Governance of AI Systems: Current State
There's no single comprehensive framework—it's a patchwork of regulations, voluntary commitments, and industry practices that varies significantly by jurisdiction. Here's a realistic breakdown:
Binding Regulations
EU AI Act (most comprehensive so far)
•Risk-tiered approach: bans certain uses (social scoring, some biometric surveillance), imposes strict requirements on "high-risk" systems, lighter touch for general-purpose AI
•Requirements around transparency, documentation, human oversight for higher-risk categories
•Still being phased in, with enforcement details evolving
Sector-specific rules (apply regardless of AI involvement)
•Healthcare (HIPAA, medical device regulations)
•Finance (lending discrimination laws, financial advice regulations)
•Employment law (discrimination protections apply to AI-driven hiring decisions)
•Consumer protection laws (deceptive practices, product liability)
Data protection laws
•GDPR, CCPA, and similar laws affect what data can train models and how
•Right to explanation provisions (contested in scope/enforceability)
Non-Binding but Influential
•NIST AI Risk Management Framework (US) - voluntary but shapes industry practice
•Company-specific policies (like Anthropic's Responsible Scaling Policy, OpenAI's preparedness framework)
•International bodies' principles (OECD AI Principles, UNESCO recommendations) - aspirational, not enforceable
Notable Gaps
•No binding international treaty governing frontier AI development
•US lacks comprehensive federal AI legislation (relies on existing laws + executive orders, which can be reversed)
•Enforcement mechanisms for many voluntary commitments are unclear
•Liability frameworks for AI-caused harms are still being worked out in courts case-by-case
•Rules haven't caught up with capabilities—much current regulation was designed before systems like me existed
Accountability in Practice
Much of what happens is self-governance: companies setting their own safety thresholds, red-teaming practices, and deployment criteria. This means accountability often depends on competitive/reputational pressure and internal culture as much as external enforcement.
I'd note I don't have detailed insight into Anthropic's internal decision-making processes beyond what's publicly documented, so I can't speak with authority on exactly how these frameworks get applied in my specific case.
What's driving your interest in this—policy work, research, or something else? I can go deeper on any particular area.