What changes for governance and regulation as AI oversight becomes a field?

The shift

Producing the artifacts and analysis of regulation — draft rules, impact assessments, compliance checks, comparisons across jurisdictions, comment synthesis — goes from scarce lawyer-and-analyst hours to near-free and instant. But the thing being regulated has also changed: a probabilistic system that updates faster than any deliberative process can revise its rules, and whose behavior can't be read off its structure the way a bridge's can. The shift is two-sided — cheap regulatory production meets a moving, opaque target.

The axioms

• Regulation moves at a deliberative pace, and that's a feature. Slow rulemaking — notice, comment, revision, review — buys legitimacy and catches errors. Rests on the assumption that the thing being regulated changes slowly enough for slow rules to still fit when they land.
• You can inspect a product or process to certify it, and the certification stays valid. Type approval, audits, safety certificates — inspect once, trust until the next review. Rests on the artifact being fixed and inspectable, and on its behavior being readable from its structure.
• Rules bind identifiable actors — a manufacturer, an operator, a licensee. Liability attaches to a legal person you can name. Rests on there being a clear, single actor responsible for a given output.
• Harms are attributable and traceable back to a cause and an actor. Enforcement needs a chain from damage to decision to decision-maker. Rests on causation being reconstructible.
• Regulators can understand what they oversee well enough to write rules for it. Rests on the domain being legible to a diligent expert — inspectable, explainable, reducible to stated criteria.
• A public authority with democratic legitimacy sets and enforces the rules. Rests on legitimacy and enforcement power being properties only an accountable state institution holds.
• Someone with standing must decide how much societal risk is acceptable. Rests on risk-acceptance being a judgment call under genuine novelty, not a computation.

Invalid axioms

1. Regulation moves at a deliberative pace, and that's a feature. The deliberative pace was tolerable when the regulated technology also moved slowly. Model capability now shifts on a timescale of months; a rule that takes two-to-three years to finalize can be aimed at a system that no longer exists by the time it binds. The pace itself isn't wrong — it's that the gap between rule-speed and capability-speed became a first-order problem. The habit-trap: legislatures still write capability-specific thresholds (parameter counts, compute floors, named model behaviors) into primary legislation, the slowest-to-amend instrument, guaranteeing the rule is calibrated to a snapshot that's stale on arrival.
2. You can inspect a product once to certify it, and the certification stays valid. A frontier model is not a fixed artifact — it's fine-tuned, updated, given new tools, and re-weighted continuously, and the same weights produce different behavior under different prompts and scaffolding. Certifying "the model" at a point in time certifies something that no longer exists after the next update. The habit-trap: importing type-approval and conformity-assessment templates from cars, drugs, and medical devices, which assume a frozen unit rolls off a line and stays that unit.
3. Regulators can inspect a system to understand it — a black box can be opened like a bridge. You cannot read a model's decision procedure off its weights the way you read load tolerance off a truss. Mechanistic interpretability is real and improving fast, but as of mid-2026 it does not deliver a reliable, courtroom-grade account of why a given output occurred. The habit-trap: writing "explainability" and "transparency" requirements that assume inspection yields understanding, when the honest artifact is a behavioral audit — testing what the system does — not a structural one.

Unchanged axioms

1. A public authority with democratic legitimacy sets and enforces the rules. Legitimacy to bind and the coercive power to enforce are properties of an accountable state institution — a model, a lab, or a standards body can't hold them. AI drafts the rule text and runs the compliance check; it can't be the authority that the rule's force derives from. This becomes more load-bearing, not less, as more of the analysis around a rule gets automated.
2. Someone with standing must decide how much societal risk is acceptable. How much accident risk, bias, or misuse a society will tolerate against what benefit is a value judgment under novelty, not a synthesis task. AI can lay out the risk surface and the tradeoffs; it has no standing to choose them on the public's behalf. Genuinely novel risks — a capability no one has regulated before — are exactly where there's no precedent to pattern-match and where confidently-wrong analysis is most dangerous.
3. Enforcement ultimately attaches to an accountable legal person. For enforcement to mean anything, penalties must land on someone who can be fined, barred, or jailed. The model can't be liable. This survives the shift, but the who gets genuinely hard (see NEW) — the principle holds while its application strains.

New axioms

1. When the regulated system is probabilistic and changes under you, oversight must solve for governing a moving target rather than a fixed artifact. Rules written against a snapshot don't bind the thing that's actually deployed. The open problem is regulatory instruments that track capability continuously — staged approvals, post-deployment monitoring, license-to-operate that can be pulled — rather than one-time certification. Which of these actually work is unsettled and moving fast.
2. The pacing problem: rules risk being obsolete on arrival. When capability moves in months and law moves in years, the scarce act shifts from writing the rule to designing rules that stay relevant as the target moves — outcome-based duties, delegated technical standards that update without reopening statute, sunset-and-review by default. Get the delegation wrong and you either freeze bad rules or hand rule-making to unaccountable bodies.
3. Auditing systems you can't fully interpret. When you can't read intent off the weights, oversight must solve for evaluation regimes that establish trust behaviorally — red-teaming, evals, incident reporting, continuous monitoring — and for who is trusted to run them and whether their results generalize past the tests. This is the central open technical-governance question as of mid-2026.
4. Jurisdictional arbitrage. Models are trained and served across borders while rules are national or regional. Oversight must solve for actors relocating training, inference, or corporate domicile to the lightest-touch regime, and for whether extraterritorial reach (market-access conditions, compute controls) can substitute for physical jurisdiction. Fast-moving and heavily contested.
5. Regulatory capture by the few labs with the expertise. The people who understand frontier systems well enough to regulate them mostly work at, or came from, the handful of labs being regulated. Oversight must solve for building independent state capacity to evaluate models rather than depending on the regulated party's self-reports and secondments — a dependency that quietly sets the rules in the labs' favor.
6. Accountability across the model supply chain. When a harm involves a base-model provider, a fine-tuner, an application developer, a deployer, and an end user, oversight must solve for allocating liability across a chain where each party can plausibly point at another. "Bind an identifiable actor" still holds in principle; which actor, for which failure, is genuinely unsettled — and how it's resolved (strict liability on the deployer, shared duties up the chain, safe harbors) is moving through legislatures and courts now.

Where it breaks

Regulators import one-time certification from cars and medical devices (INVALID #2) at the moment the systems they're certifying update continuously and can't be structurally inspected (NEW #1, NEW #3) — so a compliance certificate attests to a frozen snapshot that stopped being the deployed system after the next fine-tune, giving false assurance rather than oversight. The certificate is aimed at exactly the wrong property.

A second collision: legislatures still assume a deliberative pace is safe (INVALID #1) while the only bodies with the expertise to keep technical rules current are the labs being regulated (NEW #5). The slower the primary legislation, the more real rule-making gets delegated to fast-moving technical standards — and the thinner independent state capacity is, the more that delegated authority defaults to the regulated party. Slowness at the top quietly hands the pen to the few it was meant to constrain.

ai-axioms.vercel.app/axioms/government/ai-governance-regulation-ai-axioms