Redistributed

The most powerful AI systems in the world are currently regulated by... mostly their own developers. This is changing, slowly, unevenly, and with significant gaps.

The Current Landscape

United States: No comprehensive federal AI regulation. The White House Executive Order on AI (October 2023) requires reporting for large training runs but has limited enforcement power (White House, 2023). NIST develops voluntary frameworks. The FTC can act on deceptive practices. Sector-specific agencies (FDA, SEC, DOT) regulate AI in their domains. States, especially California, are moving faster than the federal government.

European Union: The AI Act (passed 2024) is the most comprehensive framework. It requires foundation model providers to meet transparency, documentation, and safety requirements. Enforcement begins in phases through 2026. The EU AI Office handles cross-border issues.

United Kingdom: The "pro-innovation" approach relies on existing regulators applying AI guidance to their sectors. No new AI-specific regulator. The AI Safety Institute studies frontier risks but doesn't have enforcement powers.

China: Active regulation of AI-generated content, algorithmic recommendations, and deepfakes. Foundation model providers must register and submit models for review before public release. Less transparency about compliance mechanisms.

Everywhere else: Most countries have no AI-specific regulation. Many are watching EU and US approaches before committing.

The Regulatory Gap

Foundation models are developed by a handful of companies in a handful of countries. They're deployed globally. This creates jurisdictional arbitrage:

A model trained in the US, hosted on servers in Ireland, accessed by users in Brazil — who regulates it?
Safety standards that apply in the EU may not apply to the same model served to users in India.
Requirements for transparency with regulators in one jurisdiction may not translate to disclosure elsewhere.

The companies operating at the frontier are larger, faster-moving, and better-resourced than the regulators trying to oversee them.

Self-Governance

In the absence of comprehensive regulation, foundation model developers have created their own governance mechanisms:

Responsible scaling policies: Commitments to evaluate models for dangerous capabilities before deployment and pause if certain thresholds are exceeded. Anthropic's RSP and OpenAI's Preparedness Framework are examples (Schuett et al., 2023).

Voluntary commitments: Pledges made to governments, like the White House commitments of July 2023. Not legally binding.

Third-party audits: Some companies invite external researchers to red-team models before release. The depth and independence of these audits varies.

Safety teams: Internal research groups focused on alignment and safety. Subject to the same pressures and incentives as any internal function.

The question is whether self-governance is adequate for systems this consequential. History suggests that industries rarely constrain themselves when profits conflict with safety. That said, some self-governance efforts represent genuine contributions — Anthropic's responsible scaling policy, for instance, creates measurable commitments with defined thresholds, which is more substantive than the vague pledges common in earlier tech governance. The challenge is ensuring these commitments are independently verifiable and not subject to quiet revision under competitive pressure.

What Effective Governance Would Require

Capacity: Regulators need technical expertise to evaluate complex AI systems. Currently, most expertise lives inside the companies being regulated.

Access: Meaningful oversight requires seeing inside the training process, not just the finished model. Current approaches focus on outputs; the significant decisions happen earlier.

Enforcement: Regulation without enforcement is suggestion. Current penalties, where they exist, are small relative to company revenues.

Coordination: Global systems need global governance, or at least mutual recognition frameworks. The current patchwork creates gaps and inconsistencies.

Speed: AI capabilities advance faster than regulatory processes move. By the time a rule is finalized, the technology has often shifted.

What Good Looks Like

Despite the gaps, some governance approaches show promise.

The EU's risk-based framework, for all its limitations, demonstrates that democratic institutions can write binding rules for complex technology. Its phased implementation — banning the most harmful uses first, then requiring compliance for high-risk systems — is a pragmatic approach that other jurisdictions are studying.

NIST's AI Risk Management Framework, while voluntary, provides a common vocabulary and evaluation structure that both industry and regulators can use. It is not sufficient, but it creates the foundation for more binding requirements.

Colorado's deployment-focused approach — regulating how AI is used rather than how it is built — may prove more tractable than model-level regulation, and it directly addresses the harms people experience.

Municipal algorithmic accountability — Amsterdam's algorithm register, New York's bias audits for hiring tools — demonstrates that governance can start locally and build upward.

The realistic path is not a single global regulatory body but a layered system: local accountability mechanisms, national regulatory frameworks, and international coordination on shared standards. This is how we govern other complex systems — aviation, pharmaceuticals, financial markets — and it can work for AI too.

The Stakes

Foundation models are becoming infrastructure — embedded in search, productivity software, creative tools, healthcare, education. The question of who regulates them is really a question of who shapes that infrastructure.

Right now, that power rests largely with a few companies. Whether it shifts to democratic institutions, international bodies, or remains where it is will determine what kind of AI future we get.

Sources

White House. "Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence." 2023. White House
European Union. "Regulation (EU) 2024/1689 (AI Act)." Official Journal, 2024. EUR-Lex
Schuett, Jonas et al. "Towards Best Practices in AGI Safety and Governance." 2023. arXiv
Anderljung, Markus et al. "Frontier AI Regulation: Managing Emerging Risks to Public Safety." 2023. arXiv
Hadfield, Gillian & Clark, Jack. "Regulatory Markets for AI Safety." 2023. arXiv

General

Who Regulates Foundation Models