- 01What outcome is being shaped?
- The outcome at stake is not one release but a pattern: whether frontier capabilities enter the world with evidence about their dangerous capabilities and misuse potential, or whether release decisions are made under time pressure with evidence gathered afterwards. The benefit side is real too: earlier access to capability for users and researchers.
- 05What infrastructure does the mechanism depend on or reshape, and who controls it?
- The release depends on concentrated compute and serving infrastructure controlled by the developer and its cloud partners. That concentration is what makes the decision governable at all: compute is detectable and quantifiable, so reporting thresholds are possible. The same fact means only a handful of actors can be in this position.
- 08Who decided, on what authority, and who was not represented?
- The developer decides, on the authority of ownership and its own policies. Affected people, downstream deployers, and the countries where the model will be used were not represented in the decision, and the evidence base is not public.
- 09Who bears the costs and risks, and who captures the benefits?
- The developer captures the returns and the reputational lead. The risks fall on users and third parties, on other developers pressured to match the pace, and on communities with the least ability to contest misuse. Compliance costs, if any, fall on the developer and are more affordable for it than for smaller entrants.
Cross-cutting test · 3 of 4
Distribution
Who captures the benefits, who bears the costs and risks, and who is excluded?
Aggregate benefit hides its distribution. Follow access, ownership, returns, labor, compliance costs, exposure to error, and the ability to contest.
Who is easy to miss? Include people who use or are affected by a system without having chosen it and cannot easily contest it, such as children. Ask who carries the risk of error or surveillance without a say.
Entities this test bears on
ActorAI developer or providerWho can change the system, document it, withhold it from release, or set the terms others must accept?ActorDeploying organizationWhat can the deployer demand, audit, refuse, or contest, and does it have the capacity to do so?ActorAffected peopleWhose experience and interests count in the governance process, and were they represented when it was designed?IncentiveDeployment pressureWhat rewards speed, delay, disclosure, or silence?IncentiveLiability exposureWho bears defined consequences when the system fails, and does that prospect reach the decisions that matter?IncentiveProcurement leverageWhat can the buyer demand before the contract is signed, and what leverage disappears once the system is embedded?InstitutionInternational institutionWhich countries and communities are party to the arrangement, and which are absent?InfrastructureEvaluation capacityWho has the practical means to verify what a system can do and whom it affects?InfrastructureComputeWho controls the compute, what does control make visible, and whom does it exclude?InfrastructureData, language resources, and data laborWhose data, whose languages, whose labor, and who is data-poor as a result?InfrastructureEnergy, water, and mineralsWhere do the electricity and water come from, who pays, and who decides where capacity is built?SafeguardImpact assessmentWhat could change, for whom, and what evidence would justify proceeding?SafeguardComplaint and appeal routesWho can receive the complaint, examine it, and exercise authority over the outcome?SafeguardCompute controlsWhat does the control make visible or prevent, and whom does it consolidate power among?PrincipleAccountabilityWho must answer to whom, for what, through which process, with what consequence?PrincipleSafetySafe from what, for whom, and on what evidence, before the principle becomes a safeguard?PrincipleBroadly shared benefitWho receives access, who owns, who captures returns, who supplies labor, who bears costs, and who can contest?PatternContestable decisionCan an affected person question the result and obtain review or remedy?PatternConcentration of powerIs control over the inputs and the rules becoming concentrated, and does the proposal reduce that or deepen it?PatternSystematically unreliable provenanceIs the problem a piece of content, or an environment in which no one can tell?PatternOver-reliance and deskillingWhen people work with AI, who still checks the output, and could they still do the task without it?PatternSycophancy and engagement-driven agreementIs the system rewarded for being right, or for being liked?PatternHomogenisation and loss of authorshipWhen AI helps people create, whose ideas and voice end up in the result, and does variety survive?InfrastructureData work and content moderationWho does the work that makes AI systems work, on what terms, and who can see it?
How the worked analyses answer the questions this test probes
- 01What outcome is being shaped?
- The outcome is a pattern of triage decisions across the whole system: which patients are prioritized, whose conditions are systematically under-recognized, and whether the ministry becomes dependent on a vendor it cannot audit. The benefit sought is real: more patients seen with scarce clinical capacity.
- 05What infrastructure does the mechanism depend on or reshape, and who controls it?
- The system depends on the vendor's cloud, on patient data flowing to it, and on models trained on other populations. Who controls that data afterwards, whether the local population and languages are represented, and whether the country can switch vendors are infrastructure questions that determine the ministry's bargaining power.
- 08Who decided, on what authority, and who was not represented?
- The ministry decides, on a public mandate, but the evaluation population was chosen elsewhere, the terms were drafted by the vendor, and the patients and clinicians who will live with the system were not consulted. The international standards the vendor cites were written by bodies the country may not be party to.
- 09Who bears the costs and risks, and who captures the benefits?
- Patients bear the risk of systematic error, particularly groups under-represented in the training data. The vendor captures the revenue and the data. The ministry bears compliance and dependence costs. Clinicians bear the burden of overriding a system they were told performs well.
- 01What outcome is being shaped?
- The outcome is a hiring pattern across thousands of applications, not a single decision: which candidates are systematically filtered out, whether errors can be noticed, and whether rejected applicants can contest a decision. A single wrong rejection is an incident; a repeated skew is the governance problem.
- 05What infrastructure does the mechanism depend on or reshape, and who controls it?
- The employer depends on the vendor's model and logs. If the employer cannot access records in a usable form, it cannot answer an applicant or an authority. Data about past hires, and its biases, is the infrastructure the system was built on.
- 08Who decided, on what authority, and who was not represented?
- The employer and vendor decided; applicants did not. The legal categories were set by a regional legislature, which gives the arrangement a public mandate that a purely voluntary framework would lack, while leaving the applicant's individual voice to the complaint route.
- 09Who bears the costs and risks, and who captures the benefits?
- Applicants bear the risk of systematic exclusion and the burden of proving an error. The employer captures the efficiency gain and bears compliance cost. Applicants who cannot navigate a complaint process bear the most and capture the least.
- 01What outcome is being shaped?
- The outcome at stake is a pattern, not one pupil's homework: whether pupils learn more, or learn to hand the thinking over. A tool that answers well can still reduce the effort that builds skill. The benefit is real too: help for pupils whose families cannot pay for tutoring.
- 05What infrastructure does the mechanism depend on or reshape, and who controls it?
- The tool depends on pupils' devices and home internet, the vendor's cloud service, and the data pupils type into it. The vendor controls all but the devices. Pupils without reliable access at home get less of the benefit.
- 08Who decided, on what authority, and who was not represented?
- Leadership and the vendor decide. Pupils, who will live with the result, cannot meaningfully consent and are not asked by default. Parents, the teachers who will supervise, and pupils with disabilities or who speak another language at home are absent unless the school invites them.
- 09Who bears the costs and risks, and who captures the benefits?
- Teachers absorb extra supervision, pupils supply their data, and pupils least able to spot a wrong answer carry most of the risk of one. The vendor gains a reference customer and usage data. Pupils with home access gain the most help.
- 01What outcome is being shaped?
- The outcome is whether residents who struggle most to reach public services get accurate help, or whether a fluent but unreliable channel replaces the staff they used to talk to. A pattern of confident wrong answers about eligibility or deadlines would fall hardest on people with the fewest alternatives.
- 05What infrastructure does the mechanism depend on or reshape, and who controls it?
- The assistant depends on the provider's model and cloud, residents' phones and data plans, and the quality of text in each language that the model learned from. Languages with little online text are likely to be served worse. The provider controls most of this.
- 08Who decided, on what authority, and who was not represented?
- The organisation and funder decide. Residents who will use the assistant, including speakers of the least-served languages and young people who ask on behalf of their families, are not part of the decision unless the organisation brings them in.
- 09Who bears the costs and risks, and who captures the benefits?
- Residents in well-served languages gain the most; residents in poorly served languages, with low literacy or without data plans carry more risk of wrong answers and less benefit. Children answering for parents may carry adult decisions. The provider gains usage; the funder gains a visible launch.
- 01What outcome is being shaped?
- The outcome is a pattern across many young users: whether companionship products support teenagers or shape their time, emotions and trust in ways that serve engagement. The regulator's aim is to reduce that harmful pattern without cutting off benefits some young people report.
- 05What infrastructure does the mechanism depend on or reshape, and who controls it?
- The product runs on the company's models and cloud and reaches teenagers through app stores and phones. App stores and device makers control age ratings and parental controls, which makes them possible points of intervention.
- 08Who decided, on what authority, and who was not represented?
- The company decided how the product behaves; teenagers, who use it most, had no voice in that, and children cannot consent in a meaningful way. The regulator should hear from young people, parents, schools, and child-development and mental-health experts, and from privacy advocates on the costs of age checks.
- 09Who bears the costs and risks, and who captures the benefits?
- Risks may fall most on teenagers who are isolated or in distress, if they rely on the product most. Costs of a response fall on the company, and age checks may burden all users with data collection. Benefits of the product accrue to the company and to some users who find it helpful.
Live debates that turn on this test
Risk management or rights governance?
Should governance begin from managed uncertainty or from duties that cannot be traded away?
Risk-centered
Contextual risk processes help organizations prioritize, measure, and manage diverse impacts over time.
Rights-centered
Human dignity and rights set normative boundaries for what institutions and organizations may do.
Layered
Rights establish constraints and entitlements; risk methods support operational decisions within those boundaries.
Compute controls: safety lever or power consolidator?
Should governments govern AI through control of advanced compute, given that the same lever concentrates power?
Effective intervention point
Compute is detectable, excludable, and quantifiable, so it offers regulatory visibility and enforcement unavailable elsewhere, provided guardrails limit the risks.
Concentration and dependence risk
Compute controls can centralize power, entrench incumbents, and deepen dependence for countries and communities already excluded from the inputs.
Floor before ceiling
Before restricting access at the top, put a floor under the AI divide through shared compute, data, and capacity, since universal frontier access is unrealistic.
Who should set the rules for a borderless technology?
Should international AI governance be built through coalitions of leading AI nations, universal institutions, or binding regional law?
Plurilateral initiatives
Coalitions of capable states move faster and experiment with norms; the UN advisory body calls selectivity understandable at an early stage while warning it must not persist.
Universal, UN-anchored governance
A borderless technology needs governance with global reach, anchored in international law and inclusive of the countries currently absent.
Binding regional and treaty law
Enforceable rules with real authorities, whether a regional regulation or a treaty open to non-members, do governance work that declarations cannot.
Should AI companions be available to minors?
Should young people be able to use AI companion chatbots, and on what terms?
Access with design duties
Keep access but require design safeguards: disclosure that the user is talking to an AI, limits on simulated relationships, age-appropriate defaults and crisis protocols.
No mandatory identity checks
Requiring age verification exposes everyone’s identity data to breaches and ends anonymity, so it should not be the price of protecting children.
Restrict by age
Set minimum ages and require services to check them, especially where companions can produce harmful material.
Keep minors off companion platforms
The risks to young people outweigh the benefits, so no one under 18 should use AI companion platforms.
Augment or automate judgment?
When should AI assist a human decision, and when should the decision itself be handed over?
Keep a human in control
For high-risk uses, systems should be designed so that people can oversee them, stay alert to over-reliance, and override or reverse their outputs. (Article 14 cited at source level; passage check pending.)
Oversight must be shown to work
Requiring a human in the loop often fails because people cannot perform the oversight asked of them; agencies should instead justify adopting an algorithm and show evidence that oversight works.
Some decisions are better made by algorithms
In some settings, algorithms can outperform human judgment on the outcomes that matter, and a human override can reintroduce noise and bias.
Local-language AI: build our own or adopt global models?
Should communities and regions build their own language technology, or adopt and adapt models built by global developers?
Build with communities
Language technology should be built through participatory research with speakers and local institutions, because the gap is social as well as technical and global models still underperform on many local languages.
Adopt and adapt global models
Large multilingual models trained across hundreds of languages and released openly can reach many languages faster than separate efforts.
Pool regional capacity
Regions can build shared models together through public institutions, so that their languages and culture are represented without each country starting alone.