JustujuAI, layer by layer.Open in the interactive map

Governance & Regulation

Laws, standards, licences and export controls that constrain what can be built and deployed.

Cross-cutting concern, spans every layer · Draft, awaiting expert review, reviewed 2026-10-14

D1 · StoryFor young children and total beginners

Guess: who decides what an AI is allowed to do?

Countries make rules for AI, just like they make rules for cars and medicines.

Some rules say which chips can be sold to which countries. Some say people must be told when they are talking to an AI, or when a picture was made by one.

Companies also write their own rules, and promise to test their AI before they share it.

Like: Rules for cars: who may build them, how they are tested, and what drivers must do.

D2 · PictureFor curious beginners

Rules reach every layer: energy reporting for data centres, export controls on advanced chips, copyright and transparency duties for training data, extra duties for the most capable models, and duties to tell people when they meet AI.

The EU AI Act is the broadest law so far. It sorts AI by risk: some uses are banned, high-risk systems need checks and records, general-purpose models must document their training, and models trained with more than 10²⁵ floating-point operations are presumed to carry systemic risk.

The United States leans on export controls (which chips and tools may go where) and on voluntary frameworks such as NIST's AI Risk Management Framework. Other countries publish guidance, such as Singapore's 2026 framework for agentic AI.

Licences are governance too: an open-weights licence sets what others may do with a model, and the EU's open-source exemptions don't cover the most capable models.

Like: Rules for cars: who may build them, how they are tested, and what drivers must do.
Where it breaks: Car rules grew over a century and are similar everywhere. AI rules are new, differ a lot between countries, change year to year, and often rely on companies' voluntary promises.

D5 · FrontierFor experts

Compute thresholds are easy to measure but rough: a smaller model trained more efficiently, or given more computing at answer time, can match a larger one. The AI Act lets the Commission change the threshold and designate models on other grounds.

Who counts as the 'provider' gets harder down the stack. Under the Commission's 2025 guidelines, someone who fine-tunes or compresses another's model becomes its provider only if the change uses more than a third of the original training compute.

Rules move. In May 2026 the EU agreed to push its high-risk deadlines back to December 2027 and August 2028, while the transparency duties start in August 2026. Check dates against the official text before relying on them.

Compute governance is an active research field: chips and clusters are detectable, excludable and quantifiable, which makes them a lever, but poorly scoped rules could harm privacy and concentrate power.

Most risk management is still voluntary: twelve companies published or updated frontier safety frameworks in 2025, and only a few jurisdictions have begun to make such practices law.

On every layer

Examples as of 2026-10-14

Sources

  1. Regulation (EU) 2024/1689 (the AI Act) (2024)
  2. European Commission: Guidelines on the scope of obligations for providers of general-purpose AI models (2025-07-18)
  3. EU AI Act Omnibus Agreement: postponed high-risk deadlines and other key changes (Gibson Dunn) (2026-05)
  4. Computing Power and the Governance of Artificial Intelligence (Sastry et al.) (2024-02-13)
  5. NIST AI Risk Management Framework (AI RMF 1.0) (2023-01-26)
  6. International AI Safety Report 2026 (2026-02-03)