November 13, 2026
By Burak Oktenli
Key Takeaways:
AI governance is dividing between upstream rules on powerful models (EU and California compute thresholds) and downstream rules on consequential automated decisions (as in Colorado), yet duties do not automatically transfer between them.
Accountability must be shared across the chain—model providers, integrators and deploying institutions—rather than resting solely on ownership of the algorithm or a single jurisdiction’s rules.
A short consequential-use statement identifying the decision, responsible parties, limits and redress mechanisms is proposed to make the handoff inspectable without imposing a single global AI law.
From Brussels and California to Seoul, Singapore and New Delhi, AI governance is splitting between the risks of powerful models and the consequences of the decisions made with them. Both matter, but responsibility must survive the handoff.
On October 26, Colorado held a public hearing on proposed rules for automated decision-making technologies used in consequential decisions. The state is preparing to implement a revised law that takes effect on January 1, 2027. Its focus is not how many calculations went into training an AI model. It is what happens when a system materially influences a decision about a person, and what developers and users must do about it.
That hearing captures a distinction emerging across the world. Regulators are writing two kinds of AI rulebook. One asks what a powerful model might enable, even before anyone knows its eventual use. The other asks what an organization is allowed to do with AI in a particular setting. Both questions are legitimate. The international problem is that the duties attached to one do not automatically travel with the system into the other.
Compute is a warning light, not a verdict
The European Union’s AI Act presumes that general-purpose models trained with more than 10^25 floating-point operations may pose systemic risks; the European Commission can also designate other models on the basis of equivalent capabilities or impact. California’s Transparency in Frontier Artificial Intelligence Act defines a frontier model in part by a threshold above 10^26 computational operations and requires specified disclosures and risk-management practices from covered developers. These measures address risks that can arise upstream, including catastrophic misuse, cyber threats and the security of powerful model weights.
These are not laws based simply on the electricity used in training. Computational operations are not a measure of electricity consumption, and the thresholds are not the entire regulatory design. The EU also classifies many high-risk systems according to their intended uses, and its rules assign obligations to organizations that deploy them. California’s frontier law is deliberately aimed at a narrower category of large-scale model risk. Treating either regime as though it only counts chips would misstate what legislators have built.
Yet compute is an imperfect proxy for the danger of any individual deployment. A small model can materially shape eligibility for a public benefit; a much larger one can be used to summarize an ordinary document. The number of training operations cannot tell a citizen whether a credit denial was justified or who must correct it. Conversely, regulating only what a model is permitted to execute would miss harmful assistance that requires no payment credential or robotic arm, such as help with dangerous biological or cyber capabilities. The upstream screen and the downstream decision rule address different hazards.
A global market, several points of responsibility
In January, South Korea’s AI Basic Act came into force, combining industrial development with provisions on high-impact AI and safety. In May, Singapore updated its voluntary Model AI Governance Framework for Agentic AI, adding practical cases and guidance on third-party agents, multi-agent systems and automation bias. India’s AI Governance Guidelines place innovation and sector-specific risk management within a principles-based approach. These are different instruments: a binding statute, voluntary technical guidance and government policy guidance should not be described as interchangeable law.
Their convergence is more revealing than their differences. The consequential point is the moment a general model becomes part of a particular institution’s decision. A supplier can train the model in one jurisdiction, an integrator can connect it to databases and business rules in another, and a hospital, employer or financial institution can use its output in a third. A regulator inspecting only the original model may see none of the local data, incentives or permissions that determine the actual consequence.
That does not absolve the developer. The provider knows about the training process, general capabilities, foreseeable misuse, limitations and security defects that downstream customers may be unable to discover. Nor does a deployer become solely responsible for a defect that originates in a model it cannot inspect. Accountability has to be allocated across the chain, not pushed from one end to the other.
This is why the familiar question, “who owns the algorithm?”, is often less useful than “who made this decision possible, and who can put it right?” Ownership of weights is not the same as control over a hiring rule, an eligibility threshold, a connected account or an operator’s authority to accept an automated recommendation.
Make the handoff inspectable
For consequential uses, governments should require a short consequential-use statement tied to the deployment, not a new licence for every chatbot. It should identify the decision or activity the system may materially influence; the institution legally responsible for using it; the roles of the model supplier and any integrator; the relevant limits and evidence; and the available process for review, correction and redress. Sector regulators would apply the underlying law. The statement would make responsibility visible rather than replace consumer protection, employment law, financial regulation or safety rules.
The three parties owe different evidence. A model provider should disclose material capability limitations, known failure conditions, security responsibilities and significant changes relevant to the intended use. An integrator should document what data, software tools and decision rules were connected and which safeguards it actually implemented. The deploying institution should explain why that configuration was appropriate for its task, who could challenge its output and how affected people can contest a consequential outcome.
Parts of this approach already exist. The EU AI Act’s deployer obligations include competent human oversight, monitoring and recordkeeping for high-risk systems under the applicable provisions. Colorado’s revised statute likewise assigns duties to developers and deployers of automated decision-making technology and gives consumers a way to request correction of inaccurate personal data. The proposal is not to pretend the world has no rules. It is to make the handoff legible where different national and sectoral rules meet.
Such an instrument would need proportionality. A casual writing assistant should not face the same burden as a system materially shaping access to housing, employment, finance or essential services. Confidential technical details can be supplied to competent regulators without being published to everyone. Nor can a form replace practical enforcement: a person must have an accessible place to complain, and somebody must have the legal power to investigate and order a remedy.
Convergence without a single global AI law
The geopolitical temptation is to turn this into a contest between Brussels-style restrictions and innovation-first alternatives. That is too crude. Countries can disagree about thresholds, institutional design and acceptable risk while still recognizing the same basic chain of responsibility. The EU has reasons to examine systemic model capability. California has reasons to demand transparency from its largest frontier developers. Singapore and India have reasons to pursue practical adoption and sectoral assurance. A jurisdiction affected by an AI-assisted decision has reasons to demand that its own laws remain effective after the underlying model crosses a border.
No new global authority needs to decide whether all these regimes are identical. A more realistic area for coordination is the minimum information that must pass from provider to integrator to deployer when a consequential system is put into service. That can make compliance less ambiguous for suppliers and remedies more reachable for affected people. It can also prevent local regulators from being presented with a polished model-safety report that says little about the actual decision made in their jurisdiction.
The original instinct behind compute thresholds was not mistaken: some risks warrant scrutiny before powerful models are widely distributed. But capability assessment does not settle the accountability of deployment, and deployment controls cannot replace upstream safeguards against dangerous general capabilities. A mature AI rulebook needs both.
The model’s size can tell a regulator where to look first. It cannot tell a person who must answer for the decision.
About Burak Oktenli
Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me.
View all posts by Burak Oktenli →
No comments:
Post a Comment