AI Governance and Regulation

Technology does not govern itself. When a new technology becomes powerful enough to cause serious harm — or powerful enough that its absence causes harm — societies create rules. We regulate automobiles, pharmaceuticals, financial instruments, and nuclear reactors not because we want to slow them down but because we want to deploy their benefits while managing their risks. AI is now at that threshold. This lesson surveys how governments and international bodies are approaching AI governance, examines the deep disagreements about what governance should look like, and prepares you to analyze regulatory proposals critically.

Why Governing AI Is Unusually Difficult

Traditional regulation operates on identifiable products with known risks. A pharmaceutical is a molecule with a known mechanism; it can be tested in trials, and its approval depends on demonstrating safety and efficacy for a specific indication. AI systems resist this framework for several reasons. First, AI is general-purpose. A large language model can be used for customer service, medical advice, propaganda generation, legal research, and coding assistance — often simultaneously. A regulation targeting one use may have unintended effects on others. Second, AI capability is emergent. Large models sometimes develop capabilities their creators did not anticipate and cannot fully predict. Regulating 'what a model can do' requires knowing what it can do — but that knowledge may lag the technology. Third, AI supply chains are global and layered. A model may be developed by a US company, trained on servers in the EU, fine-tuned by a startup in Singapore, and deployed by an enterprise in Brazil. Jurisdiction is genuinely ambiguous. Fourth, regulatory capture is a serious risk. AI regulation requires technical expertise, and the entities with the deepest technical expertise are the companies being regulated. Regulatory agencies may become dependent on the industry they oversee, weakening their ability to challenge it.

Three broad approaches to AI governance have emerged globally. Risk-based regulation (EU approach): The EU AI Act classifies AI applications by the risk they pose. 'Unacceptable risk' systems — such as real-time biometric surveillance in public spaces and social scoring — are banned. 'High risk' systems — including those used in employment, credit, critical infrastructure, education, and justice — are subject to stringent requirements: transparency, human oversight, data governance, and conformity assessment before deployment. Lower-risk systems face minimal requirements. Sectoral regulation (US approach): The United States has not enacted a comprehensive federal AI law (as of 2025). Instead, existing sectoral regulators — the FDA for medical AI, the CFPB for credit AI, the EEOC for employment AI — apply existing laws to AI in their domains. This produces an uneven patchwork: AI in finance may be regulated more strictly than AI in hiring, depending on which laws apply. State-led development (China approach): China has combined significant government investment in AI with detailed regulations focused on specific applications — deepfakes, recommendation algorithms, generative AI — while allowing broader deployment under state supervision. The governance model emphasizes national competitiveness alongside social stability. International bodies including the UN, OECD, G7, and the Council of Europe have published AI principles and frameworks. These are largely non-binding — expressions of norms rather than enforceable rules. The gap between principles and enforcement is one of the defining tensions of current AI governance.

Key Governance Mechanisms

Beyond broad regulatory frameworks, several specific governance mechanisms are actively debated. Mandatory disclosure and audit requirements: Requiring AI systems in high-stakes domains to be audited by independent third parties before deployment and periodically thereafter. Analogous to financial audits. The challenge is that AI auditing lacks agreed-upon standards, and audits of complex models may not detect all risks. Impact assessments: Requiring developers or deployers to conduct algorithmic impact assessments — systematic analyses of who may be harmed and how — before deployment. The EU AI Act requires these for high-risk systems. Like environmental impact assessments, they formalize the obligation to anticipate harm before causing it. Incident reporting: Requiring organizations to report AI-related harms, similarly to how aviation incidents are reported to safety boards. Aggregate incident data enables pattern recognition that individual cases do not. Liability frameworks: Determining who is legally responsible when an AI system causes harm — the developer, the deployer, or both — and whether fault must be proved or whether strict liability applies (as with certain product liability claims). The EU AI Liability Directive, proposed in 2022, would ease the burden of proof for plaintiffs harmed by AI systems. Government procurement standards: Governments as major purchasers of AI can set standards through procurement requirements rather than regulation. If a government refuses to purchase facial recognition systems that lack bias testing, vendors will supply tested systems.