Policy & Governance Resources
A curated library of frameworks, regulatory documents, case studies, and academic work the author endorses as worthwhile reading for readers of the paper.
OMB Issues Revised Policies on AI Use and Procurement by Federal Agencies
Both gates in one place. The OMB memoranda require agencies to inventory and publish their AI use cases annually and to test high-impact systems before deployment — and they push specific terms into the contract itself: limits on vendor use of agency data, portability and knowledge transfer against lock-in, and disclosure when a vendor introduces AI you did not ask for.
Topic · US Regulation
U.S. Department of Justice — AI Inventory
A published register in its working form: 315 entries for 2025, up 30.7% in a year, tracking each use case across its full life from pre-deployment through retirement. A concrete answer to what the record actually contains — including what the Department withholds, and why.
Topic · Public Sector
Model Contractual Clauses for AI Procurement in the EU: Key Takeaways
A practical read on the EU's model clauses for AI procurement: what the supplier must warrant, what audit rights and documentation access the buyer gets, and the split between the full high-risk version and the light one. Note what the clauses deliberately leave to the rest of the contract — IP, payment, and liability beyond the AI-specific obligations.
Topic · Legal & Liability
Federal Reserve Board — Compliance Plan for OMB Memorandum M-25-21
What a central AI register looks like when an institution actually runs one. Staff must document every AI use case and submit it to the AI Program; the Chief AI Officer explicitly approves high-impact uses; and the Board keeps technical controls to terminate noncompliant AI on its own IT resources — the sanctioned/shadow distinction enforced rather than merely asserted.
Topic · Governance, Risk & Compliance
Baseline Security Controls: Retire
Retirement treated as a security phase rather than an afterthought. RAND's baseline controls make the case that decommissioning is where exposure concentrates: a model withdrawn from use still holds sensitive data, metadata and intellectual property, and one retired badly can leak training data, proprietary model artifacts, or details of the infrastructure it ran on — a regulatory, privacy and security problem arriving after everyone has stopped watching the system.
Topic · Governance, Risk & Compliance
AI Debris: Residual Risk and the Afterlife of Failed AI Systems
Argues that retiring a system does not retire its risk. “AI debris” is what remains once a model is switched off — workflow dependency, contaminated data, deskilled staff, and accountability nobody has claimed — and the paper proposes a stepwise decommissioning protocol demanding auditable evidence at each step. A preprint rather than peer-reviewed work; the checklist is the useful part.
Topic · Governance, Risk & Compliance
EU AI Act — Article 49: Registration
The registration gate in law. On the Commission's official Act Service Desk, Article 49 requires high-risk systems to be entered in the EU database before they are placed on the market or put into service — registration as a precondition of deployment, not a filing that follows it.
Topic · EU Regulation
EU AI Act — Article 26: Obligations of Deployers of High-Risk AI Systems
The deploying organization's side of the register. Article 26 requires competent human oversight to be assigned, operation to be monitored, and automatically generated logs to be retained for at least six months — and bars a public-authority deployer from using a high-risk system that is not yet registered.
Topic · EU Regulation
Who's Responsible for Agentic AI?
Clifford Chance’s survey of who bears responsibility when autonomous AI agents cause harm — the global consensus is to keep humans in charge and accountable rather than grant AI legal personhood.
Topic · Legal & Liability
The Ethics and Challenges of Legal Personhood for AI
A Yale Law Journal Forum essay on the ethics and challenges of granting AI legal personhood — scholarly grounding for treating AI as a tool whose accountability stays with humans, not a separate legal entity.
Topic · Legal & Liability
The Duty of Supervision in the Age of Generative AI
The ABA’s account of the board/executive/legal duty of supervision over generative AI — an organization and its leaders remain accountable for AI use, the accountability principle in a professional-conduct frame.
Topic · Legal & Liability
Redefining the Standard of Human Oversight for AI Negligence (Harvard JOLT)
Argues that “human in the loop” mandates fail on automation bias and vigilance decrement, and names the “liability sponge” — a person absorbing responsibility for a system they lack the capacity to supervise. The legal case for why an operator cannot personally stand in for a harness the work required.
Topic · Legal & Liability
Institutional Intelligence Brief
Receive updates on new chapters, critical policy shifts, and emerging AI governance frameworks directly in your inbox.
A double opt-in confirmation keeps the list clean; unsubscribe anytime.