Governance of AI Systems: Current State
There's no single comprehensive framework—it's a patchwork that varies significantly by jurisdiction and is still evolving rapidly. Here's a realistic breakdown:
Binding Legal Requirements
EU AI Act (most comprehensive so far)
•Risk-based tiers with different obligations
•Bans certain uses outright (social scoring, some biometric surveillance)
•Requires transparency disclosures for AI-generated content in some contexts
•Still being phased in through 2025-2027
Sector-specific rules that apply regardless of AI involvement
•HIPAA (health data, US)
•Financial regulations (lending discrimination, securities law)
•Existing consumer protection and anti-discrimination laws
•These weren't written for AI but courts/regulators are applying them to AI systems
Data protection laws
•GDPR (EU), CCPA (California), similar laws elsewhere
•Govern training data collection, user data handling, some automated decision-making
Softer Governance
•US Executive Orders on AI (subject to change with administrations)
•Voluntary commitments companies make to governments or standards bodies (NIST framework, etc.)
•Company-specific policies - usage policies, content guidelines - these are contractual/terms-of-service, not law
•Industry self-regulation - varies widely in enforcement
What's Notably Thin or Absent
•No comprehensive federal AI law in the US
•Limited specific rules for training data provenance/consent
•Accountability for AI-caused harms often relies on stretching existing tort/product liability law
•No international binding treaty
•Enforcement mechanisms for many "AI principles" documents are weak or nonexistent
Practical Reality
Much of what shapes how I'm built and deployed comes from:
•Anthropic's internal policies and safety practices (not legally mandated, though increasingly documented publicly)
•Competitive/reputational pressure
•Anticipation of future regulation
•The specific laws of jurisdictions where the product operates
I don't have visibility into Anthropic's internal governance processes beyond what's publicly documented, so I can't speak authoritatively about exactly how compliance works internally. If you're researching this for something specific—a paper, policy work, personal decision-making—I'm happy to go deeper on any particular area.