Three Waves of AI

What the Three Waves Model Explains

Darpa’s Three Waves of AI is best understood as a maturity model, not a product roadmap. It describes how AI systems progress from rules and codified expert knowledge, to statistical learning from data, to systems that can explain their decisions in human-understandable terms. The value of the model is that it separates capability growth from mere automation hype.

The first wave is explicit and human-authored: knowledge is represented as rules, symbols, or expert logic. The second wave is data-driven: systems learn patterns statistically and perform well when the training distribution is representative. The third wave is the aspirational stage, where systems can justify outputs, expose reasoning traces, and support trust, debugging, and accountability.

Why the Three Waves Still Matter

The model remains useful because organisations often collapse very different AI capabilities into a single label. A rule-based classifier, a predictive model, and an explainable decision system can all be called “AI”, but they imply different operating limits, testing needs, and governance expectations. The three waves framework helps practitioners avoid treating statistical pattern matching as if it were explanation.

That distinction matters in security, compliance, and operational review. A system that predicts well may still be opaque, brittle outside its training context, or hard to challenge when it makes a harmful decision. By contrast, the third wave points toward systems that can support review, traceability, and more defensible human oversight.

What “Explanation” Means in This Model

In DARPA’s framing, explanation is not the same as a post-hoc summary or a polished natural-language answer. It means the system can show why a decision was made in a way that is useful to a person evaluating correctness, bias, safety, or failure. That typically requires more than surface-level interpretability.

This is why the third wave is still considered aspirational. Many current systems can generate plausible rationales, but plausibility is not the same as faithful reasoning. For security and governance purposes, that gap is important: organisations need evidence that the explanation reflects the actual decision process, not only a convincing narrative produced after the fact.

How the Model Shapes Trust and Governance

The three waves model helps distinguish performance from assurance. A second-wave model may be accurate enough for a task, yet still be difficult to audit, contest, or safely deploy in high-stakes contexts. A third-wave system aims to reduce that gap by making model behaviour more inspectable, which can improve human review and accountability.

That does not mean explanation automatically makes a system trustworthy. It can still inherit bad data, weak objectives, or unsafe operating assumptions. But the model usefully frames a key governance question: can the organisation understand not only what the system decided, but also why it decided it?

Risk and Threat Considerations

The main risk in the Three Waves of AI is confusing statistical success with genuine understanding. When organisations rely on opaque models for sensitive decisions, they can miss brittle behaviour, hidden bias, or failure modes that only appear outside the training set. Explanations that are not faithful can also create false confidence.

Failure mechanism: A system may produce accurate outputs during testing while still lacking transparent decision structure, making it hard to detect spurious correlations, model drift, or manipulated inputs.

Impact: Teams may approve, deploy, or trust AI systems they cannot effectively challenge, audit, or contain, increasing the chance of operational error and governance failure.

Practitioner Guidance

Why practitioners should care: Treat the three waves as a governance lens, not a maturity score that automatically certifies readiness. A system’s wave tells you what kind of assurance work it needs, including validation, review, and explanation quality.

Common misunderstanding: Do not assume a model is more trustworthy simply because it produces fluent explanations. A convincing explanation can still be unfaithful to the actual internal logic or learned correlations.

Practitioner takeaway: Use the model to ask whether the AI system’s behaviour is merely effective, or also inspectable enough to support the decisions you plan to let it influence.

Related resources from NHI Mgmt Group

• What breaks when AI fuzzing is treated as one control instead of three?
• What is Agentic AI and how does it differ from traditional generative AI?
• What NHI types do Agentic AI systems typically use?
• Why does Agentic AI dramatically increase identity sprawl?