Books / AI Strategy

The Coming Wave Review: Containment, Power, and the Management Problem Behind AI

A rigorous review of The Coming Wave as a strategy book about general-purpose technology, institutional capacity, containment, and operating under uncertainty.

The most useful way to read The Coming Wave is not as a prediction that one specific AI scenario will happen. It is as a management book about technologies whose capabilities can diffuse faster than institutions learn how to govern them.

Mustafa Suleyman, a DeepMind co-founder who later became CEO of Microsoft AI, frames the central dilemma as containment: societies want the benefits of increasingly capable technologies, but the same properties that make those technologies valuable—lower cost, accessibility, rapid replication, and generality—also make them hard to control. The publisher presents the book as a warning about AI and other fast-developing technologies and the difficulty of keeping them aligned with social order.

That framing is more useful than the standard “AI will change everything” claim. Change is not the hard part. The hard part is building decision systems that still work when capability, adoption, incentives, and misuse all move at different speeds.

The core thesis is a coordination problem, not a gadget problem

Many technology books focus on what a tool can do. The Coming Wave focuses on what happens when powerful tools become widely available to actors with different goals.

That shifts the unit of analysis from the model to the system around the model. A company can have excellent model evaluations and still deploy a product into incentives it does not understand. A government can write rules that are sensible on paper and still lack the technical capacity to inspect or enforce them. A security team can control one access point while new open-source or low-cost substitutes appear elsewhere.

Suleyman’s concept of containment therefore works best as a question: what would have to be true for a high-capability technology to remain governable after it becomes cheap, distributed, and useful?

The answer cannot be “trust the builder.” It also cannot be “ban the technology.” The book’s strongest insight is that durable control requires several layers at once: technical safeguards, organizational accountability, incentives, monitoring, public capacity, and international coordination.

Four forces make containment difficult

1. Capability improves faster than policy cycles

Software can be updated in days. Institutions usually move more slowly because they have to gather evidence, define authority, negotiate trade-offs, and survive legal or political review. That asymmetry creates a recurring gap between what can be done and what governing systems know how to evaluate.

NIST’s AI Risk Management Framework is useful precisely because it treats AI risk as an ongoing governance process rather than a one-time certification. The framework is designed around mapping, measuring, managing, and governing risk over time.

For operators, the lesson is simple: a control that was adequate for last quarter’s model may not be adequate for the next one.

2. General-purpose tools have many legitimate and harmful uses

A narrow industrial machine is easier to reason about because its use cases are constrained. General-purpose AI can be applied to software development, analysis, customer support, research, persuasion, automation, and many other tasks.

That breadth means the same capability can create productivity for one user and risk for another. The governance problem is contextual. “Safe” is not a permanent property of the model; it depends on access, task, environment, autonomy, and consequences.

3. Diffusion weakens centralized control

When a capability is expensive and concentrated, a small number of institutions can set norms around it. Falling costs broaden access. Stanford’s 2026 AI Index reports that generative AI adoption spread extremely quickly and that organizational use continued to rise sharply. Widespread adoption makes centralized oversight harder because deployment decisions multiply across firms, teams, and jurisdictions.

This is why the book’s containment problem becomes more credible as adoption rises: more value is created, but more actors also make consequential deployment choices.

4. Competition creates pressure to move before uncertainty is resolved

A firm that believes competitors are gaining an advantage from AI may deploy before it has perfect evidence. Governments can face similar pressure when they believe strategic rivals are moving faster. The result is a classic coordination problem: everyone may prefer a safer equilibrium, while each actor has an incentive to move first.

The book is strongest when it forces the reader to think about these incentives rather than treating safety as a matter of goodwill.

The practical idea: build a containment stack

Executives cannot solve global AI governance. They can, however, build a containment stack inside their organization.

Layer 1: capability boundaries

Define which systems may do what. Separate low-consequence assistance from actions that can move money, change production systems, contact customers, modify code, access sensitive data, or make irreversible decisions.

The mistake is to classify every AI use as equivalent. A drafting assistant and an autonomous production agent should not share the same approval model.

Layer 2: access boundaries

Control who can invoke high-impact functions, which data the system can reach, and which external tools it can call. Minimize default permissions. Treat model access like operational access, not like ordinary software convenience.

Layer 3: evaluation before deployment

Test the task the organization actually intends to automate. General benchmark scores are not enough. A model can perform well on public benchmarks and still fail on the edge cases that matter to a specific workflow.

Layer 4: monitoring after deployment

Containment is not finished at launch. Track failure modes, anomalous behavior, escalation rates, user overrides, sensitive-data incidents, and changes in model behavior after upgrades.

Layer 5: human ownership

Every high-impact system needs a named owner who is accountable for outcomes. “The model decided” is not an operating model.

Layer 6: stopping rules

Before deployment, define the evidence that would trigger rollback, reduced autonomy, or suspension. Without stopping rules, teams rationalize failures after the fact because they are already invested in the system.

What the book gets right about institutional capacity

The book repeatedly returns to the fact that governance is only as strong as the institutions capable of executing it. That point deserves more attention in business.

Companies often write policies that exceed their operational capacity. A policy may say that all AI output must be reviewed, but no one defines what “review” means. Another may prohibit sensitive data in external models, while teams lack approved alternatives. A third may require risk classification, while no one owns the taxonomy.

Governance that cannot be executed becomes ceremony.

The better standard is operational governance: rules tied to systems, permissions, logs, responsible owners, and measurable exceptions.

This is where The Coming Wave becomes useful to founders and executives who are not policy specialists. The containment problem exists inside every fast-scaling company. Growth creates new capabilities faster than the organization’s controls mature. The same pattern appears in finance, security, data, hiring, and AI.

Where the argument can overreach

A warning book has an incentive to emphasize tail risks. Readers should separate three questions:

1. Is a harmful outcome possible?
2. Is it plausible enough to deserve investment today?
3. What control has the best cost-to-risk-reduction ratio?

Those are not the same question.

Some readers may leave the book with a generalized sense that technological diffusion is inherently uncontrollable. That can become strategically paralyzing. Organizations do not need certainty about civilization-scale outcomes to make better deployment decisions. They need prioritized risk models.

There is also a danger in treating “technology” as one wave. AI, synthetic biology, robotics, and other domains differ in cost structure, physical constraints, observability, expertise requirements, and failure modes. A single containment theory can illuminate common dynamics, but it should not erase those differences.

The book is also vulnerable to prediction asymmetry

If a forecast is dramatic and the negative outcome does not occur, advocates can argue that mitigation worked or that timing was wrong. If the outcome does occur, the forecast looks prescient. This asymmetry makes sweeping technology predictions difficult to falsify.

A disciplined reader should therefore extract mechanisms rather than dates.

The mechanisms in The Coming Wave are strong: falling cost, capability diffusion, dual use, competitive pressure, institutional lag, and coordination difficulty. Those mechanisms can be tested even when long-range forecasts remain uncertain.

An operator’s version of the containment question

For a founder or executive, containment can be reframed as five operating questions:

What capability are we introducing? Describe the actual new action the system enables, not the vendor category.

Who gains power from it? AI can redistribute decision rights toward frontline employees, centralized platform teams, vendors, or customers.

What failure becomes newly possible? Automation changes both frequency and scale of mistakes.

How quickly would we know? A risk that is detected immediately is different from one that compounds silently.

Can we reverse the decision? Reversibility is one of the cheapest risk controls. Pilot designs should preserve it.

A decision matrix for AI deployment

| Deployment | Upside | Failure cost | Reversibility | Governance intensity | | — | — | — | — | — | | Internal brainstorming | Moderate | Low | High | Light | | Customer-facing drafting | Moderate | Medium | High | Medium | | Code changes with review | High | Medium | High | Medium | | Autonomous production changes | High | High | Variable | High | | Financial or safety-critical action | High | Very high | Low | Very high |

The point is not that high-risk uses should never happen. It is that control intensity should scale with consequence and reversibility.

A concrete containment test: the customer-service agent

The containment problem becomes clearer when it is attached to a real operating decision. Imagine a company wants to give an AI agent authority to answer support tickets, issue credits, cancel subscriptions, and update customer records. The first deployment question is not “How intelligent is the model?” It is “What is the maximum damage this system can cause before a human notices?”

That question forces management to translate abstract AI risk into an operating design. A low-risk version of the agent can draft replies but cannot send them. A medium-risk version can send replies but cannot change account state. A higher-autonomy version can issue credits only below a defined threshold and only for a narrow set of reasons. The most consequential actions—closing accounts, changing identity information, altering payment methods, or approving unusually large refunds—can remain outside the agent’s authority.

This is containment through scope, permissions, thresholds, observability, and reversibility. None of those controls require solving the philosophical problem of whether advanced AI can ever be fully controlled. They require management to know which actions matter, which failures are tolerable, and which signals should trigger intervention.

The same logic applies outside AI. A junior trader has limits. A production deployment has rollback procedures. A new supplier receives smaller commitments before it receives strategic dependence. High-uncertainty capability becomes safer when authority is staged rather than granted all at once.

Containment is also an incentive problem

One of the harder implications of The Coming Wave is that safety cannot be separated from competition. A company may understand that a deployment is premature and still feel pressure to launch because a competitor is moving faster. A government may prefer a slower path while fearing that another government will accept more risk. A research lab can worry about capabilities while also depending on continued technical leadership.

That means governance cannot rely only on people “being responsible.” Good systems reduce the penalty for responsible delay and increase the cost of irresponsible acceleration. Inside a company, that can mean a launch process in which the product team is not rewarded solely for shipping dates. Security, reliability, legal, and operations should have explicit authority to raise blocking conditions, while leadership should define what evidence allows the block to be removed.

The principle is important: when the incentive system rewards speed but the policy document rewards caution, speed usually wins.

The management lesson beneath the technology story

For founders and executives, the most durable value of the book is not a forecast about a particular model, robotics system, or biotechnology platform. It is a method for thinking about technologies whose upside and downside both grow with capability.

The method has four steps:

1. Identify the capability that creates leverage.
2. Identify the failure modes that become larger as capability improves.
3. Build boundaries before scale makes those boundaries politically or commercially expensive.
4. Preserve the ability to stop, narrow, or reverse deployment when the evidence changes.

A company that waits until a system is business-critical before defining its stopping rules has already surrendered part of its governance. The cost of shutting it down is now embedded in customer expectations, revenue targets, employee workflows, and executive credibility. Containment is therefore partly a sequencing discipline: put controls in place while the organization can still afford to use them.

Who should read The Coming Wave

The book is especially useful for founders, executives, product leaders, security leaders, investors, and policymakers who need a vocabulary for technology governance without assuming that innovation and control are opposites.

It is less useful as a technical guide to model safety. The book operates at the strategic and institutional layer. Readers looking for implementation standards should pair it with concrete frameworks such as NIST’s AI RMF and domain-specific security practices.

The strongest lesson is about management under uncertainty

The deepest value of The Coming Wave is not that it tells you exactly what AI will become. It forces you to design institutions for a future in which capabilities are uncertain but diffusion is fast.

Good management under uncertainty does not require perfect forecasts. It requires:

• explicit assumptions,
• staged deployment,
• evidence collection,
• permissions proportional to consequence,
• monitoring that can detect drift,
• and stopping rules that preserve reversibility.

That is containment at organizational scale.

Final assessment

The Coming Wave earns its place on a serious operator’s reading list because it makes governance part of strategy rather than an afterthought. Its biggest weakness is the natural tendency of a warning book to compress many technologies and uncertain futures into one large narrative.

Read it for the mechanisms, not for a prophecy.

The useful question after finishing the book is not “Will Suleyman’s future happen?” It is: if capability accelerates faster than our organization’s ability to understand it, what system have we built to keep learning without losing control?

FAQ

What is the main idea of The Coming Wave?

The book argues that rapidly advancing, widely diffusing technologies create a containment problem: societies want their benefits while struggling to preserve meaningful control over their risks and use.

Is The Coming Wave anti-technology?

No. Its central tension is that the same technologies can produce enormous benefits and serious risks. The argument is about building capacity to govern powerful technology rather than rejecting innovation.

Is The Coming Wave useful for business leaders?

Yes, especially when containment is translated into operational design: permissions, evaluations, monitoring, ownership, reversibility, and stopping rules.

What should readers be skeptical about?

Long-range forecasts should be separated from the mechanisms underneath them. Diffusion, incentives, dual use, and institutional lag are more testable than specific future scenarios.

Continue inside the Millionaire Lesson library

Competitive Strategy Switching Costs Business Strategy Basics

Sources

• Penguin Random House — The Coming Wave
• NIST — AI Risk Management Framework
• Stanford HAI — 2026 AI Index Report
• Stanford HAI — AI Index Economy chapter
• Crown Publishing — Mustafa Suleyman on The Coming Wave