Policy & Governance Resources
A curated library of frameworks, regulatory documents, case studies, and academic work the author endorses as worthwhile reading for readers of the paper.
OMB Issues Revised Policies on AI Use and Procurement by Federal Agencies
Both gates in one place. The OMB memoranda require agencies to inventory and publish their AI use cases annually and to test high-impact systems before deployment — and they push specific terms into the contract itself: limits on vendor use of agency data, portability and knowledge transfer against lock-in, and disclosure when a vendor introduces AI you did not ask for.
Topic · US Regulation
U.S. Department of Justice — AI Inventory
A published register in its working form: 315 entries for 2025, up 30.7% in a year, tracking each use case across its full life from pre-deployment through retirement. A concrete answer to what the record actually contains — including what the Department withholds, and why.
Topic · Public Sector
Model Contractual Clauses for AI Procurement in the EU: Key Takeaways
A practical read on the EU's model clauses for AI procurement: what the supplier must warrant, what audit rights and documentation access the buyer gets, and the split between the full high-risk version and the light one. Note what the clauses deliberately leave to the rest of the contract — IP, payment, and liability beyond the AI-specific obligations.
Topic · Legal & Liability
Federal Reserve Board — Compliance Plan for OMB Memorandum M-25-21
What a central AI register looks like when an institution actually runs one. Staff must document every AI use case and submit it to the AI Program; the Chief AI Officer explicitly approves high-impact uses; and the Board keeps technical controls to terminate noncompliant AI on its own IT resources — the sanctioned/shadow distinction enforced rather than merely asserted.
Topic · Governance, Risk & Compliance
Baseline Security Controls: Retire
Retirement treated as a security phase rather than an afterthought. RAND's baseline controls make the case that decommissioning is where exposure concentrates: a model withdrawn from use still holds sensitive data, metadata and intellectual property, and one retired badly can leak training data, proprietary model artifacts, or details of the infrastructure it ran on — a regulatory, privacy and security problem arriving after everyone has stopped watching the system.
Topic · Governance, Risk & Compliance
AI Debris: Residual Risk and the Afterlife of Failed AI Systems
Argues that retiring a system does not retire its risk. “AI debris” is what remains once a model is switched off — workflow dependency, contaminated data, deskilled staff, and accountability nobody has claimed — and the paper proposes a stepwise decommissioning protocol demanding auditable evidence at each step. A preprint rather than peer-reviewed work; the checklist is the useful part.
Topic · Governance, Risk & Compliance
EU AI Act — Article 49: Registration
The registration gate in law. On the Commission's official Act Service Desk, Article 49 requires high-risk systems to be entered in the EU database before they are placed on the market or put into service — registration as a precondition of deployment, not a filing that follows it.
Topic · EU Regulation
EU AI Act — Article 26: Obligations of Deployers of High-Risk AI Systems
The deploying organization's side of the register. Article 26 requires competent human oversight to be assigned, operation to be monitored, and automatically generated logs to be retained for at least six months — and bars a public-authority deployer from using a high-risk system that is not yet registered.
Topic · EU Regulation
Who's Responsible for Agentic AI?
Clifford Chance’s survey of who bears responsibility when autonomous AI agents cause harm — the global consensus is to keep humans in charge and accountable rather than grant AI legal personhood.
Topic · Legal & Liability
The Ethics and Challenges of Legal Personhood for AI
A Yale Law Journal Forum essay on the ethics and challenges of granting AI legal personhood — scholarly grounding for treating AI as a tool whose accountability stays with humans, not a separate legal entity.
Topic · Legal & Liability
The Duty of Supervision in the Age of Generative AI
The ABA’s account of the board/executive/legal duty of supervision over generative AI — an organization and its leaders remain accountable for AI use, the accountability principle in a professional-conduct frame.
Topic · Legal & Liability
Redefining the Standard of Human Oversight for AI Negligence (Harvard JOLT)
Argues that “human in the loop” mandates fail on automation bias and vigilance decrement, and names the “liability sponge” — a person absorbing responsibility for a system they lack the capacity to supervise. The legal case for why an operator cannot personally stand in for a harness the work required.
Topic · Legal & Liability
No Legal Personhood for AI
A peer-reviewed argument that AI lacks the agency and accountability that legal personhood would require — scholarly grounding for the chapter’s rejection of AI as a separate, liable entity.
Topic · Legal & Liability
Germany: Court Rules Chatbot Operators Liable for AI Hallucinations
A German court (OLG Hamm, May 2026) held a company liable for its own AI chatbot’s misleading answers — the chatbot is corporate communication, like an employee’s statement. Accountability for AI output flows to the deploying organization.
Topic · Legal & Liability
Germany: Court Holds Google Liable for Incorrect AI Overviews
A German court (Munich, May 2026) held Google directly liable for false statements in its AI Overviews — the AI summary is content attributable to the company. A fresh marker that organizations own their AI’s output.
Topic · Legal & Liability
Generative AI Tools: ABA Formal Opinion 512
An analysis of ABA Formal Opinion 512 by an ABA ethics-committee member: lawyers must understand AI’s limits and independently verify its output, retaining full professional accountability — the principle applied to a regulated profession.
Topic · Legal & Liability
AI in Litigation: Gen-AI Sanctions Update (2026)
A 2026 update on U.S. court sanctions for AI-hallucinated filings — courts uniformly reject “the AI did it”; the responsible attorney owns every citation regardless of the tool. The accountability principle enforced through 2026.
Topic · Legal & Liability
AI Hallucinations in Court Filings: A 2025 Review of Sanctions
A 2025 survey of court sanctions for AI-fabricated citations, documenting how repeatedly judges reject the “the AI made the mistake” defense — the accountability principle enforced in practice.
Topic · Legal & Liability
Updated OECD Definition of an AI System
The updated OECD definition of an AI system (2023) with its explanatory memorandum — the intergovernmental reference definition many regulators build on.
Topic · Governance, Risk & Compliance
Three Lines of Defense Against Risks from AI (Schuett)
Adapts the Institute of Internal Auditors’ Three Lines model — a framework for assigning and coordinating risk roles — to AI, arguing it closes coverage gaps and lets boards oversee management. The scholarly case for supplementing existing control functions rather than standing up a parallel one.
Topic · Governance, Risk & Compliance
The Language of Trustworthy AI: In-Depth Glossary (NIST)
NIST’s in-depth glossary of trustworthy-AI terms, aligned to the AI RMF — an authoritative vocabulary for the definitions an organization must agree on.
Topic · Governance, Risk & Compliance
Risk Tiering AI Use Cases: A Practical Guide (Google Cloud Office of the CISO)
Tiers AI use cases by autonomy, architectural agency, data and IAM boundaries, and blast radius, then attaches controls to each tier — automated guardrails and a stop control at the autonomous end, human approval plus anti-automation-bias measures in the middle. Insists the controls be technically enforced rather than documented.
Topic · Governance, Risk & Compliance
OpenAI — Hugging Face Model-Evaluation Security Incident
OpenAI’s disclosure of a security incident in a Hugging Face model-evaluation workflow — a concrete case of risk inside the AI evaluation pipeline itself, reinforcing why higher-trust tiers require stronger verification and tighter harnessing.
Topic · Governance, Risk & Compliance
OECD AI Principle: Accountability
The intergovernmental accountability standard: organizations and individuals developing, deploying, or operating AI are accountable for its proper functioning, by role and context — a near-verbatim statement of this chapter’s principle.
Topic · Governance, Risk & Compliance
Institutional Intelligence Brief
Receive updates on new chapters, critical policy shifts, and emerging AI governance frameworks directly in your inbox.
A double opt-in confirmation keeps the list clean; unsubscribe anytime.