Three items this time, and one question underneath them: when you hand something important to someone else, do you know what they are standing on? This cycle's blog post asks it about the hardware behind your AI workloads. California just asked it about AI that disciplines and fires people. And the federal incident-reporting rule finally moved, which tells you how long you have to know who your reporting depends on.
The Bare Metal Return Isn't a Homecoming. It's a New Landlord.#
This spring, surveys from Cloudian and Broadcom said most enterprises have moved AI workloads off public cloud or are weighing it, and that cost has overtaken security as the top complaint. Both companies sell the alternative, so I'm leaving their headline percentages out; only the sellers stand behind them. The direction is real, though: AI teams are backing away from virtualized cloud and toward "bare metal," a dedicated physical machine with nobody sharing it.
Virtualized cloud works like an apartment building. You get a locked unit, but the plumbing is shared. For AI, how much that costs depends on how the chip is shared. A chip attached directly to your machine loses almost nothing, 0 to 2% in VMware's own benchmarks. A chip time-sliced among tenants, booked in turns like a conference room, loses 4 to 25%, and large training jobs spread across many machines can lose a third or more. A company running one model to answer customer questions has little reason to move. A company training across dozens of machines has a real one.
Here is the part most coverage skips. Almost nobody "returning" to bare metal buys servers. They rent from neoclouds, newer companies such as CoreWeave, Lambda, Crusoe, and Nebius that rent dedicated chips for roughly $2 to $4 an hour against $7 to $12 at the big three. Part of that gap is real efficiency. Part is a bet on hardware value: NVIDIA releases a new chip generation roughly yearly, each one pushes down what the older chips are worth, and more than $20 billion in debt is now backed by these chips as collateral. A hyperscaler can absorb that. A provider built on a few data centers and borrowed money cannot do so as easily.
What it changes for you: benchmark your own workload before assuming you need dedicated hardware. Ask your current provider about bare-metal pricing first; Amazon and Oracle sell it inside contracts you may already have. If you sign with a newer provider, ask in writing what happens to your contract, data, and price if they are acquired, restructured, or lose their financing.
California Made "Human Review" Mandatory Before AI Disciplines or Fires Anyone#
On September 30, Governor Newsom signed SB 947, the No Robo Bosses Act. Starting July 1, 2027, California employers may not rely solely on an automated decision system (ADS), meaning software that scores, ranks, or recommends in place of a person's judgment, to discipline or fire a worker. When an employer relies primarily on one, a human must corroborate the result by reviewing the underlying data or other evidence, not just approve the output. The employee gets a stand-alone written notice and can ask what data the system used. Penalties start at $500 per violation, and once an ADS is shown to be involved, the burden shifts to the employer to prove it complied.
In issue #13 I borrowed Colorado's draft review standard as a yardstick for your AI approval steps. California has now written a similar one into binding law for employment decisions. The same signing day also brought SB 1000, an update to the AI content-labeling law from issue #9: it removes the one-million-user threshold and took effect immediately.
What it changes for you: ask HR which tools produce scores or flags that feed discipline, including features built into your HR platform. For each one, write down who reviews the output, what evidence they look at, and where that review is recorded. You have until July, but the records have to exist on the day of the decision.
The Federal 72-Hour Reporting Rule Reached the White House#
In issue #9 I said the final rule under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was expected in September. Here is the update. On October 1 the Cybersecurity and Infrastructure Security Agency (CISA) sent it to the White House Office of Management and Budget (OMB) for review, after missing its October 2025, May 2026, and September 2026 targets. Publication is expected before year-end.
The 2024 proposal required covered entities in 16 critical infrastructure sectors to report substantial incidents within 72 hours and ransom payments within 24. CISA estimated about 316,000 entities would be covered. The final text, and any changes to who counts, stays unknown until it publishes, and OMB review is not a compliance date.
What it changes for you: confirm whether your sector and size put you in scope under the proposal, and make sure your incident plan names who decides an event is "substantial" and who files. If a cloud or hosting provider runs your critical systems, check that your contract obliges them to tell you fast enough for you to meet 72 hours.
One Level Deeper: The Risk Runs Both Ways#
The blog frames the chip-value problem as counterparty risk: the provider holding your contract might not survive the next price drop. That is right, but it is only half of the bet. The other half is that the provider survives fine and you overpay.
Here is an illustrative case. You lock in eight dedicated chips at $3 an hour on a three-year fixed contract. That is 8 × $3 × 8,760 hours, about $210,000 a year. Then NVIDIA's next generation arrives in year two, the old chips reprice, and the open market rate for what you rent drops to $2. You are now paying about $70,000 a year above market for the rest of the term, and nobody did anything wrong.
So a fixed long-term price for chips is not a hedge. It is a wager that the hardware holds its value, made from the opposite side of the provider's own wager. The fix is to write the chip calendar into the contract: a price review tied to the next major chip release, a right to move to newer hardware at a set rate, or a term short enough to end before the next generation lands. If a provider will not discuss any of the three, you have learned how confident they are in their own pricing.
How This Impacts Your Organization#
The principle doesn't change with company size: you are handing important work to someone else's hardware, software, or reporting process, and you need to know what they are standing on before something forces the answer. What changes is how much of each problem you actually have and how much leverage you have to fix it in a contract.
Large Enterprises (1,000+ employees)
Your real risk is organizational: chip contracts, HR scoring tools, and incident reporting each sit with a different team, and nobody connects them. Your leverage is scale. This quarter, have procurement add a chip-generation price review to any dedicated-hardware contract over a year, have HR and legal inventory every system that feeds discipline decisions in California, and confirm that a named owner can make the CIRCIA "substantial incident" call.
Mid-Size Organizations (100–999 employees)
You feel this fastest, because the person who signed the chip contract is also running the incident plan. The overcorrection to avoid is signing a multi-year neocloud deal for the price line alone. Three moves: benchmark before you buy dedicated hardware; ask your current cloud provider for bare-metal pricing before anyone new; and list the HR features that flag or score employees, then write down who reviews each flag.
Small & Growing Organizations (under 100 employees)
Honest counsel: you almost certainly don't have a bare-metal decision to make, and if someone is selling you one, ask which workload of yours needs it. Your exposure is one step removed, through AI vendors that run on neoclouds and HR tools that score staff. Ask each vendor whose infrastructure they run on, and switch off automated discipline features nobody chose. Nothing here requires a purchase.
Curated Links#
- The Bare Metal Return Isn't a Homecoming — It's a New Landlord (companion blog post) — dlegenddigital.com/blog
- Cloudian enterprise AI repatriation survey — cloudian.com
- VMware performance engineering: GPU passthrough vs. time-slicing — blogs.vmware.com
- California finalizes next wave of AI and privacy regulation — wilmerhale.com
- No Robo Bosses: California requires human review before AI-driven discipline — ktslaw.com
- California SB 947, Employment: Automated Decision Systems — leginfo.legislature.ca.gov
- CISA sends CIRCIA final rule for White House review — hipaajournal.com
- CISA sends final CIRCIA rule to White House for review — govinfosecurity.com
Three items, one habit: know what the thing you depend on is standing on, and get it in writing before you need it.
On the blog this cycle: The Bare Metal Return Isn't a Homecoming — It's a New Landlord — the performance math, the neocloud pricing gap, and the chip-value risk at every company size.
Hit reply and tell me what you're wrestling with — I read every one.
— Charles Redding, Founder, DLegendDigital