AI Governance Framework

The Basic Structure

An AI governance framework is not a single document. It is a stack of decisions: who has authority, over what, enforced how. At the national level, frameworks tend to address three distinct questions. Who can develop frontier models, addressed through export controls, compute limits, and licensing requirements. Under what conditions those models can be deployed, addressed through safety standards, audit requirements, and incident reporting obligations. And who has authority when something goes wrong, addressed through liability allocation, enforcement jurisdiction, and appeals mechanisms.

These three questions can be answered by the same body or split across several agencies. In the US, the Commerce Department handles export controls, NIST runs voluntary safety standards, and CISA manages critical infrastructure risk. Each of those is a distinct answer to a distinct governance question. They do not always align.

The Two Dominant National Approaches

The US approach through 2026 has been executive-order-led and agency-executed. It is fast to implement and easy to adjust, but it lacks legislative durability and produces compliance uncertainty for operators who cannot predict whether a new administration will reverse the standing rules.

The EU’s AI Act took a different approach: risk-tiered regulation applied to deployers and providers, with hard prohibitions on certain use cases and conformity assessments required before high-risk systems can go to market. The Act creates more compliance certainty because it is legislative, but it is slower to adapt when capabilities shift faster than the risk categories it defined.

These two frameworks are not compatible in their underlying architecture. A company operating in both jurisdictions faces genuinely conflicting requirements: the US framework is primarily export-control and voluntary-standard oriented, while the EU framework is deployer-liability and conformity-assessment oriented. The operator who treats “regulatory compliance” as a single box has not understood the geography.

Why the International Layer Matters

Individual national frameworks create compliance obligations for operators inside those jurisdictions. They do not coordinate with each other, which means the friction is real and compounding.

Export controls on the same chips or models may differ between countries. A chip the US allows to ship to one country may be prohibited from re-export to a third. A model freely available in the US may require a conformity assessment in the EU, be restricted outright in a third market, and fall into an unaddressed gap in a fourth.

Data residency requirements may conflict. A model trained on data from one jurisdiction may not be able to serve users in another. A company that consolidates training compute for efficiency may inadvertently violate localization rules in markets it serves.

Liability rules may point in different directions. A US operator whose AI-assisted output causes harm faces one set of rules. The same operator serving EU users with the same output faces another. The product did not change. The compliance surface did.

International governance frameworks, when they function, reduce this friction by establishing mutual recognition of safety certifications, harmonized incident reporting standards, and shared baseline definitions. The UN Global Dialogue on AI Governance, which opened in Geneva in July 2026 with all 193 member states, is the most ambitious attempt yet to create that layer.

The Three-Level Stack

In practice, AI governance operates at three levels simultaneously.

Domestic regulation is what individual governments do inside their own borders: the AI Act, US executive orders, China’s generative AI interim measures, India’s advisory frameworks. These create the compliance floor for any operator deploying at scale in multiple markets.

Bilateral and multilateral agreements cover things individual governments cannot handle alone: export controls on advanced chips, data localization requirements that affect cross-border model serving, and mutual recognition of safety certifications. The US-UK AI Safety Institute memorandum is an example. These reduce compliance friction between aligned jurisdictions without creating a universal standard.

International frameworks are what Geneva is attempting: standards, norms, and coordination mechanisms that apply across all jurisdictions. The challenge is enforcement. An international framework without binding authority is a statement of intent. Most operators will not feel its effects directly until domestic regulators implement it in their own jurisdictions.

The Capability Compression Problem

One reason governance frameworks struggle to keep pace is capability-compression: the pattern in which frontier model capabilities reach mid-tier pricing faster than regulatory processes can assess them. When a governance framework is written around the capabilities available at the time of drafting, and those capabilities double in effective reach within twelve months at half the cost, the framework is already behind before implementation begins.

This is not an argument against governance. It is an argument for frameworks built around capability classes and risk categories rather than specific products or model generations. The EU AI Act’s risk-tiered approach is an attempt at this. Whether it survives the current pace of inference-tiering is the question the next two years will answer.

What the Operator Faces

For an operator running AI in production, the governance framework question is not abstract. Every decision about which model to run, in which region, serving which users, is already a governance decision. The compliance questions embedded in that choice include export control classification, data residency requirements, liability rules, and incident reporting obligations.

The compliance surface for a global deployment is genuinely complex in the current patchwork. A model freely available in one market may require a conformity assessment in another, be restricted outright in a third, and fall into an unaddressed gap in a fourth. International soft-law standards, if Geneva produces them, will eventually reduce that complexity. Until then, operators working across jurisdictions need country-specific compliance counsel, not just the model vendor’s terms of service.

How TWO Uses It

The Wise Operator tracks governance frameworks because they directly determine what operators can build, where, and at what compliance cost. A new export control can remove a model from your available stack overnight. A new liability rule changes who bears responsibility for an AI-assisted workflow’s output. A new conformity assessment requirement adds months to a deployment timeline.

The practical posture: know which framework applies to your current deployment, monitor the one or two frameworks most likely to change your compliance surface in the next twelve months, and do not assume that a product your vendor describes as “compliant” is compliant in every jurisdiction where you operate. The vendor’s terms cover the vendor’s obligations. Your deployment obligations are yours.