AI Governance Institute logo
AI Governance Institute

Intelligence for Compliance and GRC Teams

← News
Research2026-05-26

AI Governance Problems, Policy Options, and Research Gaps Mapped in LawAI Literature Review

What happened

LawAI published the Advanced AI Governance: A Literature Review of Problems, Options and Research Challenges in January 2025, providing a structured survey of academic and policy literature on frontier AI governance mechanisms. The review covers regulatory instruments including compute security measures, software and hardware export controls, licensing regimes for advanced AI systems, structured system evaluations, and procurement rules designed to advance AI safety objectives. It also examines voluntary corporate governance proposals such as Responsible Scaling Policies adopted by several leading AI developers, and formal AI certification schemes being explored by standards bodies and regulators. The document does not make binding recommendations but synthesizes existing research to identify where evidence is strong, where significant gaps remain, and which governance questions require further empirical or legal investigation. The review is intended to serve policymakers and governance practitioners across international frameworks, with particular relevance to active policy discussions in the United States, the United Kingdom, and the European Union.

Why it matters

  • ·The review signals that licensing and pre-market certification regimes for frontier AI models are under active consideration across multiple jurisdictions, creating potential new regulatory exposure for developers who have not yet mapped their compliance posture against emerging approval obligations.
  • ·The document's detailed treatment of system evaluations connects directly to existing mandates such as the EU AI Act's conformity assessment requirements and NIST's AI Risk Management Framework, meaning organizations already subject to these frameworks may face heightened scrutiny of their evaluation and audit practices.
  • ·The inclusion of compute governance and export controls as core governance topics underscores that trade compliance functions are now organizationally implicated in AI risk management, expanding the internal stakeholder set that must coordinate on AI governance strategy.

Governance controls affected

CHM-002Pre-Production Approval GateCMP-002International AI Standards Monitoring WorkflowCMP-005Regulatory Engagement Process for AI Standards DevelopmentHOC-001AI Risk ClassificationMON-005Model Card and Documentation MaintenancePRC-001Third-Party AI Risk AssessmentSAF-005Red-Teaming and Adversarial Testing

What to do now

  • ☐Review internal AI risk classification processes against the licensing and certification frameworks surveyed in the literature review to identify gaps ahead of potential pre-market approval obligations.
  • ☐Assign trade compliance teams to assess the organization's exposure to current and anticipated compute-related export controls, particularly those tightened by the United States and mirrored by allied governments.
  • ☐Evaluate existing system evaluation and conformity assessment procedures against the structured evaluation standards discussed in the review and referenced in the EU AI Act and NIST AI RMF.
  • ☐Brief procurement and legal counsel on the review's findings regarding AI procurement rules so that vendor contracts can be updated to reflect emerging government expectations around safety and transparency.
  • ☐Identify open research and regulatory questions highlighted in the review that are relevant to the organization's AI portfolio and determine where engagement with regulators or standards bodies would be productive.

What to watch next

Compliance teams should monitor legislative and regulatory developments in the United States, the United Kingdom, and the European Union related to compute export controls, as restrictions have been tightening rapidly and further allied government coordination is expected. Progress on formal AI certification schemes at standards bodies such as ISO and national equivalents warrants close attention, given that the review identifies certification as an area of active policy development that could result in binding pre-market obligations. Teams should also track any follow-on publications from LawAI and similar academic-policy institutions, as subsequent work addressing the open research gaps identified in this review may inform upcoming regulatory guidance cycles.

AI Governance Weekly

Weekly intelligence on AI regulation, enforcement, and governance. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-07-14

Gated AI Governance at Scale: A Case Study in Executive Oversight, RACI Accountability, and Build-vs-Buy Decision Frameworks

THIS IS ORG has published a case study documenting how one enterprise moved AI governance from ad hoc experimentation to a structured, scalable operating model. The organization established an AI Transformation Council for executive oversight, introduced a gated process to move use cases from concept to funded deployment, and applied a proprietary Risk Assessment Framework covering security, ethics, and business value. The case study presents a replicable model including a RACI accountability structure and defined Build vs Buy decision pathways.

Insight2026-06-27

Introducing Model Radar: Weekly Compliance Status for Frontier AI Models

AI Governance Institute launches Model Radar, a weekly-updated compliance tracker covering 10 frontier AI models across three status tiers. The tool is designed for enterprise procurement and governance teams assessing which models are safe to procure and deploy in regulated environments.

Insight2026-06-16

Anthropic's Fable 5 Defense Statement Reveals the Gap Between Vendor Safety Architecture and Government Risk Tolerance

Anthropic published a formal rebuttal to the June 12 U.S. export control directive suspending Fable 5 and Mythos 5, disclosing for the first time the specific jailbreak at issue (asking the model to read a codebase and fix software flaws) and the details of its defense-in-depth safety methodology. The statement is the clearest public account yet of how Anthropic characterizes its own safety assurances, and it reveals a meaningful gap between what vendors can promise and what government risk tolerance now requires.