The Future of AI Governance

New Research Publication Alert on AI Act Governance! 🚀 Regulation is nothing without enforcement. The AI Office is gearing up, AI Safety Institutes are springing into work. How can these institutions become a success? We are excited to share our collaborative paper, crafted by an interdisciplinary team from Digital Ethics Center (DEC), Yale University, the European New School of Digital Studies and the University of Agder. This paper presents a forward-thinking analysis of the European Union's Artificial Intelligence Act and proposes a robust, adaptive framework for AI governance. 🔍 Title: "A Robust Governance for the AI Act: AI Office, AI Board, Scientific Panel, and National Authorities" Authors: Claudio Novelli, Jessica Rose Morley, PhD, Philipp Hacker, Jarle Trondal and Luciano Floridi. Highlights of Our Study: 1. Anticipatory Regulation & Adaptive Governance: We emphasize the need for forward-looking perspectives on AI governance. We stress anticipatory regulation and the adaptive capabilities of governance structures to keep pace with technological advancements. 2. Five Key Proposals for Robust Governance: - Establish the AI Office as a Decentralized Agency: Similar to EFSA or EMA, this move aims to enhance its autonomy and reduce influences from political agendas at the Commission level. - Consolidate Advisory Bodies: Merge the Advisory Forum and the Scientific Panel into a single entity to streamline decision-making and improve the quality of advice wrt both technical and societal implications of AI. - Improve Coherence Among EU Bodies: Address overlapping or conflicting jurisdictions by strengthening the EU Agency Network and creating an EU AI Coordination Hub (EU AICH) - Authority of the AI Board: Give the AI Board more authority to revise national decisions to prevent inconsistent application of AI regulations across Member States, similar to issues with GDPR enforcement. - Introduce Mechanisms for Continuous Learning: Establish a dedicated unit within the AI Office for continuous learning and adaptation, sharing best (and worst) practices, and simplifying regulatory frameworks to aid compliance, especially for SMEs. 3. Future Outlook for AI Governance: - The paper acknowledges that the governance of AI in the EU is both promising and challenging. As AI technologies evolve, the AIA's governance structures must remain flexible and robust to address new developments and unforeseen risks. Ultimately, the AI Office could, and should, evolve into a cross-sectoral "digital agency," handling various laws relating to AI and emerging technologies. 📃 Read the full paper here: https://lnkd.in/ei8EnzTD Comments most welcome! #aiact #AI #Governance #eulaw #ArtificialIntelligenceAct #InterdisciplinaryResearch #AIRegulation #FutureOfAI

"The rapid evolution and swift adoption of generative AI have prompted governments to keep pace and prepare for future developments and impacts. Policy-makers are considering how generative artificial intelligence (AI) can be used in the public interest, balancing economic and social opportunities while mitigating risks. To achieve this purpose, this paper provides a comprehensive 360° governance framework: 1 Harness past: Use existing regulations and address gaps introduced by generative AI. The effectiveness of national strategies for promoting AI innovation and responsible practices depends on the timely assessment of the regulatory levers at hand to tackle the unique challenges and opportunities presented by the technology. Prior to developing new AI regulations or authorities, governments should: – Assess existing regulations for tensions and gaps caused by generative AI, coordinating across the policy objectives of multiple regulatory instruments – Clarify responsibility allocation through legal and regulatory precedents and supplement efforts where gaps are found – Evaluate existing regulatory authorities for capacity to tackle generative AI challenges and consider the trade-offs for centralizing authority within a dedicated agency 2 Build present: Cultivate whole-of-society generative AI governance and cross-sector knowledge sharing. Government policy-makers and regulators cannot independently ensure the resilient governance of generative AI – additional stakeholder groups from across industry, civil society and academia are also needed. Governments must use a broader set of governance tools, beyond regulations, to: – Address challenges unique to each stakeholder group in contributing to whole-of-society generative AI governance – Cultivate multistakeholder knowledge-sharing and encourage interdisciplinary thinking – Lead by example by adopting responsible AI practices 3 Plan future: Incorporate preparedness and agility into generative AI governance and cultivate international cooperation. Generative AI’s capabilities are evolving alongside other technologies. Governments need to develop national strategies that consider limited resources and global uncertainties, and that feature foresight mechanisms to adapt policies and regulations to technological advancements and emerging risks. This necessitates the following key actions: – Targeted investments for AI upskilling and recruitment in government – Horizon scanning of generative AI innovation and foreseeable risks associated with emerging capabilities, convergence with other technologies and interactions with humans – Foresight exercises to prepare for multiple possible futures – Impact assessment and agile regulations to prepare for the downstream effects of existing regulation and for future AI developments – International cooperation to align standards and risk taxonomies and facilitate the sharing of knowledge and infrastructure"

By 2028, Boards of Directors will not be able to treat AI as a side conversation or a delegated technical issue. AI is becoming a core governance responsibility. As risk velocity accelerates and corporate complexity deepens, boards must develop algorithmic awareness, AI fluency, and new oversight muscles. Fiduciary duty will increasingly depend on how well directors understand AI driven risk sensing, ethical governance, strategic foresight, board effectiveness, and stakeholder sentiment. The boards that lead will not just react faster. They will govern smarter, anticipate disruption earlier, and build long term trust with investors, regulators, and society. I break this down in the latest piece, 2028 Boardroom Playbook: Using AI to Lead, Govern, and Win, with five concrete AI use cases every board should understand now. Read more about it here: https://lnkd.in/evUMrFR2 AI is no longer just a tool for management. It is becoming a compass for modern governance.

I had the privilege of delivering a lecture yesterday at the School of Management at Harbin Institute of Technology (HIT) , one of China’s C9 universities, on a topic that will define the trajectory of our century: Governing Intelligence: The Future Architecture for Responsible AI in a Fragmented World. As AI capabilities accelerate from generative to agentic systems and move toward proto-AGI, humanity stands at a profound inflection point. Intelligence is rapidly becoming a new form of global infrastructure. Yet while AI advances in months, our governance systems evolve in years. This widening gap is one of the greatest strategic risks of our time. Across the world, the governance landscape is diverging: - The U.S. prioritizes innovation and competitive advantage, - China emphasizes sovereignty and control, - The EU focuses on rights and risk mitigation, - And the UAE, uniquely, is emerging as a strategic bridge connecting global blocs. These fragmented philosophies create a world where we innovate together but govern apart, with no shared definitions of safety, accountability, or acceptable risk. As I highlighted in the lecture, this fragmentation, if left unaddressed, will increase the probability of systemic failures, regulatory arbitrage, unchecked agentic AI, and even existential risk. To move beyond this trajectory, I introduced a Future Architecture for Responsible AI Governance, a layered global blueprint that brings coherence, clarity, and shared responsibility: - Global AI Principles & Frameworks grounded in human rights and universal values - Clear Red Lines where the world must say no, from fully autonomous lethal systems to unregulated AI-driven bioengineering - Green Lines that direct AI toward humanity’s highest priorities, healthcare, climate modeling, disaster prediction, education, and inclusion - A Full AI Safety & Assurance Stack to build systems that are safe, robust, verifiable, and governable in real-world conditions - A Global Responsibility Council, an “IAEA for AI”, to set safety baselines and coordinate responses to global AI incidents Five priority actions for the next five years: 1️⃣ Harmonize global interoperable standards 2️⃣ Invest in TEVV and AI assurance capacity 3️⃣ Build sovereign, culturally aligned, responsible models 4️⃣ Embed safety-by-design across ecosystems 5️⃣ Strengthen global tech diplomacy for a shared future What encouraged me most today was the energy of HIT’s faculty, researchers, and students, the future guardians of intelligent systems. Universities, as I noted, have a critical role to play: they are the anchors of ethical reflection, rigorous methodology, and cross-disciplinary thinking that the world urgently needs. If we aspire to an Intelligent Age that expands human potential rather than constrains it, the world must converge on shared frameworks, shared norms, and shared mechanisms for responsibility. We still have time to shape the future, but only if we act together.

The GRC market is quietly splitting in two. On the surface, it looks like convergence. Every major platform is adding AI capabilities. ServiceNow, MetricStream, Drata, Vanta. Chatbots that draft policies. Automation that gathers evidence. Assistants that summarise risk registers. The pitch is consistent: AI makes GRC faster. But underneath the feature announcements, something more interesting is happening. A separate category is forming around a different problem entirely. Not using AI to accelerate governance, but governing AI itself. Credo AI, Holistic AI, ModelOp, Fiddler. Gartner published its first Market Guide for AI Governance Platforms in November 2025, which suggests the analyst community sees these as distinct. The reason this matters is scope. Five years ago, AI governance meant a few ML models in fraud detection or recommendation engines. Narrow, contained, manageable. Today, AI is embedded in everything. Customer support runs on LLMs. Agents book meetings, write code, make purchasing decisions. Copilots sit inside every productivity tool. Shadow AI is everywhere because AI is everywhere. When AI was a feature, governing it was a checkbox. When AI becomes the operating layer for most business processes, governing it becomes the whole game. Traditional GRC wasn't built for this. It assumes periodic assessment, human-produced evidence, and systems that stay relatively stable between reviews. AI systems drift, learn, act autonomously, and change behaviour based on yesterday's data. The enterprise GRC vendors have distribution and existing budget ownership. The AI governance vendors have architectural fit for how these systems actually behave. Both have a case. I don't know yet whether these categories merge or stay separate. What I'm watching is whether the growth of AI as infrastructure forces a corresponding growth in AI-native governance, or whether the traditional platforms absorb the problem fast enough. If AI becomes the operating layer for most of your business processes, does your current GRC approach still make sense? #AISecurity #AIGovernance #GRC #CyberSecurity #CISO #AI

As a member of the United Nations Secretary-General’s High-level Advisory Body on AI (HLAB-AI) report, Governing AI for Humanity, I am excited to share the results of our collective efforts. This report offers a comprehensive blueprint for global AI governance that prioritizes humanity, human rights, and equity in the rapidly evolving AI landscape. https://lnkd.in/eK9uqHMG The report outlines key recommendations: 🔹 Common Understanding: Establishing an International Scientific Panel on AI to bridge knowledge gaps and provide impartial insights to member states. 🔹 Common Ground: Encouraging global dialogue and regulatory interoperability to align AI governance with human rights values. 🔹 Common Benefits: Supporting a global AI capacity-building network to boost AI governance capabilities and foster local innovations that advance the Sustainable Development Goals (SDGs). Together, we can build an inclusive, transparent, and accountable framework that ensures AI benefits everyone. It has been an honour to be part of this important work, and I look forward to seeing how we can shape the future of AI for the better. #AI #AIGovernance #GlobalCollaboration #HumanRights #UN #SustainableDevelopment #AI4Good

Everyone is talking about AI governance. But I think we are missing a more fundamental shift. For decades, enterprise governance was built around one assumption: The actor was human. Humans understand policies. Humans seek approvals. Humans operate at human speed. Humans can be trained and held accountable. Now the actor is increasingly an AI agent. Agents access data, retrieve context, invoke APIs, update records, and make decisions continuously and at machine speed. That is the mismatch. Governance was designed for humans. The next decade will require governance designed for agents. This is why I believe the future challenge is not simply governing data. It is governing autonomous actors operating on data. Many organizations are responding with more policies, more guardrails, and more agent registries. Those are important, but they address only part of the problem. The harder challenge is architectural. How do we establish identity for agents? How do we validate intent? How do we enforce permissions at execution time? How do we reconstruct decisions and actions after the fact? How do we make accountability work at machine speed? In my view, this is where enterprise data platforms become increasingly important. Not because governance belongs only in the database, but because the data platform is one of the few places where identity, context, policy, enforcement, auditability, and traceability can come together. The organizations that solve this will gain far more than compliance. They will gain the confidence to trust agents with more decisions, automate more workflows, and scale AI adoption faster than competitors. The winners in the Agentic AI era will not be the organizations with the most policies. They will be the organizations that can safely delegate the most decisions to agents. #AI #AgenticAI #EnterpriseAI #AIGovernance #DataPlatforms #PostgreSQL #EnterpriseArchitecture #AIInfrastructure

A New Path for Agile AI Governance To avoid the rigid pitfalls of past IT Enterprise Architecture governance, AI governance must be built for speed and business alignment. These principles create a framework that enables, rather than hinders, transformation: 1. Federated & Flexible Model: Replace central bottlenecks with a federated model. A small central team defines high-level principles, while business units handle implementation. This empowers teams closest to the data, ensuring both agility and accountability. 2. Embedded Governance: Integrate controls directly into the AI development lifecycle. This "governance-by-design" approach uses automated tools and clear guidelines for ethics and bias from the project's start, shifting from a final roadblock to a continuous process. 3. Risk-Based & Adaptive Approach: Tailor governance to the application's risk level. High-risk AI systems receive rigorous review, while low-risk applications are streamlined. This framework must be adaptive, evolving with new AI technologies and regulations. 4. Proactive Security Guardrails: Go beyond traditional security by implementing specific guardrails for unique AI vulnerabilities like model poisoning, data extraction attacks, and adversarial inputs. This involves securing the entire AI/ML pipeline—from data ingestion and training environments to deployment and continuous monitoring for anomalous behavior. 5. Collaborative Culture: Break down silos with cross-functional teams from legal, data science, engineering, and business units. AI ethics boards and continuous education foster shared ownership and responsible practices. 6. Focus on Business Value: Measure success by business outcomes, not just technical compliance. Demonstrating how good governance improves revenue, efficiency, and customer satisfaction is crucial for securing executive support. The Way Forward: Balancing Control & Innovation Effective AI governance balances robust control with rapid innovation. By learning from the past, enterprises can design a resilient framework with the right guardrails, empowering teams to harness AI's full potential and keep pace with business. How does your Enterprise handle AI governance?

One of the most important shifts in AI governance is happening quietly. Governments are starting to regulate compute, not just models. At first glance, this sounds highly technical. It is actually about power. A recent paper by Matteo Pistillo Suzanne Van Arsdale Lennart Heim and Christoph Winter on compute thresholds argues that training compute may become the key regulatory trigger for frontier AI systems - because compute is measurable, monitorable, and harder to hide than model capabilities themselves. If this approach scales, AI governance starts looking less like content moderation and more like financial supervision, and that has major implications. The strategic chokepoints are no longer only algorithms or applications. They are cloud infrastructure, semiconductor supply chains, chip access, training clusters, and verification systems. In other words: infrastructure becomes governance. The deeper implication is geopolitical. Only a small number of actors control advanced compute at scale. So the future of AI governance may depend less on whether governments can regulate "AI" in the abstract - and more on whether they can govern concentrated infrastructure ecosystems dominated by a handful of firms and jurisdictions. This also explains why AI sovereignty debates are intensifying globally. Because dependence on external compute infrastructure increasingly looks like strategic dependence itself. The next phase of AI governance may not primarily be about regulating intelligence. It may be about regulating access to the industrial base that produces it. #AIGovernance #ComputePolicy #DigitalSovereignty #TechPolicy #AIPolicy

Most AI governance frameworks still assume risk is relatively static. Conduct an assessment. Assign a rating. Review it next quarter. Repeat. That approach worked reasonably well for traditional technology risk. I'm not convinced it works for AI. AI risk changes constantly. New agents are deployed. Permissions expand. Data sources change. Vendors introduce new AI capabilities. Threat actors develop new attack techniques. Regulations evolve. Business use cases shift. The question is no longer: "What's our AI risk rating?" The better question is: "How is our AI risk profile changing right now?" That thinking led me to develop the Runtime AI Governance Maturity Model. The progression isn't simply from governance to automation. It's a progression toward Adaptive AI Risk Intelligence. Level 1 — Ad Hoc AI Level 2 — Defined AI Governance Level 3 — Managed AI Governance Level 4 — Continuous AI Risk Governance Level 5 — Adaptive AI Risk Intelligence At Level 5, risk is not treated as a static score. Risk continuously adjusts based on: • Runtime telemetry • Threat intelligence • Third-party risk signals • Regulatory developments • Business criticality changes • Control effectiveness The result is a living risk profile rather than a point-in-time assessment. I believe the future of AI governance will look much more like modern cybersecurity, operational risk management, and continuous monitoring than traditional compliance programs. AI governance is no longer just about governing models. It's about continuously understanding how risk is changing and adapting controls accordingly. #AIGovernance #AIRisk #OperationalRisk #CyberSecurity #ThirdPartyRisk #NIST #FAIR #ISO42001 #AIControls #ResponsibleAI #AgenticAI