Current Governance Landscape for AI Systems
The honest answer is: a patchwork that's still forming, with significant gaps.
Binding regulation (limited but growing)
•EU AI Act is the most comprehensive so far—risk-tiered rules, with stricter requirements for "high-risk" applications, transparency obligations for general-purpose AI models, and some outright bans (like certain biometric surveillance uses). Still being phased in.
•Sectoral laws that predate AI but apply anyway: anti-discrimination law, consumer protection, product liability, GDPR-style data protection rules. These create real legal exposure even without AI-specific statutes.
•US approach is fragmented—no comprehensive federal law. Instead: an executive order (subject to change with administrations), FTC enforcement using existing consumer protection authority, state-level laws (Colorado, Illinois, California have various AI-related statutes), and agency-specific guidance.
•China has its own regulatory regime for generative AI, algorithmic recommendation systems, etc., with different priorities (content control, security review).
Industry commitments (voluntary, weaker teeth)
•Companies like Anthropic, OpenAI, Google DeepMind have made voluntary commitments (White House commitments, Frontier Model Forum) around safety testing, red-teaming, information sharing.
•These are self-policed—there's no independent enforcement mechanism if a company decides to walk back a commitment.
Internal governance
•Companies have their own responsible scaling policies, usage policies, safety teams. Anthropic's Responsible Scaling Policy is one example—it ties development decisions to capability thresholds. But it's self-imposed and self-graded.
What's notably thin or missing:
•No international binding treaty comparable to nuclear nonproliferation frameworks.
•No robust third-party auditing regime that's mandatory across jurisdictions.
•Liability rules for harms caused by AI-generated content/decisions are still being worked out case by case.
•No agreed global standard for what "safety testing" even means before deployment.
•Enforcement capacity often lags the pace of deployment—regulators are behind technically and in staffing.
So the real state of things: there's more structure than five years ago, but a lot rests on companies' voluntary choices and reputational incentives rather than hard external accountability. If you're asking because you want to know what actually constrains a system like me in practice, it's a mix of Anthropic's internal policies, some binding law depending on jurisdiction, and reputational/market pressure—not yet a mature external regulatory system.
Want me to go deeper on any one piece—like the EU AI Act's actual mechanics, or how RSPs work?