- 03Which institution has the authority to act?
- Formally, the developer's own leadership and safety team hold the authority to release or delay. No external institution has a defined power to require evidence first in this setting. That absence is itself a finding.
- 04Does that institution have the capacity, independence, expertise, legitimacy, and accountability to act?
- Ask whether the safety team can actually stop the release, who overrules it, whether it has independent access to the model and enough time, and whether anyone outside the firm can hold the decision to account. A team with expertise but no escalation power exists formally and fails operationally.
- 08Who decided, on what authority, and who was not represented?
- The developer decides, on the authority of ownership and its own policies. Affected people, downstream deployers, and the countries where the model will be used were not represented in the decision, and the evidence base is not public.
Object of governance · 2 of 4
Institutions
Who has authority, capacity, and accountability?
Principles cannot determine who classifies a system as high risk, who receives an incident report, who can stop a deployment, or who hears an appeal. Institutions can. Legislatures, regulators, courts, company boards, technical safety teams, procurement authorities, standards bodies, and international organizations are all institutional sites of governance.
Read the object in depth
How institutions shape a decision
Give authority and responsibility somewhere to live
Changing incentives requires people and organizations capable of making decisions. Institutions give authority and responsibility somewhere to live: regulators, courts, company boards, procurement offices, professional bodies, and independent evaluators.
For our ministry, who approves the purchase? Who can inspect the evidence? Who investigates a complaint? Who can suspend use?
A mandate is not the same as the capacity to act
Naming an organization is only the beginning.
It needs expertise, resources, access to information, and enough independence to exercise its authority.
A regulator may have a strong mandate and too few staff. A company’s safety team may understand a problem and lack the power to delay release. A complaints office may receive objections without being able to secure a remedy.
Question to carry forward: And what makes them capable of exercising that responsibility?
Read “Institutions: who can act?” in the source article (Google Doc; may require access)
Further reading cited in the article
These links preserve the article's reading trail. Inclusion here does not imply an independent review or a new claim record in the source register.
Entities recorded for this object
InstitutionRegulator or public authorityWhat authority makes a governance demand legitimate and enforceable, and does the body have the staff and expertise to use it?Open record InstitutionInternal safety and governance teamCan the team actually stop or delay a deployment, and who overrules it?Open record InstitutionStandards bodyWho writes the standard, who was in the room, and what gives it force?Open record InstitutionInternational institutionWhich countries and communities are party to the arrangement, and which are absent?Open record
How the worked analyses answer this object's questions
- 03Which institution has the authority to act?
- The ministry, as licensing authority and deployer, holds the formal power. A medicines or devices regulator may also have jurisdiction. Whether either has the authority to require re-evaluation, audit access, or exit terms depends on the contract and the law.
- 04Does that institution have the capacity, independence, expertise, legitimacy, and accountability to act?
- Ask whether the ministry has staff who can read an evaluation, access to the system to test it, independence from the vendor's technical narrative, and a way for patients to hold it to account. Formal authority without evaluation capacity is authority the vendor effectively exercises.
- 08Who decided, on what authority, and who was not represented?
- The ministry decides, on a public mandate, but the evaluation population was chosen elsewhere, the terms were drafted by the vendor, and the patients and clinicians who will live with the system were not consulted. The international standards the vendor cites were written by bodies the country may not be party to.
- 03Which institution has the authority to act?
- Under a risk-based law, obligations are allocated between the provider and the deployer, and a public market surveillance authority can receive complaints. Inside the firm, someone must be named as owner of the system.
- 04Does that institution have the capacity, independence, expertise, legitimacy, and accountability to act?
- Ask whether the named owner can pause the tool, whether the recruiters overseeing it have the information and time to override it, and whether the authority has the staff and technical capacity to investigate a complaint about one employer among many.
- 08Who decided, on what authority, and who was not represented?
- The employer and vendor decided; applicants did not. The legal categories were set by a regional legislature, which gives the arrangement a public mandate that a purely voluntary framework would lack, while leaving the applicant's individual voice to the complaint route.
- 03Which institution has the authority to act?
- The head teacher can approve a pilot; the governing board approves spending above a threshold; the vendor controls the model and its updates; the education authority sets data-protection rules. No one at the school has authority over how the model is trained.
- 04Does that institution have the capacity, independence, expertise, legitimacy, and accountability to act?
- The school can watch how pupils use the tool, but it cannot test the model independently. Its only technical capacity is a part-time coordinator. Most of what it knows about accuracy and safety comes from the vendor, so its independence is limited.
- 08Who decided, on what authority, and who was not represented?
- Leadership and the vendor decide. Pupils, who will live with the result, cannot meaningfully consent and are not asked by default. Parents, the teachers who will supervise, and pupils with disabilities or who speak another language at home are absent unless the school invites them.
- 03Which institution has the authority to act?
- The organisation's director and board can launch or stop the assistant. The model provider controls the model, its updates and its terms. Public agencies own the rules the assistant describes but have no say over the assistant itself.
- 04Does that institution have the capacity, independence, expertise, legitimacy, and accountability to act?
- The organisation knows its residents and their languages better than anyone, which is real capacity. It lacks the means to evaluate the model at scale in every language, and it depends on the provider's documentation for what the model can do.
- 08Who decided, on what authority, and who was not represented?
- The organisation and funder decide. Residents who will use the assistant, including speakers of the least-served languages and young people who ask on behalf of their families, are not part of the decision unless the organisation brings them in.
- 03Which institution has the authority to act?
- The regulator can investigate and act within its online-safety powers. Data-protection and consumer authorities may also have jurisdiction. The company controls the model and its design, and is based abroad, which limits enforcement. Parents and schools can set rules on devices but cannot change the product.
- 04Does that institution have the capacity, independence, expertise, legitimacy, and accountability to act?
- The regulator may lack technical staff to test a chatbot's behaviour across many situations, and its evidence will come partly from the company. Acting against a foreign company takes time and cooperation with other regulators.
- 08Who decided, on what authority, and who was not represented?
- The company decided how the product behaves; teenagers, who use it most, had no voice in that, and children cannot consent in a meaningful way. The regulator should hear from young people, parents, schools, and child-development and mental-health experts, and from privacy advocates on the costs of age checks.
Live debates touching this object
Risk management or rights governance?
Should governance begin from managed uncertainty or from duties that cannot be traded away?
Risk-centered
Contextual risk processes help organizations prioritize, measure, and manage diverse impacts over time.
Rights-centered
Human dignity and rights set normative boundaries for what institutions and organizations may do.
Layered
Rights establish constraints and entitlements; risk methods support operational decisions within those boundaries.
Voluntary practice or binding rule?
When does guidance become an obligation, and what is lost if those forms are treated as interchangeable?
Practice-led
Voluntary frameworks can move faster, fit diverse organizations, and improve internal capability.
Law-led
Binding duties create minimum floors, public supervision, and consequences that internal practice alone cannot provide.
Govern now, or wait for evidence?
When should governance intervene, given that early action is poorly informed and late action is costly?
Act early: the window closes
Change is cheapest before adoption compounds; once arrangements are embedded, reversal is costly even when consequences are clear.
Wait: rules written in ignorance lock in
Early rules are written with the least information, and the categories they create acquire defenders of their own.
Anticipatory and adaptive: act early, specify review
Build foresight, engagement, and revision into governance so it can act while management is still possible and change when assumptions fail.
Who should set the rules for a borderless technology?
Should international AI governance be built through coalitions of leading AI nations, universal institutions, or binding regional law?
Plurilateral initiatives
Coalitions of capable states move faster and experiment with norms; the UN advisory body calls selectivity understandable at an early stage while warning it must not persist.
Universal, UN-anchored governance
A borderless technology needs governance with global reach, anchored in international law and inclusive of the countries currently absent.
Binding regional and treaty law
Enforceable rules with real authorities, whether a regional regulation or a treaty open to non-members, do governance work that declarations cannot.
Should AI companions be available to minors?
Should young people be able to use AI companion chatbots, and on what terms?
Access with design duties
Keep access but require design safeguards: disclosure that the user is talking to an AI, limits on simulated relationships, age-appropriate defaults and crisis protocols.
No mandatory identity checks
Requiring age verification exposes everyone’s identity data to breaches and ends anonymity, so it should not be the price of protecting children.
Restrict by age
Set minimum ages and require services to check them, especially where companions can produce harmful material.
Keep minors off companion platforms
The risks to young people outweigh the benefits, so no one under 18 should use AI companion platforms.
Augment or automate judgment?
When should AI assist a human decision, and when should the decision itself be handed over?
Keep a human in control
For high-risk uses, systems should be designed so that people can oversee them, stay alert to over-reliance, and override or reverse their outputs. (Article 14 cited at source level; passage check pending.)
Oversight must be shown to work
Requiring a human in the loop often fails because people cannot perform the oversight asked of them; agencies should instead justify adopting an algorithm and show evidence that oversight works.
Some decisions are better made by algorithms
In some settings, algorithms can outperform human judgment on the outcomes that matter, and a human override can reintroduce noise and bias.
Local-language AI: build our own or adopt global models?
Should communities and regions build their own language technology, or adopt and adapt models built by global developers?
Build with communities
Language technology should be built through participatory research with speakers and local institutions, because the gap is social as well as technical and global models still underperform on many local languages.
Adopt and adapt global models
Large multilingual models trained across hundreds of languages and released openly can reach many languages faster than separate efforts.
Pool regional capacity
Regions can build shared models together through public institutions, so that their languages and culture are represented without each country starting alone.