The Noise Floor: AI Triage Is a Decision Someone Must Own, Not a Feature You Buy

The question I would put to any vendor is not "how accurate is it". It is "at the operating point that fits my analyst capacity, what do I miss, and who signs for that".

Introduction

Report volume is going up and it is not coming back down. More reporting entities, more sensors, more partner feeds, more machine-generated exhaust from systems that log everything by default. Human reading capacity, meanwhile, is a flat line, set by a headcount cap, a thin hiring market for specialist analysts, and a working day that stubbornly refuses to get longer.

Those two lines diverge, and the space between them is the interesting part. It is the residue of reports nobody read. The comforting story is that AI closes the gap by reading everything and surfacing only what matters. That story is half true and half sales pitch. AI can read everything. What it cannot do is tell you, for free and without consequence, where "what matters" begins. That boundary is a number a person chooses, and this article is about who chooses it and what they are actually choosing.

You came here for more than "buy the tool". So let us peel back what the tool is really doing.

The Volume Curve Nobody Budgets

Here is the Australian example everyone in this space is watching. The anti-money-laundering reforms known as Tranche 2 commenced on 1 July 2026, taking AUSTRAC's regulated population from about 19,000 businesses to over 100,000, with newly captured businesses enrolling until 29 July 2026 (Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth); Australian Transaction Reports and Analysis Centre, 2025). I have argued elsewhere that the hard part of that reform is entity resolution rather than compliance (see my article [link]), so I will not re-run that spine here. The point for this piece is simpler and blunter: the intake curve just stepped up, and the number of analysts did not step up with it.

This is the shape of the problem across the whole sector, not just financial intelligence. Intake compounds because every new source multiplies against every existing one. Reading capacity is flat because it is bound to headcount. Draw the two curves on one axis and they never meet. The gap widens every year, and the missed signal lives in the gap, not in the pile you read.

Claude Shannon gave us the language for this in 1948 when he treated information and noise as measurable quantities rather than metaphors (Shannon, 1948). Signal versus noise is not a vibe. It is a ratio, and at scale the noise term grows faster than the signal term, because the world produces far more ordinary events than interesting ones. That is the noise floor rising under everything you monitor. The honest question is not "how do we eliminate the noise", it is "given a floor that keeps rising, where do we choose to stop reading".

That choice is the rest of this article.

The Dial Is a Decision, Not a Setting

Strip away the marketing and "AI reduces the noise" means something precise. A classifier assigns each report a score, and you pick a threshold. Above the line, an analyst looks. Below the line, nobody does. Move the threshold down and you read more, catch more real signals, and burn analyst hours on reports that turn out to be nothing. Move it up and you save the hours, read less, and quietly let more real signals fall below the line unexamined.

That is a precision-recall trade, and it is a hard constraint, not a tuning inconvenience. Every threshold position is an operating point on that curve. There is genuinely no position called "just the signal", any more than there is a volume knob setting called "only the music I like". You are always choosing a mix. The dial does two things at once: it allocates a finite pool of analyst attention, and it sets the rate at which unexamined reports pile up below the line. Both are consequences a person owns, whether or not anyone admits to owning them.

And here is where it stops being a purely technical matter. From 10 December 2026, the automated-decision-making transparency provisions in Australia's amended privacy law (APPs 1.7 to 1.9) require entities to be transparent about computer-assisted decisions that significantly affect people (Privacy and Other Legislation Amendment Act 2024 (Cth)). The final OAIC guidance is not out yet, expected around September 2026, so I am not going to overclaim the detail. But the direction is clear enough to plan against. "The machine decided not to look" is becoming a position you may have to defend. A threshold that silently drops a class of reports below the line is a decision the system made about a person, and "a contractor set it during UAT and nobody revisited it" is not a defensible answer.

The Confidence Launderer, and the Queue That Trains You to Look Away

Now the contrarian bit, and it is the part vendors hate. Fusing more sources is sold as clarity. Combine the feeds, resolve the conflicts, get one clean confident picture. But fusing correlated sources adds confidence without adding information, and those are not the same thing.

Picture a partner feed that repackages an upstream source you already ingest. You are not getting a second independent witness. You are getting the same witness in a different hat, re-confirming the noise with its own echo. When the fusion layer silently reconciles that agreement into a single score, the score rises across the board, because the correlated inputs move together. The threshold that was balanced yesterday floods today. Your analysts drown, and the missed-signal rate barely improves, because nothing new was actually learnt. The fusion did not sharpen the picture. It manufactured a confident number the underlying evidence does not support.

This is confidence hardening at the fusion seam. A silent conflict resolution takes genuine disagreement between sources and launders it into a clean assertion. The fix is not to fuse less. It is to carry uncertainty and source lineage through the fusion, so the analyst sees that three of the four "corroborating" feeds trace back to one origin, and that the sources actually disagree. Fusion that hides disagreement is a confidence launderer. Fusion that surfaces it is doing its job.

[Ben: personal example here about an alert queue or monitoring backlog that ran permanently over capacity until the team stopped believing it, without naming the client. The article flows without it.]

That flooding leads to the terminal failure mode, and it is not the one people fear. A queue that sits permanently over capacity trains the humans on the end of it. Give a person a queue they can never clear, ninety-something percent of it noise, and they learn, rationally, to skim and dismiss. You have quietly converted a detection system into a suppression system. The alerts still fire. Nobody believes them. And now the worst outcome is not the alert you missed. It is the alert you saw, at 4pm on a Friday, and had been trained by a thousand false positives to wave through. Alert fatigue is well documented as a driver of missed true positives in high-volume monitoring, though the strongest citations sit in clinical and SOC literature rather than intelligence [Verify source: alert fatigue / alarm fatigue effect on true-positive detection rates]. The mechanism transfers regardless of domain.

Here is the candid aside. Everyone in this field has stood in front of a dashboard that the people meant to act on it had stopped trusting months ago. It was still green. It was still "operational". It was, functionally, wallpaper. That is what an unowned threshold produces over time: an expensive system everybody has quietly agreed to ignore.

Why This Market Is Not Ad-Tech

This is the distinction the procurement conversation keeps missing. In ad-tech, a false negative is a lost click. You model it, you price it, you move on. In this sector a false negative is an unexamined suspicious matter report that surfaces two years later in a royal commission, with your organisation's name attached and a barrister asking why the threshold sat where it did. That asymmetry of consequence is why you cannot buy triage the way you buy a spam filter.

Vendors sell recall headlines: "detects 99 percent of X". That number is meaningless without its operating point. Ninety-nine percent recall at what precision, producing what queue, at what analyst cost per decision? The recall figure alone is a brochure number. The figure that decides whether the capability survives its second budget cycle is cost per decision multiplied by the queue the threshold creates. That is what agencies must budget, and it is what turns "own the threshold" from a slogan into a line item.

The So What?

So you are standing up a triage capability, or inheriting one. What does an architect actually do, beyond nodding at the precision-recall curve? A few things, and none of them start with the licence.

• Own the operating point as policy, not config. The threshold is a documented, reviewable decision with a named owner and a recorded rationale, not a value a contractor set during UAT and nobody revisited. When the ADM transparency obligations bite, "here is who chose it and why" is the only answer that holds.

• Budget the queue, not the licence. Model the real economics before you sign: volume above the line, review rate, analyst cost per decision, inference cost. If the numbers only work at pilot scale, the capability is already broken. The licence is the cheap part.

• Carry uncertainty and lineage through fusion. Make disagreement and source provenance first-class attributes that reach the analyst. A fusion layer that outputs a single confident score, and swallows the fact that its sources conflicted, is manufacturing false confidence. Refuse it.

• Watch for correlated feeds masquerading as corroboration. Before you add a source, ask what it is actually independent of. A feed that repackages one you already hold does not add information, it adds an echo that pushes scores up and floods the queue.

• Instrument alert fatigue as a metric, not a mood. Track dismissal rates, time-to-dismiss, and how often dismissed items later mattered. When the queue is training your analysts to stop looking, that shows up in the data before it shows up in an incident.

Conclusion

The seductive framing is that AI hands you the signal and takes away the noise. It does not, because "the signal" is not a thing the world hands you. It is a line you draw across a rising noise floor, and where you draw it decides what you catch, what you burn, and what falls into the dark below the line. That line is a decision. Decisions have owners. In this sector, from December 2026, they may also have to have explanations.

So before you buy the tool that promises to cut through the noise, answer the only question that matters. At the operating point your analyst capacity can actually sustain, what are you choosing not to look at, and whose name is on that choice?

Thanks for reading.

The views expressed in this article are my own and do not represent those of my employer, or any of my clients.

See other articles I have written: The 80,000-Entity Wave: Why Tranche 2 Is an Entity Resolution Problem, Not a Compliance One [link] and The Compliance Clock [link].

References

APA 7. Confirm current versions, dates, and URLs against the research pack before publishing. The alert-fatigue claim carries a marked verify slot rather than an invented citation.

• Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) No. 110. https://www.legislation.gov.au/C2024A00110

• Australian Transaction Reports and Analysis Centre. (2025). AUSTRAC corporate plan 2025–29. Australian Government. https://www.austrac.gov.au/about-us/corporate-information-and-governance/corporate-plan

• Privacy and Other Legislation Amendment Act 2024 (Cth) No. 128. https://www.legislation.gov.au/C2024A00128

• Shannon, C. E. (1948). A mathematical theory of communication. The Bell System Technical Journal, 27(3), 379–423.