AI governance: from hype to real policy

AI · 2026-07-18 · 11 min read

By Arjun Mehta, Engineering & product

Governments have moved past principles documents. What arrives next is dated obligations, and most teams are not ready for the paperwork.

For several years AI governance meant a page of principles: fairness, transparency, human oversight. Nobody had to prove anything. That period has ended, and what replaces it is far less philosophical — registration deadlines, documentation requirements and named accountable people.

The change is easiest to feel in the calendar. The EU AI Act, the template most other jurisdictions are copying, phases in obligations on fixed dates rather than aspirations: prohibited uses first, then transparency duties, then the heavier requirements for high-risk systems. A deadline concentrates the mind in a way a value statement never did.

Most emerging frameworks converge on the same idea: classify by use, not by model. A recommendation engine sorting films and the same architecture sorting job applicants attract completely different obligations, because the risk lives in the decision, not the maths.

A worked example makes it concrete. The same open-source model can power a spam filter and a tool that screens loan applications. The first is low-stakes and lightly regulated; the second touches credit, so it inherits documentation, human-review and record-keeping duties. Nothing about the weights changed — only where the output lands.

The practical burden lands on documentation. Where did the training or fine-tuning data come from, what evaluations were run before release, who signed off, and what happens when the system misfires. Teams that never wrote this down are discovering it is far harder to reconstruct a year later.

"Named accountable person" is the phrase that catches companies off guard. Regulators increasingly want a specific human who owns each deployed system — not a committee, not a vendor. If you cannot say who that is for the model touching your customers today, that gap is itself the finding.

None of this is expensive if you start early. Keep a one-page inventory of every place a model touches a decision about a person, note the fallback when it is wrong, and record each evaluation as you run it rather than the week before an audit.

In practice that inventory is four columns: the system, what decision it influences, the accountable owner, and the manual process you fall back to when it fails. A ten-line spreadsheet started today beats a forensic reconstruction in twelve months, and it doubles as an onboarding document for the next engineer.

The teams that will struggle are the ones treating governance as a legal problem. It is an engineering problem with a legal deadline, and the artefacts it demands — provenance, evaluations, incident logs — are the same ones that make a system debuggable.

That reframing is the whole point. Every hour spent writing down where the data came from and how the model was tested is repaid the first time something breaks in production and you can answer, in minutes rather than weeks, exactly what the system was doing and why.

Tags: ai, policy, regulation

Arjun Mehta — Arjun writes about web performance, developer tooling and applied AI for ESPYCRUX. He has spent the last decade building and maintaining production web apps, and most of his articles start from something that broke in one of them.