Where are we at the moment with AI governance

Below are concise, actionable policy options paired with the actors best placed to implement each. Options are practical, interoperable across jurisdictions, and scalable to different capabilities. 1. Model classification and capability-based certification - What: Require independent testing and tiered certification based on model capabilities (e.g., compute, emergent behaviors, ability to generate disinformation or perform code/biological design). - Who: National regulators (tech/competition/security agencies) set rules; accredited third‑party labs perform testing; standards bodies (ISO, OECD, IEC) define technical criteria. - Rationale: Focuses regulatory attention where risk is highest and creates interoperable attestations for cross‑border use/export. 2. Mandatory pre‑deployment impact assessments (AIIA) - What: Obligate developers and deployers of high‑risk systems to conduct and publish standardized impact assessments covering safety, privacy, discrimination, security, and societal harms. - Who: Legislatures/regulatory agencies mandate format and scope; firms conduct assessments; independent auditors verify completeness for high‑risk classes. - Rationale: Encourages risk identification early, informs procurement and public oversight, and creates accountability trails. 3. Incident reporting and near‑miss sharing - What: Require timely reporting of safety incidents, misuse, and near misses to a secure national or international repository, with tiers for confidentiality vs public disclosure. - Who: National regulators require reporting; an international body (OECD or a UN technical forum) hosts cross‑border aggregation and anonymized sharing; industry participates via sectoral coalitions. - Rationale: Builds collective learning, early warning about emergent risks, and evidence for regulation; balances transparency with IP/security needs. 4. Regulatory sandboxes and conditional authorizations - What: Create controlled environments where novel AI systems can be tested under regulatory supervision with informed users and monitoring. - Who: National agencies (financial, health, transport) run sandboxes; regional blocs coordinate mutual recognition of lessons and approvals. - Rationale: Lowers barriers to innovation while enabling regulators to observe real‑world impacts and refine rules. 5. Model provenance, documentation and “model cards” mandates - What: Standardize and require metadata disclosures (training data provenance, capability statements, known limitations, safety evaluations) for models above a risk threshold. - Who: Standards bodies define schemas; national regulators mandate disclosures for market access; procurement rules require them for public contracts. - Rationale: Improves transparency for users, auditors, and downstream deployers; aids accountability and risk management. 6. Export controls and usage restrictions for high‑capability models - What: Restrict cross‑border transfer of models, weights, or specialized tooling that enable dual‑use harms; apply licensing and end‑use controls. - Who: National governments coordinate multilaterally (Wassenaar-like processes, G7, OECD) for harmonized controls; customs/security agencies enforce. - Rationale: Mitigates proliferation of capabilities that can be misused for cyberattacks, biological design, or large‑scale disinformation. 7. Mandatory red‑teaming and adversarial testing for high‑risk models - What: Require internal and external red‑teaming, with documented remediation before broad deployment. - Who: Firms perform tests; accredited independent red‑teams and standard test suites (via NIST/ISO) validate results; regulators set minimum requirements for high‑risk classes. - Rationale: Reduces unexpected failure modes and uncovers misuse vectors prior to release. 8. Liability frameworks and clarity on accountability - What: Define civil and administrative liability rules for harms caused by AI (differentiating manufacturers, deployers, and operators), and safe‑harbor paths for good‑faith compliance. - Who: Legislatures enact laws; courts refine standards through adjudication; regulators provide guidance and enforcement. - Rationale: Aligns incentives for safer design and careful deployment without stifling innovation. 9. Public procurement standards and certification requirements - What: Require certified safety, transparency, and impact assessments for AI used in government services. - Who: Governments set procurement rules; procurement agencies enforce; vendors comply to sell to public sector. - Rationale: Uses government buying power to raise baseline safety and set market norms. 10. Capacity building and technical assistance for lower‑resource countries - What: Fund and coordinate technical help (training, labs, policy toolkits) so more countries can assess and regulate AI responsibly. - Who: Multilateral development banks, OECD, UN agencies, regional organizations deliver programs; high‑income states fund and mentor. - Rationale: Reduces governance gaps, promotes interoperable standards, and prevents regulatory arbitrage. Implementation notes (short) - Layered approach: Combine voluntary standards for lower‑risk systems with mandatory rules and audits for high‑risk or high‑capability AI. - MutualTitle: Concrete AI Governance Options — What to Do and Who Should Act Below recognition: are practical Encourage international policy options, brief descriptions, and the actors best mutual recognition placed to implement each of certifications one. 1. Mandatory pre and test‑deployment impact assessments - results to What: Require developers/deploy reduce duplicationers to assess risks (safety, privacy, and friction fairness, security) before public release, with documentation. - and mitigation plans. - Who: National Privacy/security regulators (privacy/data balance: protection authorities, sectoral regulators), procurement Design reporting agencies for government use and sharing; companies must conduct and certify systems that assessments. - Why: Ident protect IPifies harms early and creates accountability and sensitive trail. 2. data while Risk‑based model enabling oversight certification and labeling - What. -: Independent certification for high‑ Iterationrisk models (safety tests: Use, red‑te sandboxesaming results), plus standardized labels/model cards and phased describing capabilities, limitations, and training data rollouts provenance. - Who so rules: National standards bodies and certifying agencies can adapt (or delegated third alongside rapid‑party conformity assessment bodies); technical change international standards bodies (ISO, OECD). Selected for harmonized criteria; industry references consortia to operationalize- OECD tests. - Why: Provides verifiable AI Principles assurance to regulators, purchasers, & AI and the public; supports cross Policy Observatory‑border interoperability. 3. Mandatory incident reporting and - shared near‑miss databases - What EU AI: Obligate organizations to report Act ( breaches, misuse, or seriousproposal) model failures to authorities and contribute- N anonymized near‑miss dataIST AI to secure Risk Management, shared repositories. - Who Framework : Regulators (- UNESCOcybersecurity agencies, sectoral overse Recommendation oners) the Ethics of AI to collect If you want reports; multilateral platforms (, IOECD, UN) or trusted intermedi can convertaries to host shared databases; industry required this into to submit. - Why: a one Enables collective learning, faster mitigation‑page, and evidence for policy brief policymaking. 4. Export tailored to controls and model capability classification a specific- What: Class actor (ify models by capability and restrict export ornational regulator access to high‑capability, tech models and associated tooling that pose firm, security risks. - Who: or international National governments (trade and security agencies) body). coordinating via multilateral fora (Wassenaar Arrangement, G7/OECD) to align thresholds. - Why: Limits proliferation of dual‑use capabilities while allowing legitimate research and commerce. 5. Regulatory sandboxes and conditional approvals - What: Time‑limited, supervised testing environments where companies can pilot systems under regulatory oversight and data protection safeguards. - Who: Regulators and innovation agencies to host sandboxes; standards bodies to set evaluation criteria. - Why: Balances innovation with risk control and informs rulemaking with real‑world evidence. 6. Mandatory transparency for government use and procurement rules - What: Governments must disclose AI use in public services, conduct public impact assessments, and adopt procurement rules requiring vendor safety attestations. - Who: National and local governments, public procurement offices, audit institutions. - Why: Protects civil rights, promotes accountability, and incentivizes safer products. 7. Liability rules and consumer redress mechanisms - What: Clarify legal responsibility for harms from AI (strict liability for certain harms, duty of care standards), and ensure accessible remedies for affected individuals. - Who: Legislatures to enact liability frameworks; courts to interpret; regulators to implement enforcement mechanisms. - Why: Creates stronger incentives for safe design and deployment. 8. Funding and coordination for global safety research and capacity building - What: Public funding for foundational safety research, grants for low‑ and middle‑income countries to build regulatory capacity, and mechanisms for secure sharing of safety knowledge. - Who: National governments, multilateral institutions (World Bank, OECD, UN), philanthropic funders, and research consortia. - Why: Reduces global disparities and supports informed governance. 9. Standards for data governance and access controls - What: Rules for data provenance, consent, and secure data‑sharing infrastructures for model training and evaluation. - Who: Data protection authorities, standards bodies (ISO, IEEE), and national legislatures. - Why: Protects privacy and improves auditability. 10. Ethical review boards and corporate safety governance - What: Require large AI developers to maintain independent safety boards, red‑teaming teams, and internal compliance processes with whistleblower protections. - Who: Companies (especially those operating advanced models), guided by industry codes and regulator minimum requirements. - Why: Strengthens internal checks and aligns corporate incentives with public safety. Implementation notes (short) - Mix of instruments: Use a layered approach—mandatory rules for high‑risk cases, standards/certification for technical assurance, and voluntary best practices for lower‑risk innovation. - Multilevel coordination: National laws needed for enforcement; international alignment (standards, export controls, data sharing) reduces fragmentation. - Phased rollout: Start with high‑risk sectors/models, pilot sandboxes/certification, then scale as methods mature. Key sources and precedents: EU AI Act (risk‑based rules, conformity assessment), NIST AI Risk Management Framework (assessment guidance), OECD AI Principles (nonbinding standards), export‑control frameworks (for dual‑use tech).