# Governance & Regulation URL: https://justuju.org/concern/governance/ Cross-cutting concern, on every layer Laws, standards, licences and export controls that constrain what can be built and deployed. ## D1 · Story Countries make rules for AI, just like they make rules for cars and medicines. Some rules say which chips can be sold to which countries. Some say people must be told when they are talking to an AI, or when a picture was made by one. Companies also write their own rules, and promise to test their AI before they share it. Like: Rules for cars: who may build them, how they are tested, and what drivers must do. ## D2 · Picture Rules reach every layer: energy reporting for data centres, export controls on advanced chips, copyright and transparency duties for training data, extra duties for the most capable models, and duties to tell people when they meet AI. The EU AI Act is the broadest law so far. It sorts AI by risk: some uses are banned, high-risk systems need checks and records, general-purpose models must document their training, and models trained with more than 10²⁵ floating-point operations are presumed to carry systemic risk. The United States leans on export controls (which chips and tools may go where) and on voluntary frameworks such as NIST's AI Risk Management Framework. Other countries publish guidance, such as Singapore's 2026 framework for agentic AI. Licences are governance too: an open-weights licence sets what others may do with a model, and the EU's open-source exemptions don't cover the most capable models. If you deploy AI rather than build models, for example a business using a chatbot or an AI hiring tool in the EU, the AI Act still applies. Since February 2025 you must take steps to build AI literacy among staff who use AI (softened in 2026 to supporting it). From August 2026, people must be told when they are talking to an AI unless it is obvious, and deployers must label deepfakes, and AI-written text published to inform the public unless a person has edited it under their own responsibility. If you use a high-risk system, such as one for hiring or credit decisions, you must follow its instructions for use, assign trained staff to oversee it, keep its logs for at least six months, and tell workers and the people it affects. Those high-risk duties apply from 2 December 2027 (2 August 2028 for AI inside regulated products), under the 2026 amendment. Like: Rules for cars: who may build them, how they are tested, and what drivers must do. Where it breaks: Car rules grew over a century and are similar everywhere. AI rules are new, differ a lot between countries, change year to year, and often rely on companies' voluntary promises. ## D5 · Frontier Rules written for "the model" and "the provider" get harder to apply as models are fine-tuned, compressed and wrapped by others. Compute thresholds are rough. Efficient training or extra computing at answer time lets smaller models match larger ones, so the AI Act lets the Commission change the threshold and designate models on other grounds (AI Act). Who is the provider? Someone who fine-tunes or compresses another's model becomes its provider only if the change uses more than a third of the original training compute (Commission guidelines, 2025). Rules move. The May 2026 deal became law in July 2026: high-risk duties now apply from 2 December 2027, or 2 August 2028 for AI in regulated products, while transparency duties started in August 2026 (Regulation 2026/1744). Compute as a lever. Chips are easy to count and control, but poorly scoped rules could harm privacy and concentrate power (Sastry et al., 2024). Mostly voluntary. Twelve companies published or updated frontier safety frameworks in 2025, and only a few jurisdictions have begun to make such practices law (International AI Safety Report, 2026). ## Examples as of 2026-10-14 - EU AI Act (Regulation 2024/1689) - US export controls on advanced computing chips - NIST AI Risk Management Framework - Singapore Model AI Governance Framework for Agentic AI - EU Energy Efficiency Directive (data centre reporting) ## Sources - Regulation (EU) 2024/1689 (the AI Act): https://eur-lex.europa.eu/eli/reg/2024/1689/oj - European Commission: Guidelines on the scope of obligations for providers of general-purpose AI models: https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act - EU AI Act Omnibus Agreement: postponed high-risk deadlines and other key changes (Gibson Dunn): https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/ - Computing Power and the Governance of Artificial Intelligence (Sastry et al.): https://arxiv.org/abs/2402.08797 - NIST AI Risk Management Framework (AI RMF 1.0): https://www.nist.gov/itl/ai-risk-management-framework - International AI Safety Report 2026: https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026 - Regulation (EU) 2026/1744 amending the AI Act (Digital Omnibus on AI): https://eur-lex.europa.eu/eli/reg/2026/1744/oj --- Justuju · https://justuju.org/ · Content CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Quote with a link to the page.