In 1956, British cybernetician W. Ross Ashby articulated a principle so fundamental it should sit above every AI strategy deck: Only variety can destroy variety.
Ashby’s Law of Requisite Variety states that a control system must possess at least as much variety — the number of distinct states it can occupy — as the system it seeks to control. Too little variety in your regulator, and the environment will generate disturbances you cannot counter. You will, in Ashby’s precise language, be outmanoeuvred.
Most organisations are deploying AI in direct violation of this law.
The Precision of the Constraint
Variety, in Ashby’s sense, is not vagueness or creativity. It is a measurable property. A thermostat with two states (on/off) has variety of 2. A competitive market with a thousand distinct demand patterns has variety far exceeding that. The thermostat cannot regulate the market. The mismatch is not a management failure — it is a structural impossibility.
Ashby formalised this in An Introduction to Cybernetics (1956): for any regulator R attempting to control a disturbed system D, the variety of R must be at least as large as the variety of D. This ceiling is not recoverable through effort, culture change, or more senior leadership attention. It is a hard constraint.
Stafford Beer spent the following two decades translating this into management science. In Brain of the Firm (1972) and The Heart of Enterprise (1979), he built the Viable System Model — an explicit requisite-variety architecture for organisations. Each of its five recursive systems is designed to handle the complexity one level up. System 3 (operational management) must match the variety of what System 1 (operations) is actually doing. System 4 (intelligence, scanning the environment) must match the variety of the outside world. Get this wrong — under-variety your management layer — and the organisation cannot adapt. It becomes rigid in a world that isn’t.
The VSM is not a conceptual framework. It is an engineering specification. And AI is being bolted onto organisations that never met its requirements in the first place.
What AI Monocultures Do
Most organisations treating AI as a standardisation play are, unknowingly, under-varieting themselves.
Here is the mechanism. The large foundation models powering most enterprise AI deployments — GPT-4-class systems, Claude, Gemini — are trained on similar corpora, fine-tuned with similar techniques, and exhibit correlated failure modes. They share systematic blind spots: non-Western contexts, niche professional domains, novel problem structures under-represented in training data. Deploy one as your primary reasoning engine and you inherit all of its gaps as organisational gaps.
This matters enormously when your environment has more variety than your AI. And almost every complex adaptive environment — competitive markets, regulatory landscapes, geopolitical contexts, customer behaviour — does.
The financial services sector learned this expensively in 2022. Systematic quantitative funds, many using machine learning models trained on similar post-2008 low-interest-rate data, were caught flat-footed when the inflation-and-rate-regime shift arrived. The models’ training distributions did not include the relevant patterns. Crucially, the failure was correlated: funds sharing similar model architectures and training approaches deleveraged in unison, amplifying rather than dampening the volatility they were supposed to manage. This is Ashby’s Law playing out in balance sheets. The regulatory variety — a new macro regime — exceeded the variety of the AI systems managing it. The cost was systemic.
The same dynamic is emerging across industries as organisations converge on similar foundation model deployments. The risk is not that any one AI will fail. The risk is that when the environment generates a genuinely novel disturbance — a black-swan regulatory shift, a competitive move outside existing training data, a geopolitical event with no recent precedent — all the AI systems fail simultaneously, because they share the same variety ceiling.
The Diversity Imperative
Requisite variety thinking reframes what good AI strategy means. It is not about picking the best model. It is about asking: does our portfolio of AI capabilities have sufficient variety to match the complexity of the environments we operate in?
This means diversity at three levels.
Model architecture diversity. Relying on a single foundation model or a single vendor’s model family creates a monoculture with correlated failure modes. Diverse model architectures — specialised models for specific domains, smaller fine-tuned models for high-frequency operational decisions, general-purpose reasoning models for strategic tasks — distribute the variety problem across the portfolio. No single model’s blind spots become systemic blind spots.
Training data diversity. Models trained on homogeneous data have homogeneous blind spots. Organisations operating across multiple geographies, regulated sectors, or specialist domains need AI that has been exposed to the relevant variety. A model fine-tuned on your industry’s proprietary operational data has different variety properties than a general-purpose model. That difference matters when the market generates novel signals that only appear in your sector’s history.
Human-AI team composition. This is the variety lever most organisations overlook entirely. A team where every human defers to the same AI recommendation has less variety than one where humans with different expertise interact with AI differently — accepting some outputs, challenging others, routing specific problem types to specific tools. The human element is a variety amplifier or attenuator depending on how you design the team structure. Beer’s VSM makes this explicit: management is not about eliminating variety in the workforce, but channelling it productively. AI that homogenises your team’s thinking has reduced your organisation’s internal variety, regardless of how capable the model is.
Amplifying vs. Attenuating Variety
Beer distinguished between two responses to variety: attenuation (filtering, compressing, standardising) and amplification (expanding options, adding sensors, diversifying responses). Both have legitimate uses. The error is applying the wrong one.
Most AI deployments are default variety attenuators. They take a complex decision — customer segment strategy, supply chain routing, credit assessment — and compress it to a single recommended output. That compression is useful when the decision is genuinely routine and the environment is stable. It becomes dangerous when the problem is genuinely novel.
Leaders need to ask, for each AI deployment: is this a variety-attenuating use case (appropriate) or a variety-amplifying one (where AI should generate more options, not fewer)? Strategic planning, innovation assessment, scenario analysis — these are domains where AI should expand the decision space. An AI that gives you one strategic recommendation is reducing your organisation’s variety. An AI that surfaces five plausible futures you had not considered is amplifying it.
The EU AI Act’s systemic risk provisions are beginning to encode this distinction. The Act requires that high-risk AI systems include risk management processes that account for correlated failure modes at sector level — the same logic that financial regulators have applied to credit risk modelling for decades. Concentration in AI capability creates concentration in failure risk. Regulators are arriving at this conclusion through exposure to systemic loss. Strategy teams should get there first.
What Leaders Should Actually Do
First, map your operational complexity before you standardise. What is the genuine variety of the decisions your AI will support? If the answer is high — many distinct inputs, genuinely novel situations arising regularly, high-stakes contexts with no clear precedent — your AI portfolio needs matching variety. If the answer is low — highly repetitive, stable, well-defined — standardisation on one model is rational. The error most organisations make is applying the low-complexity answer to the high-complexity question.
Second, treat your AI portfolio like a capability portfolio. No sensible CFO holds a single asset class. Apply the same logic to AI: different architectures for different problem types, multiple vendors to avoid correlated failure modes, human oversight calibrated to the novelty of the task rather than the confidence of the output.
Third, protect human variety. The most dangerous AI deployments are those that homogenise human thinking across an organisation. If everyone is reading the same AI-generated summaries, acting on the same AI-generated recommendations, and trusting the same AI-generated analyses, you have created an information monoculture. The organisation’s internal variety has collapsed. Ashby’s Law does not care whether it was a human or a machine that under-varieted you.
The organisations that will thrive in complex, AI-enabled environments are not those with the most AI. They are those with the right amount of variety in their AI — matched, as Ashby insisted, to the variety of the world they are trying to navigate.