Policy & Governance Resources
A curated library of frameworks, regulatory documents, case studies, and academic work the author endorses as worthwhile reading for readers of the paper.
OMB Issues Revised Policies on AI Use and Procurement by Federal Agencies
Both gates in one place. The OMB memoranda require agencies to inventory and publish their AI use cases annually and to test high-impact systems before deployment — and they push specific terms into the contract itself: limits on vendor use of agency data, portability and knowledge transfer against lock-in, and disclosure when a vendor introduces AI you did not ask for.
Topic · US Regulation
U.S. Department of Justice — AI Inventory
A published register in its working form: 315 entries for 2025, up 30.7% in a year, tracking each use case across its full life from pre-deployment through retirement. A concrete answer to what the record actually contains — including what the Department withholds, and why.
Topic · Public Sector
Model Contractual Clauses for AI Procurement in the EU: Key Takeaways
A practical read on the EU's model clauses for AI procurement: what the supplier must warrant, what audit rights and documentation access the buyer gets, and the split between the full high-risk version and the light one. Note what the clauses deliberately leave to the rest of the contract — IP, payment, and liability beyond the AI-specific obligations.
Topic · Legal & Liability
Federal Reserve Board — Compliance Plan for OMB Memorandum M-25-21
What a central AI register looks like when an institution actually runs one. Staff must document every AI use case and submit it to the AI Program; the Chief AI Officer explicitly approves high-impact uses; and the Board keeps technical controls to terminate noncompliant AI on its own IT resources — the sanctioned/shadow distinction enforced rather than merely asserted.
Topic · Governance, Risk & Compliance
Baseline Security Controls: Retire
Retirement treated as a security phase rather than an afterthought. RAND's baseline controls make the case that decommissioning is where exposure concentrates: a model withdrawn from use still holds sensitive data, metadata and intellectual property, and one retired badly can leak training data, proprietary model artifacts, or details of the infrastructure it ran on — a regulatory, privacy and security problem arriving after everyone has stopped watching the system.
Topic · Governance, Risk & Compliance
AI Debris: Residual Risk and the Afterlife of Failed AI Systems
Argues that retiring a system does not retire its risk. “AI debris” is what remains once a model is switched off — workflow dependency, contaminated data, deskilled staff, and accountability nobody has claimed — and the paper proposes a stepwise decommissioning protocol demanding auditable evidence at each step. A preprint rather than peer-reviewed work; the checklist is the useful part.
Topic · Governance, Risk & Compliance
EU AI Act — Article 49: Registration
The registration gate in law. On the Commission's official Act Service Desk, Article 49 requires high-risk systems to be entered in the EU database before they are placed on the market or put into service — registration as a precondition of deployment, not a filing that follows it.
Topic · EU Regulation
EU AI Act — Article 26: Obligations of Deployers of High-Risk AI Systems
The deploying organization's side of the register. Article 26 requires competent human oversight to be assigned, operation to be monitored, and automatically generated logs to be retained for at least six months — and bars a public-authority deployer from using a high-risk system that is not yet registered.
Topic · EU Regulation
Who's Responsible for Agentic AI?
Clifford Chance’s survey of who bears responsibility when autonomous AI agents cause harm — the global consensus is to keep humans in charge and accountable rather than grant AI legal personhood.
Topic · Legal & Liability
The Ethics and Challenges of Legal Personhood for AI
A Yale Law Journal Forum essay on the ethics and challenges of granting AI legal personhood — scholarly grounding for treating AI as a tool whose accountability stays with humans, not a separate legal entity.
Topic · Legal & Liability
The Duty of Supervision in the Age of Generative AI
The ABA’s account of the board/executive/legal duty of supervision over generative AI — an organization and its leaders remain accountable for AI use, the accountability principle in a professional-conduct frame.
Topic · Legal & Liability
Redefining the Standard of Human Oversight for AI Negligence (Harvard JOLT)
Argues that “human in the loop” mandates fail on automation bias and vigilance decrement, and names the “liability sponge” — a person absorbing responsibility for a system they lack the capacity to supervise. The legal case for why an operator cannot personally stand in for a harness the work required.
Topic · Legal & Liability
No Legal Personhood for AI
A peer-reviewed argument that AI lacks the agency and accountability that legal personhood would require — scholarly grounding for the chapter’s rejection of AI as a separate, liable entity.
Topic · Legal & Liability
Germany: Court Rules Chatbot Operators Liable for AI Hallucinations
A German court (OLG Hamm, May 2026) held a company liable for its own AI chatbot’s misleading answers — the chatbot is corporate communication, like an employee’s statement. Accountability for AI output flows to the deploying organization.
Topic · Legal & Liability
Germany: Court Holds Google Liable for Incorrect AI Overviews
A German court (Munich, May 2026) held Google directly liable for false statements in its AI Overviews — the AI summary is content attributable to the company. A fresh marker that organizations own their AI’s output.
Topic · Legal & Liability
Generative AI Tools: ABA Formal Opinion 512
An analysis of ABA Formal Opinion 512 by an ABA ethics-committee member: lawyers must understand AI’s limits and independently verify its output, retaining full professional accountability — the principle applied to a regulated profession.
Topic · Legal & Liability
AI in Litigation: Gen-AI Sanctions Update (2026)
A 2026 update on U.S. court sanctions for AI-hallucinated filings — courts uniformly reject “the AI did it”; the responsible attorney owns every citation regardless of the tool. The accountability principle enforced through 2026.
Topic · Legal & Liability
AI Hallucinations in Court Filings: A 2025 Review of Sanctions
A 2025 survey of court sanctions for AI-fabricated citations, documenting how repeatedly judges reject the “the AI made the mistake” defense — the accountability principle enforced in practice.
Topic · Legal & Liability
Updated OECD Definition of an AI System
The updated OECD definition of an AI system (2023) with its explanatory memorandum — the intergovernmental reference definition many regulators build on.
Topic · Governance, Risk & Compliance
Three Lines of Defense Against Risks from AI (Schuett)
Adapts the Institute of Internal Auditors’ Three Lines model — a framework for assigning and coordinating risk roles — to AI, arguing it closes coverage gaps and lets boards oversee management. The scholarly case for supplementing existing control functions rather than standing up a parallel one.
Topic · Governance, Risk & Compliance
The Language of Trustworthy AI: In-Depth Glossary (NIST)
NIST’s in-depth glossary of trustworthy-AI terms, aligned to the AI RMF — an authoritative vocabulary for the definitions an organization must agree on.
Topic · Governance, Risk & Compliance
Risk Tiering AI Use Cases: A Practical Guide (Google Cloud Office of the CISO)
Tiers AI use cases by autonomy, architectural agency, data and IAM boundaries, and blast radius, then attaches controls to each tier — automated guardrails and a stop control at the autonomous end, human approval plus anti-automation-bias measures in the middle. Insists the controls be technically enforced rather than documented.
Topic · Governance, Risk & Compliance
OpenAI — Hugging Face Model-Evaluation Security Incident
OpenAI’s disclosure of a security incident in a Hugging Face model-evaluation workflow — a concrete case of risk inside the AI evaluation pipeline itself, reinforcing why higher-trust tiers require stronger verification and tighter harnessing.
Topic · Governance, Risk & Compliance
OECD AI Principle: Accountability
The intergovernmental accountability standard: organizations and individuals developing, deploying, or operating AI are accountable for its proper functioning, by role and context — a near-verbatim statement of this chapter’s principle.
Topic · Governance, Risk & Compliance
OECD — Drawing the AI / Non-AI Boundary
OECD’s explainer on drawing the AI / non-AI line — the intergovernmental consensus definition and the “continuum, no red line” framing any boundary test must reckon with.
Topic · Governance, Risk & Compliance
NIST AI RMF: Agentic Profile (Cloud Security Alliance)
An industry profile extending the NIST AI RMF to autonomous agents that independently arrives at a Tier 1 (supervised) through Tier 4 (fully autonomous) classification — with oversight boundaries set per deployment, tool-use risk modeled by consequence scope and reversibility, and delegation registers naming the responsible human.
Topic · Governance, Risk & Compliance
Human-in-the-Loop Artificial Intelligence: A Systematic Review of Concepts, Methods, and Applications
An open-access systematic review that organizes human-in-the-loop systems into a unified taxonomy by loop placement, interaction granularity, and temporal characteristics — a scholarly map of the ground between a human gating every action and a human supervising an autonomous process.
Topic · Governance, Risk & Compliance
How Internal Audit Can Adapt to AI (EY)
Maps AI oversight onto the three lines — operational teams, then risk and compliance, then internal audit — and names who owns what, up through the chief audit executive and the board. Argues for trigger-based coverage tied to high-impact deployments rather than a static annual plan.
Topic · Governance, Risk & Compliance
Examining Human Reliance on Artificial Intelligence in Decision Making (Scientific Reports)
Peer-reviewed evidence that people do discriminate useful AI guidance from bad — but that a positive attitude toward AI measurably degrades that discrimination, and that AI-derived guidance biases judgement in a way equivalent human guidance does not.
Topic · Governance, Risk & Compliance
Detecting and Correcting Reference Hallucinations in Commercial LLMs and Deep Research Agents
Measures fabricated citations at scale — 3–13% of citation URLs hallucinated across ~221,000 URLs and ten models — and finds that deep research agents cite more sources than search-augmented models while hallucinating at a higher rate. The empirical weight behind checking a grounded system’s sources rather than trusting them.
Topic · Governance, Risk & Compliance
An Autonomy-Based Classification: AI Agents, Liability and Lessons from the Automated Vehicles Act
A five-level autonomy spectrum for AI agents — graded by generality of function, control allocation, and environmental access — in which liability shifts toward the provider as the user’s control diminishes. A policy-side counterpart to classifying deployments by the constraint around them.
Topic · Governance, Risk & Compliance
AI Board Governance Roadmap (Deloitte)
Directs boards to establish who in management owns AI, to assign oversight to a named body or committee, and to require risk reporting upward — the board-level counterpart to naming a single policy owner distinct from a governance council.
Topic · Governance, Risk & Compliance
A Decoupled Human-in-the-Loop System for Controlled Autonomy in Agentic Workflows
Proposes treating human oversight as an independent component of the agent operating environment rather than logic hard-coded into each workflow, with a four-dimension design framework covering when humans engage, who decides, and through what channel. An architecture for where the gate lives.
Topic · Governance, Risk & Compliance
European Commission Guidelines on the Definition of an AI System
The European Commission’s official guidelines (Feb 2025) on how to determine whether a software system is an “AI system” under the AI Act — the practical boundary test behind the Article 3 definition.
Topic · EU Regulation
EU Draft Guidelines on Classifying High-Risk AI Systems
The Commission’s draft guidelines on classifying high-risk AI systems — which categories of AI system draw heightened obligations, a comparative reference for defining the scope a policy governs.
Topic · EU Regulation
EU AI Act Article 3, Annotated (Future of Life Institute)
A readable, recital-linked annotation of EU AI Act Article 3 (68 defined terms including “AI system”), maintained by the Future of Life Institute — a convenient reader reference (unofficial machine translation).
Topic · EU Regulation
EU AI Act — Article 3: Definitions
The EU AI Act’s binding legal definition of an “AI system” (Article 3(1)), on the Commission’s official Act Service Desk — the authoritative anchor for what a policy governs and where the boundary sits.
Topic · EU Regulation
EU AI Act — Article 14: Human Oversight
The legal spine of a domain custodian’s veto. On the Commission’s official Act Service Desk, Article 14 requires that human oversight be assigned to natural persons with the necessary competence, training and “authority” — empowered to disregard, override or reverse an AI system’s output and to interrupt its operation.
Topic · EU Regulation
Colorado Artificial Intelligence Act (SB 24-205)
The first comprehensive US state AI law: a duty of reasonable care on developers and deployers of high-risk systems making consequential decisions. Effective June 30, 2026.
Topic · US Regulation
California Transparency in Frontier AI Act (SB 53)
California’s frontier-model transparency law — published safety frameworks, critical-incident reporting, transparency reports, and whistleblower protections for large frontier developers.
Topic · US Regulation
UK Government — Artificial Intelligence Playbook
The UK government’s practical playbook for safe, effective AI adoption across public-sector teams — a strong, concrete comparator for enterprise policy.
Topic · Public Sector
GovAI Coalition — AI Policy Templates & Resources
A reusable, NIST-aligned toolkit — policy template, governance handbook, incident-response plan, and vendor agreement — built by public-sector practitioners for direct adaptation.
Topic · Public Sector
GAO-25-107653 — Generative AI Use at Federal Agencies
A comparative GAO study of generative-AI use and management across 12 federal agencies — a rigorous inventory of how large institutions are actually governing AI.
Topic · Public Sector
CDT — AI in Local Government
The Center for Democracy & Technology’s comparative analysis of AI governance across roughly 20 counties and cities — strong orientation reading on the public-sector layer.
Topic · Public Sector
Moffatt v. Air Canada (2024)
A tribunal held the company liable for its chatbot’s inaccurate information — establishing that organizations own what their AI tells customers.
Topic · Legal & Liability
Mata v. Avianca (S.D.N.Y. 2023)
The landmark sanctions case where attorneys filed ChatGPT-fabricated citations — the canonical cautionary tale on unverified generative output in professional work.
Topic · Legal & Liability
HHS HTI-1 Final Rule — Algorithm Transparency (FAVES)
Introduces “Predictive Decision Support Interventions” and the FAVES criteria (Fair, Appropriate, Valid, Effective, Safe) — the key transparency rule for AI in healthcare.
Topic · Healthcare
Singapore Model AI Governance Framework for Generative AI
The most influential non-EU AI governance framework — a practical, principles-based model for governing generative AI, widely referenced by regulators and enterprises internationally.
Topic · Governance, Risk & Compliance
NIST Generative AI Profile (NIST AI 600-1)
NIST’s companion profile applying the AI RMF specifically to generative AI — the most current and directly applicable NIST guidance for GenAI deployments.
Topic · Governance, Risk & Compliance
NIST AI Risk Management Framework (AI RMF 1.0)
The foundational US framework for identifying, measuring, and managing AI risk across the system lifecycle — the reference most enterprise governance programs map back to.
Topic · Governance, Risk & Compliance
In re Knight Capital — SEC Enforcement Order (2013)
The $440M automated-trading failure — a deployment and rollback gone wrong. The SEC order is the primary account of how an untested change cascaded in minutes.
Topic · Financial Services
FS-ISAC — Acceptable Use Policy Framework for External GenAI
A financial-services-flavored template for an external generative-AI acceptable-use policy — a useful starting point for the Financial Services overlay.
Topic · Financial Services
FINRA Regulatory Notice 24-09 — Generative AI
FINRA’s technology-neutral position: existing supervision, communications, and books-and-records rules apply directly to AI use in financial services.
Topic · Financial Services
EU Artificial Intelligence Act (Regulation 2024/1689)
The world’s first comprehensive, risk-tiered AI regulation. High-risk obligations phase in through 2026–2027; the high-risk provisions are the priority read for enterprises.
Topic · EU Regulation
EEOC v. iTutorGroup (2023)
The EEOC’s first AI hiring-discrimination settlement — automated screening that rejected applicants by age. A marker for algorithmic-bias liability in employment.
Topic · Employment
Institutional Intelligence Brief
Receive updates on new chapters, critical policy shifts, and emerging AI governance frameworks directly in your inbox.
A double opt-in confirmation keeps the list clean; unsubscribe anytime.