side change like this one is pointing the oversight that already exists at the right question. Most organisations already have a delegated authority limit on marketing spend, and most already have some form of vendor-change review built into procurement or legal processes. Nobody assigned that mechanism to watch for this specific kind of change, because until a vendor actually makes one, the change looks hypothetical.

A workable version of that assignment has four parts. First, find the clause: read the terms of service for every AI vendor a budget currently runs against, specifically the sections governing eligibility, placement, and licensing, not just price. Second, name the watcher: assign a specific person or role, not a general "marketing" or "IT" catch-all, to read vendor changelogs and policy updates on a set cadence. Third, set the cadence. Quarterly is defensible for a Search budget. Monthly is more defensible for anything running against a frontier model whose licence terms have already shown they can move between one release and the next. Fourth, write it down: when a vendor-side change is noticed, record the decision taken, approved, flagged, escalated, in the same place the original budget approval lives, so the next reviewer is not starting from zero. None of this requires new governance infrastructure. It requires pointing the infrastructure that already exists at a question it was not previously asked.

Applied to this week specifically, the four steps are not abstract. The clause to find is the eligibility language inside Google's own Ads Help page, not the press announcement, because that is where the actual mechanism and the market-specific caveats live. The watcher for a marketing budget should already be reading Google's advertiser-facing documentation, not just its press releases, on the understanding that the two do not say the same thing. The cadence for a model licence is tighter than for an ad platform. A model vendor can ship a new flagship, and a new licence class with it, inside a single release cycle measured in weeks rather than years. The written record is different again. Any organisation already running Mistral's weights through a third-party host should now note explicitly that the Large 4 generation carries a Model-as-a-Service carve-out Large 3 did not. That way, the next person who inherits that vendor relationship is not starting the same research this article just did.

The open-source dimension

The open-source dimension here is not a side note. It is the reason the Mistral finding is checkable at all. Mistral publishes its full licence text, for both Large 3 and Large 4, on its own site, in English, dated. A closed, API-only model could make the identical commercial decision, tightening how a hosted reseller may use it, without leaving any inspectable trace a customer could compare against yesterday's version. Open weights do not guarantee good terms; Large 4's carve-out is less permissive than Large 3's, by design, and that is Mistral's own commercial choice to make. What open publication guarantees is a paper trail. The before and the after both sit on the public record, dated and attributable, which is exactly what let this article compare them in the first place rather than take anyone's word for what changed.

The implication on the sovereignty side is the same shape, read one level up. A government's standing arrangement with a frontier AI lab, a security review, a compute allocation, a usage tier, sits downstream of the same kind of vendor-side setting. That is what moved Google's ad eligibility and Mistral's licence class this week. The European Union's EuroHPC Joint Undertaking is the sovereign supercomputing programme built so a European frontier model never has to depend on infrastructure the EU does not itself control. NATO's Defence Innovation Accelerator for the North Atlantic, DIANA, is a different kind of instrument, a capability-adoption accelerator rather than a compute programme. Both aim at a shared underlying question: who decides the terms a frontier model is used under, once it is trained, and on whose hardware it runs. A defence ministry that signed off under one compute allocation or one licensing assumption has no standing mechanism that fires when the vendor, or the infrastructure owner, moves that allocation unasked. The procurement question is structurally the same one a marketing team should be asking: who is told when the terms change, and does that person have the authority to act.

Neither finding in this article required an unusual amount of digging. Google's own eligibility page and Mistral's own two licence pages are all public, all dated, and all written by the vendor in its own words. The work was reading them against each other rather than against the trade coverage of them. That is a cheaper form of governance than it sounds: it does not need a new committee, a new tool, or a new budget line. It needs someone who reads the vendor's own publication schedule as carefully as the vendor wrote it.

Two vendors, one week, the same underlying question. If your organisation runs an advertising budget or a model licence through a vendor you have not re-read since you signed up, someone there should be able to answer two questions. Who would be the first to notice if the terms moved again next week? What would they be able to do about it?

If your organisation is moving AI agents from pilot to production and nobody outside the vendor has inspected the control plane, message me. I will send the scope and the fixed fee for an independent review.


The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. I write as director of Te Pono Limited; the views are personal and do not represent the position of any client, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance, and it is politically neutral.


Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Hallucination Economy examines what happens when organisations buy, deploy, report on and are audited against AI claims that nobody outside the producer can check. Through Te Pono he provides independent reviews of agentic AI control planes for organisations moving from pilot to production; contact andreas@thehambergerreport.com for the scope and fixed fee.


This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.


[1] Google. "Ads in AI Mode expand to 10 new countries." 28 October 2026. https://blog.google/products/ads-commerce/ads-in-ai-mode-global/

[2] Google Ads Help. "About ads in AI-powered experiences in Google Search." https://support.google.com/google-ads/answer/18826097?hl=en

[3] ppc.land. "Advertisers in 10 more countries can't opt out of Google's AI Mode ads." https://ppc.land/advertisers-in-10-more-countries-cant-opt-out-of-googles-ai-mode-ads/

[4] Search Engine Land. "Google expands ads in AI Mode to 10 new markets with UK and Brazil next." https://searchengineland.com/google-expands-ads-in-ai-mode-to-10-new-markets-with-uk-and-brazil-next-499644

[5] Engadget. "Google brings AI Mode advertisements to more countries." https://www.engadget.com/2301660/google-brings-ai-mode-advertisements-to-more-countries/

[6] Mistral AI. "Mistral Large 4 (Le Chonk) is now open weight." https://mistral.ai/news/mistral-large-4-oss/

[7] Mistral AI. "Introducing Mistral 3." https://mistral.ai/news/mistral-3/

Next
Next

AI Spending: The Money Is Leaving the Platform