Policy & Governance Resources
A curated library of frameworks, regulatory documents, case studies, and academic work the author endorses as worthwhile reading for readers of the paper.
Who's Responsible for Agentic AI?
Clifford Chance’s survey of who bears responsibility when autonomous AI agents cause harm — the global consensus is to keep humans in charge and accountable rather than grant AI legal personhood.
Topic · Legal & Liability
The Ethics and Challenges of Legal Personhood for AI
A Yale Law Journal Forum essay on the ethics and challenges of granting AI legal personhood — scholarly grounding for treating AI as a tool whose accountability stays with humans, not a separate legal entity.
Topic · Legal & Liability
The Duty of Supervision in the Age of Generative AI
The ABA’s account of the board/executive/legal duty of supervision over generative AI — an organization and its leaders remain accountable for AI use, the accountability principle in a professional-conduct frame.
Topic · Legal & Liability
Redefining the Standard of Human Oversight for AI Negligence (Harvard JOLT)
Argues that “human in the loop” mandates fail on automation bias and vigilance decrement, and names the “liability sponge” — a person absorbing responsibility for a system they lack the capacity to supervise. The legal case for why an operator cannot personally stand in for a harness the work required.
Topic · Legal & Liability
No Legal Personhood for AI
A peer-reviewed argument that AI lacks the agency and accountability that legal personhood would require — scholarly grounding for the chapter’s rejection of AI as a separate, liable entity.
Topic · Legal & Liability
Germany: Court Rules Chatbot Operators Liable for AI Hallucinations
A German court (OLG Hamm, May 2026) held a company liable for its own AI chatbot’s misleading answers — the chatbot is corporate communication, like an employee’s statement. Accountability for AI output flows to the deploying organization.
Topic · Legal & Liability
Germany: Court Holds Google Liable for Incorrect AI Overviews
A German court (Munich, May 2026) held Google directly liable for false statements in its AI Overviews — the AI summary is content attributable to the company. A fresh marker that organizations own their AI’s output.
Topic · Legal & Liability
Generative AI Tools: ABA Formal Opinion 512
An analysis of ABA Formal Opinion 512 by an ABA ethics-committee member: lawyers must understand AI’s limits and independently verify its output, retaining full professional accountability — the principle applied to a regulated profession.
Topic · Legal & Liability
AI in Litigation: Gen-AI Sanctions Update (2026)
A 2026 update on U.S. court sanctions for AI-hallucinated filings — courts uniformly reject “the AI did it”; the responsible attorney owns every citation regardless of the tool. The accountability principle enforced through 2026.
Topic · Legal & Liability
AI Hallucinations in Court Filings: A 2025 Review of Sanctions
A 2025 survey of court sanctions for AI-fabricated citations, documenting how repeatedly judges reject the “the AI made the mistake” defense — the accountability principle enforced in practice.
Topic · Legal & Liability
Updated OECD Definition of an AI System
The updated OECD definition of an AI system (2023) with its explanatory memorandum — the intergovernmental reference definition many regulators build on.
Topic · Governance, Risk & Compliance
Three Lines of Defense Against Risks from AI (Schuett)
Adapts the Institute of Internal Auditors’ Three Lines model — a framework for assigning and coordinating risk roles — to AI, arguing it closes coverage gaps and lets boards oversee management. The scholarly case for supplementing existing control functions rather than standing up a parallel one.
Topic · Governance, Risk & Compliance
The Language of Trustworthy AI: In-Depth Glossary (NIST)
NIST’s in-depth glossary of trustworthy-AI terms, aligned to the AI RMF — an authoritative vocabulary for the definitions an organization must agree on.
Topic · Governance, Risk & Compliance
Risk Tiering AI Use Cases: A Practical Guide (Google Cloud Office of the CISO)
Tiers AI use cases by autonomy, architectural agency, data and IAM boundaries, and blast radius, then attaches controls to each tier — automated guardrails and a stop control at the autonomous end, human approval plus anti-automation-bias measures in the middle. Insists the controls be technically enforced rather than documented.
Topic · Governance, Risk & Compliance
OpenAI — Hugging Face Model-Evaluation Security Incident
OpenAI’s disclosure of a security incident in a Hugging Face model-evaluation workflow — a concrete case of risk inside the AI evaluation pipeline itself, reinforcing why higher-trust tiers require stronger verification and tighter harnessing.
Topic · Governance, Risk & Compliance
OECD AI Principle: Accountability
The intergovernmental accountability standard: organizations and individuals developing, deploying, or operating AI are accountable for its proper functioning, by role and context — a near-verbatim statement of this chapter’s principle.
Topic · Governance, Risk & Compliance
OECD — Drawing the AI / Non-AI Boundary
OECD’s explainer on drawing the AI / non-AI line — the intergovernmental consensus definition and the “continuum, no red line” framing any boundary test must reckon with.
Topic · Governance, Risk & Compliance
NIST AI RMF: Agentic Profile (Cloud Security Alliance)
An industry profile extending the NIST AI RMF to autonomous agents that independently arrives at a Tier 1 (supervised) through Tier 4 (fully autonomous) classification — with oversight boundaries set per deployment, tool-use risk modeled by consequence scope and reversibility, and delegation registers naming the responsible human.
Topic · Governance, Risk & Compliance
Human-in-the-Loop Artificial Intelligence: A Systematic Review of Concepts, Methods, and Applications
An open-access systematic review that organizes human-in-the-loop systems into a unified taxonomy by loop placement, interaction granularity, and temporal characteristics — a scholarly map of the ground between a human gating every action and a human supervising an autonomous process.
Topic · Governance, Risk & Compliance
How Internal Audit Can Adapt to AI (EY)
Maps AI oversight onto the three lines — operational teams, then risk and compliance, then internal audit — and names who owns what, up through the chief audit executive and the board. Argues for trigger-based coverage tied to high-impact deployments rather than a static annual plan.
Topic · Governance, Risk & Compliance
Examining Human Reliance on Artificial Intelligence in Decision Making (Scientific Reports)
Peer-reviewed evidence that people do discriminate useful AI guidance from bad — but that a positive attitude toward AI measurably degrades that discrimination, and that AI-derived guidance biases judgement in a way equivalent human guidance does not.
Topic · Governance, Risk & Compliance
Detecting and Correcting Reference Hallucinations in Commercial LLMs and Deep Research Agents
Measures fabricated citations at scale — 3–13% of citation URLs hallucinated across ~221,000 URLs and ten models — and finds that deep research agents cite more sources than search-augmented models while hallucinating at a higher rate. The empirical weight behind checking a grounded system’s sources rather than trusting them.
Topic · Governance, Risk & Compliance
An Autonomy-Based Classification: AI Agents, Liability and Lessons from the Automated Vehicles Act
A five-level autonomy spectrum for AI agents — graded by generality of function, control allocation, and environmental access — in which liability shifts toward the provider as the user’s control diminishes. A policy-side counterpart to classifying deployments by the constraint around them.
Topic · Governance, Risk & Compliance
AI Board Governance Roadmap (Deloitte)
Directs boards to establish who in management owns AI, to assign oversight to a named body or committee, and to require risk reporting upward — the board-level counterpart to naming a single policy owner distinct from a governance council.
Topic · Governance, Risk & Compliance
A Decoupled Human-in-the-Loop System for Controlled Autonomy in Agentic Workflows
Proposes treating human oversight as an independent component of the agent operating environment rather than logic hard-coded into each workflow, with a four-dimension design framework covering when humans engage, who decides, and through what channel. An architecture for where the gate lives.
Topic · Governance, Risk & Compliance
European Commission Guidelines on the Definition of an AI System
The European Commission’s official guidelines (Feb 2025) on how to determine whether a software system is an “AI system” under the AI Act — the practical boundary test behind the Article 3 definition.
Topic · EU Regulation
EU Draft Guidelines on Classifying High-Risk AI Systems
The Commission’s draft guidelines on classifying high-risk AI systems — which categories of AI system draw heightened obligations, a comparative reference for defining the scope a policy governs.
Topic · EU Regulation
EU AI Act Article 3, Annotated (Future of Life Institute)
A readable, recital-linked annotation of EU AI Act Article 3 (68 defined terms including “AI system”), maintained by the Future of Life Institute — a convenient reader reference (unofficial machine translation).
Topic · EU Regulation
EU AI Act — Article 3: Definitions
The EU AI Act’s binding legal definition of an “AI system” (Article 3(1)), on the Commission’s official Act Service Desk — the authoritative anchor for what a policy governs and where the boundary sits.
Topic · EU Regulation
EU AI Act — Article 14: Human Oversight
The legal spine of a domain custodian’s veto. On the Commission’s official Act Service Desk, Article 14 requires that human oversight be assigned to natural persons with the necessary competence, training and “authority” — empowered to disregard, override or reverse an AI system’s output and to interrupt its operation.
Topic · EU Regulation
Colorado Artificial Intelligence Act (SB 24-205)
The first comprehensive US state AI law: a duty of reasonable care on developers and deployers of high-risk systems making consequential decisions. Effective June 30, 2026.
Topic · US Regulation
California Transparency in Frontier AI Act (SB 53)
California’s frontier-model transparency law — published safety frameworks, critical-incident reporting, transparency reports, and whistleblower protections for large frontier developers.
Topic · US Regulation
UK Government — Artificial Intelligence Playbook
The UK government’s practical playbook for safe, effective AI adoption across public-sector teams — a strong, concrete comparator for enterprise policy.
Topic · Public Sector
GovAI Coalition — AI Policy Templates & Resources
A reusable, NIST-aligned toolkit — policy template, governance handbook, incident-response plan, and vendor agreement — built by public-sector practitioners for direct adaptation.
Topic · Public Sector
GAO-25-107653 — Generative AI Use at Federal Agencies
A comparative GAO study of generative-AI use and management across 12 federal agencies — a rigorous inventory of how large institutions are actually governing AI.
Topic · Public Sector
CDT — AI in Local Government
The Center for Democracy & Technology’s comparative analysis of AI governance across roughly 20 counties and cities — strong orientation reading on the public-sector layer.
Topic · Public Sector
Institutional Intelligence Brief
Receive updates on new chapters, critical policy shifts, and emerging AI governance frameworks directly in your inbox.
A double opt-in confirmation keeps the list clean; unsubscribe anytime.