When a company releases a generative AI system, who checks whether it protects personal data, treats people fairly, and can be held accountable for harm? AI-specific governance addresses those questions through company practices, public rules, and oversight of how AI systems are developed and used. Its aim is to manage risks without assuming that every future effect of AI can be predicted. section 10.0 section 10.33
Governance can take several forms:
- Companies can set voluntary standards for safety, fairness, privacy, transparency, and human oversight. These commitments may help establish practices, but a company’s commercial interests can conflict with protecting users—particularly without transparency or accountability. section 10.32 section 10.33
- Governments can set requirements. The European Union’s AI Act uses a risk-based approach; the United States has published an AI Action Plan rather than a comparable large-scale law; and China has adopted interim measures for generative AI services. section 10.35
- Independent oversight is another proposed safeguard. Calls for a permanent, well-resourced institution reflect concern that company commitments and existing rules may not, by themselves, ensure public benefit. section 10.35 section 10.32
Data privacy as a governance question
Personal data used in machine learning is subject to growing regulatory scrutiny. The European Union’s General Data Protection Regulation provides a framework for data governance, while its AI Act adds requirements for generative model developers, including data-source documentation and risk assessments. Protecting privacy is therefore not only a technical task: users, developers, and institutions share responsibility. section 10.18
Governance remains a work in progress. Many efforts have relied on voluntary principles, and developers can fall short of their stated goals. The practical question is whether commitments, enforceable rules, and oversight provide enough accountability as AI systems spread. section 10.33 section 10.35
