The Nvidia Case and Key-Person Risk in Technology

Summary

• Nvidia remains under a board investigation and, according to the coverage, has no public succession plan for its CEO.
• Key-person risk means depending on one person, or a few, for decisions or knowledge the company cannot replace quickly.
• In software, it shows up as the system that only one person understands, operates or dares to touch.
• Mapping dependencies, documenting with every change and spreading knowledge reduces the risk.

What the Nvidia case shows beyond the news

On November 8, 2026, Nvidia CEO Jensen Huang admitted in a statement to employees that he had been unfaithful to his wife, and said the company's board had opened an independent investigation. The admission came after months of reports about his relationship with a former executive of Megaspeed International, a Singapore-based company that was a Nvidia customer. That is what Bloomberg reported, in an article published by InfoMoney on 9/11/2026. That history explains the investigation. The United States government suspects that this woman was recruited by a Chinese intelligence agency, and Megaspeed was accused of violating American export restrictions and smuggling Nvidia chips into China. Until then, Huang had said the relationship was commercial and normal. With the admission, the episode stopped being only a private matter and became a governance issue: the board formed a committee of independent directors, with outside lawyers, to look into the allegations that the CEO may have been the target of a foreign intelligence operation. This matters because Nvidia can only sell a limited range of products to China, under a US government license, and because its decisions shape the artificial intelligence market. It is worth separating facts from allegations. The infidelity was admitted by Huang himself. The espionage suspicion is an allegation under investigation, and the board says it has no reason to believe that national security or the company's secrets were compromised. His personal life is not what interests us here. What matters is what the coverage reveals about structure. Huang remains in his post during the investigation, Nvidia has no public succession plan and, according to the article, he personally drives most decisions, with allegedly 60 direct reports. For Bernstein analyst Stacy Rasgon, the episode highlights the risk of depending on a key figure. The investigation is ongoing and the outcome may change. The lesson about structure will not.

Key-person risk is not just a problem for giants

Key-person risk is the situation in which a company depends too much on one individual to keep its operation and pace going. In a January 20, 2023 article about Tesla, JPMorgan and Meta, Fortune recalls, drawing on a piece from The Economist, that the risk comes in three variations:

• one person concentrates too much control;
• only one person is seen as able to fill the role;
• the company is so complex that a single mind understands how the pieces fit together.

The same article notes that the challenge may be greater in mid-sized companies, which often hire function leaders without thinking about succession. And the key person does not need to be the CEO: it can be an inventor, a marketing director or the CTO. In technology, it is usually whoever alone knows the system that sustains the operation.

How key-person risk shows up in software projects

In technology projects, the risk grows gradually. Someone solves a complex crisis, the system returns to normal and recording what was done is left for later. Over time, that person becomes the exclusive owner of that knowledge. That is what Ian Ramone, commercial director at N&DC, describes in an article published by ABC da Comunicação on 19/02/2026: availability indicators look good, but the operation relies on the memory of a few people. In the software world, this risk has a nickname: bus factor. It is the number of people whose absence would cause a critical impact. If the number is 1, the departure of a single person can stop projects, as a CTO explains in a text from DGS Web, on Substack. The name comes from a provocative question: what happens to the company if that person is hit by a bus tomorrow? Some signs that a system or process depends on a single person (illustrative scenarios, not real cases):

• only one person knows how to release a new version or recover the system after a failure;
• when she is on vacation, questions pile up and tasks stay on hold until she returns;
• documentation exists, but only she knows what is outdated;
• nobody wants to touch the parts of the system that "have always worked";
• the company fears she may quit or negotiate from a position of strength.

The result is apparent stability: everything works until the day that person is not there.

What reduces key-person risk in practice

There is no single formula, but the practices that appear most often in the sources we consulted are similar, and none of them depends on a hero:

• Map critical dependencies: find out in which systems and in which people knowledge is concentrated.
• Document as part of the work: every implementation, change or fix updates the knowledge base.
• Spread understanding: code review, pair programming and role rotation make more than one person know each part.
• Automate and standardize: environments anyone can recreate and clear playbooks for incidents.
• Review often: repeat the mapping to see whether knowledge is actually spreading.

For leadership, it is worth giving knowledge resilience the same weight given to infrastructure resilience, as the ABC da Comunicação article argues. It is the project-scale equivalent of the succession plan Nvidia does not publicly have.

What Espresso brings to systems that depend on a few people

At Espresso, maintaining and modernizing software that already sustains an operation is part of the work. We have more than 8 years of experience, more than 220 clients served and 57 systems under maintenance. For systems that cannot stop, what we bring is:

• maintenance and modernization of the software that already runs the operation, without taking down what is live;
• rigor, testing and extra care in critical systems;
• code that another person can read, maintain and evolve;
• continuous monitoring of how the system is used and behaves, so it evolves based on what actually happens.

We have already told how sustaining a critical system works in a regulated sector in the article about software houses for brokerage firms and how continuous evolution fits into the routine of those who operate in agribusiness in Is Brazilian agribusiness innovating fast enough?. If your system depends on one or two people, talk to people who understand systems that cannot stop, through the contact form or on WhatsApp.

Frequently asked questions

What is key-person risk? It is the exposure of a company that depends on one person, or a few, for decisions, relationships or knowledge that cannot be replaced quickly. The test is replacement: how much time and cost it would take to cover what that person does. It can be the CEO, but also a developer who alone knows a critical system. What is bus factor? It is an informal measure of the number of people whose absence would cause a critical impact on a project or company. If a team's bus factor is 1, only one person holds the essential knowledge, and their departure can paralyze the work. The name comes from the question of what would happen if someone were hit by a bus. How do I know if my system depends on a single person? Watch the operation when that person is absent. If questions pile up, if tasks stop until they return or if nobody can release a version or recover the system after a failure, the dependency is clear. Another sign is documentation that only they know whether it is up to date. Does documentation solve key-person risk? It helps, but only when documentation is part of the system's lifecycle and is updated with every implementation, change or fix. A document written once and forgotten loses value. Code review, role rotation and cross-training complement it, because they make more than one person understand each part. When does it make sense to ask for outside support? When the mapping shows critical points concentrated in a few people and the internal team cannot prioritize spreading knowledge. An outside view can point out blind spots that routine makes natural. It is worth talking before the key person leaves, not after. The facts about Nvidia reflect what had been disclosed up to November 9, 2026 and may change as the investigation progresses.