AI Governance Is Moving from Principles to Implementation

For several years, the global AI governance debate was dominated by principles.

Governments published frameworks.

International organisations developed recommendations.

Companies released responsible AI commitments.

Researchers debated fairness, transparency, safety and accountability.

The language became increasingly sophisticated.

But an important problem remained.

How do you know whether an AI system actually follows those principles?

A company can say that its model is safe.

A government can publish an AI strategy.

An institution can announce responsible AI principles.

But none of these automatically demonstrates that an AI system is safe, fair, transparent or accountable in practice.

This is the implementation problem.

And by 2026, it is becoming one of the central questions in global AI governance.

From Principles to Evidence

The evolution of AI governance can be understood as a sequence.

First came principles.

Then came governance frameworks.

Then came legislation.

Now comes implementation.

Implementation requires evidence.

Evidence requires measurement.

Measurement requires standards and evaluation methods.

Evaluation requires technical expertise.

And enforcement requires institutions capable of interpreting and acting on the evidence.

This creates a governance chain:

Principles → Rules → Standards → Evaluation → Documentation → Monitoring → Enforcement.

If one part of the chain is missing, governance can become weaker in practice.

A sophisticated law without technical evaluation capacity may be difficult to enforce.

A strong technical standard without institutional authority may have limited effect.

An audit without reliable evidence may become a procedural exercise.

A regulatory authority without technical expertise may struggle to assess advanced models.

The next phase of AI governance is therefore increasingly institutional and technical.

The EU AI Act: From Law to Enforcement

The European Union provides one of the clearest examples of this transition.

The AI Act was adopted as a comprehensive legal framework, but the existence of the law did not complete the governance process.

Implementation requires institutions, technical standards, conformity assessment, documentation, market surveillance and enforcement.

As of 2 August 2026, major parts of the AI Act entered an important enforcement phase.

The European Commission’s AI Office and national competent authorities became responsible for implementing, supervising and enforcing relevant provisions. The AI Office has specific responsibilities concerning general-purpose AI models, including models that may pose systemic risks.

This represents an important transition.

AI governance is no longer only a policy document.

There are now authorities with investigative powers.

There are obligations that organisations must meet.

There are mechanisms for complaints and enforcement.

There are technical questions about how compliance should be demonstrated.

And there are still future implementation milestones, particularly for high-risk AI systems.

The AI Act therefore illustrates an important principle:

Passing an AI law is the beginning of implementation, not the end.

The Institutional Layer

The EU framework also demonstrates why governance institutions matter.

The European AI Office is supported by the European AI Board, Scientific Panel and Advisory Forum.

At national level, Member States have competent authorities responsible for supervision and enforcement.

Notified bodies may perform conformity assessments for relevant systems.

This institutional architecture is essential because AI governance involves different kinds of expertise.

A regulator may understand administrative law.

A technical evaluator may understand model performance.

A cybersecurity specialist may understand attack surfaces.

A domain expert may understand healthcare, education or financial risks.

A human-rights expert may understand discrimination and fundamental-rights implications.

Effective AI governance therefore cannot rely on one type of expertise.

It requires institutional coordination.

This is one of the major lessons emerging from the implementation phase.

Standards Become Governance Infrastructure

The transition toward implementation is also increasing the importance of technical standards.

Standards translate broad policy requirements into more operational concepts.

They can define terminology.

They can establish testing procedures.

They can specify documentation requirements.

They can create methods for risk management.

They can support interoperability.

They can help organisations demonstrate compliance.

NIST’s work illustrates this development.

The NIST AI Risk Management Framework was originally designed as a voluntary framework for organisations developing, deploying and using AI systems.

It is structured around four functions: Govern, Map, Measure and Manage.

The significance of this framework is not that it creates a universal legal obligation.

It does not.

Its significance is that it provides an operational vocabulary for turning AI risk management into organisational processes.

That distinction is important.

Principles tell organisations what matters.

Frameworks help explain how to manage it.

Standards can make those processes more consistent.

Evaluations provide evidence.

Regulators can then use that evidence when relevant.

The rise of AI standards therefore represents a bridge between policy and implementation.

Evaluation Becomes Central

One of the most important developments in this new phase is the growing importance of AI evaluation.

AI systems are increasingly being evaluated not only for conventional accuracy but also for safety, robustness, security, bias, reliability, harmful capabilities and real-world impacts.

The challenge is that evaluation itself is difficult.

Different AI systems require different evaluation methods.

A medical AI system cannot necessarily be evaluated in the same way as a chatbot.

A foundation model cannot necessarily be evaluated in the same way as a traditional classification model.

An autonomous AI agent creates another set of questions because the system can act rather than simply generate an answer.

NIST’s 2026 TEVV-Athlon framework reflects this expanding evaluation landscape.

Its proposed framework is designed to support assessment of different types of AI systems, including large language models, multimodal models and agentic systems.

NIST also published an ARIA Evaluation Planning Manual in September 2026 describing a broader evaluation approach combining model testing, red teaming and user testing.

This illustrates a larger trend.

AI evaluation is becoming a governance capability in its own right.

The Audit Question

Evaluation naturally leads to another question:

Who should perform the evaluation?

This is where AI auditing becomes increasingly important.

Internal evaluation can provide valuable information.

But regulators may sometimes require greater independence.

Companies may have incentives to present their systems positively.

A developer may know its model better than an external auditor but may not provide the same degree of independence.

This creates a tension between technical access and institutional independence.

The future governance ecosystem may therefore contain several layers of assessment.

Developers may conduct internal testing.

Independent evaluators may conduct third-party assessments.

Standards organisations may establish evaluation methodologies.

Regulators may review evidence and investigate failures.

Civil society and researchers may perform external scrutiny.

These roles are not interchangeable.

The question of who audits AI is therefore becoming a governance question in its own right.

From Pre-Deployment Testing to Continuous Monitoring

Another major shift is the recognition that testing an AI system before deployment may not be enough.

AI systems operate in changing environments.

Users behave unpredictably.

Models may be updated.

Prompts can change.

Data distributions can change.

New vulnerabilities can emerge.

Systems may be integrated with external tools.

Agentic systems may behave differently as their environments change.

For these reasons, governance increasingly needs to continue after deployment.

NIST’s 2026 work on deployed AI systems explicitly highlights the need for post-deployment monitoring and notes that common monitoring practices and validated methodologies are still developing.

This is an important development.

Traditional software governance often assumes that a product can be tested, released and then maintained.

AI complicates that model.

The behaviour of an AI system can depend on data, context, users, model updates and interactions with other systems.

Governance therefore becomes continuous.

The AI Governance Lifecycle

A useful way to understand this emerging model is as an AI governance lifecycle.

Before development, organisations identify objectives, risks and applicable requirements.

During development, they manage data, model design, testing and documentation.

Before deployment, they conduct evaluations and determine whether the system is appropriate for its intended use.

During deployment, they monitor performance and unexpected behaviour.

After incidents, they investigate, document and correct failures.

When systems are modified or updated, they may need to be reassessed.

This changes the meaning of accountability.

Accountability is no longer simply:

Who approved the system?

It becomes:

Who designed it?

Who trained it?

Who evaluated it?

Who deployed it?

Who monitored it?

Who had authority to intervene?

Who was responsible when something went wrong?

This is lifecycle governance.

Documentation Becomes Evidence

Implementation also increases the importance of documentation.

Governance cannot operate effectively if regulators, auditors or users have no information about how a system was developed and deployed.

Documentation can include information about training data, system capabilities, known limitations, testing, risk assessments, intended uses and monitoring.

For organisations, documentation can initially appear administrative.

But from a governance perspective, documentation creates traceability.

Traceability allows investigators to understand what happened.

It allows auditors to assess whether appropriate procedures were followed.

It allows regulators to identify responsibility.

It allows organisations to learn from incidents.

As AI systems become more complex, this traceability function becomes increasingly important.

The Rise of Assurance

A broader concept is emerging around these practices:

AI assurance.

Assurance is not identical to safety.

It is not identical to auditing.

It is not identical to compliance.

Instead, assurance can be understood as the broader process of generating justified confidence that an AI system satisfies specified requirements.

That can involve testing, evaluation, verification, validation, documentation, monitoring, audit and governance controls.

This distinction matters because no single test can establish that an advanced AI system is “safe” in every possible context.

Governance therefore needs evidence across multiple dimensions.

A system may perform well on a benchmark but behave poorly in deployment.

It may be technically robust but create unacceptable privacy risks.

It may be accurate but produce discriminatory outcomes for particular groups.

It may be safe under normal use but vulnerable to adversarial manipulation.

Assurance is therefore becoming an ecosystem rather than a single certificate.

AI Governance Becomes Technical

This transition has an important consequence for policymakers.

AI governance can no longer remain entirely within traditional policy disciplines.

A regulator dealing with frontier AI may need to understand model evaluations.

A standards body may need technical AI expertise.

An auditor may need cybersecurity knowledge.

A policymaker may need to understand compute and model development.

A university training AI policy specialists may therefore need to combine law, public policy, computer science, statistics, cybersecurity and social science.

This is one reason why AI governance is becoming a new interdisciplinary field.

The Governance Capacity Problem

But implementation creates another problem:

Who has the capacity to do all this?

Large economies can build dedicated institutions.

They can recruit technical experts.

They can fund testing infrastructure.

They can establish standards programmes.

They can create regulatory laboratories.

Many developing countries cannot easily do the same.

This creates a potential global governance asymmetry.

Countries may adopt AI principles but lack the capacity to evaluate imported AI systems.

They may enact regulations but lack specialised regulators.

They may require audits but lack qualified auditors.

They may demand transparency without having the technical ability to verify claims.

This means that AI governance capacity itself may become a form of technological power.

The countries capable of evaluating advanced AI systems will have greater ability to govern them.

The countries without that capability may remain dependent on external providers and external evaluators.

The Global South Dimension

This issue is particularly important for the Global South.

AI governance discussions often focus on what rules countries should adopt.

But a more fundamental question is:

What institutions can actually implement those rules?

For developing countries, governance capacity may need to be built progressively.

The first stage may involve national inventories of AI systems and use cases.

The next may involve basic risk-management guidance.

Universities and research institutions can develop evaluation expertise.

Public agencies can build AI procurement and oversight capabilities.

Standards bodies can develop technical knowledge.

Independent research organisations can conduct external assessments.

Over time, more sophisticated regulatory and assurance institutions can emerge.

This suggests that AI governance should be treated partly as institutional development.

Bangladesh and the Implementation Question

For Bangladesh, this distinction is particularly important.

A national AI policy or strategy would not by itself create effective AI governance.

The country would also need the institutional capacity to implement it.

That could include public-sector AI expertise, university research capacity, AI testing and evaluation, procurement standards, data governance, cybersecurity expertise and mechanisms for monitoring high-impact AI deployments.

Universities could play an especially important role.

They could become centres for AI evaluation research.

They could train regulators and public officials.

They could develop local-language evaluation datasets.

They could study AI impacts in education, employment, healthcare and public services.

They could create independent technical expertise that government and industry could use.

This creates a potential research opportunity for Atlas AI Institute:

instead of asking only whether Bangladesh has an AI policy, study whether Bangladesh has the institutional capabilities required to implement AI governance.

That is a much deeper question.

The Governance Gap

The difference between formal policy and operational capability can be described as the governance gap.

A country may have:

an AI strategy but limited implementation capacity;

AI principles but no evaluation infrastructure;

regulatory provisions but insufficient technical expertise;

AI procurement policies but weak monitoring;

public-sector AI deployments but limited independent oversight.

The existence of a governance document therefore tells us relatively little about the maturity of the governance system unless we also examine implementation.

This is why comparative AI governance research should increasingly examine institutions rather than documents alone.

Who has authority?

Who has expertise?

Who can test?

Who can investigate?

Who can sanction?

Who can appeal?

Who can publish evidence?

Who can intervene?

These questions reveal how governance actually works.

Implementation Is Becoming the New Competitive Frontier

There is also a geopolitical dimension.

As AI governance becomes more operational, countries may compete not only over models and compute but also over standards, evaluation methodologies and assurance infrastructure.

A country that develops trusted evaluation institutions can influence international standards.

A country that develops widely adopted testing methodologies can shape compliance ecosystems.

A country that trains AI auditors can supply expertise internationally.

A country that develops strong AI safety research can influence frontier governance discussions.

This means that AI governance capacity may become part of technological influence.

The competition is therefore expanding.

It is no longer simply:

Who has the best model?

It is also:

Who can measure models?

Who can evaluate them?

Who can certify them?

Who can monitor them?

Who can investigate failures?

Who can establish trusted standards?

The New Governance Stack

A mature AI governance ecosystem may increasingly contain several interconnected layers.

At the top are principles and laws.

Below them are regulatory requirements and standards.

Below those are evaluation methodologies and technical tools.

Then come audits, conformity assessments and assurance mechanisms.

After deployment come monitoring and incident reporting.

Finally, enforcement and institutional learning close the loop.

This can be visualised as a governance stack:

Principles

Law and regulation

Standards

Risk management

Testing and evaluation

Audit and assurance

Deployment monitoring

Incident response

Enforcement and learning

The important point is that no single layer is sufficient.

The effectiveness of the overall system depends on how well the layers connect.

The Next Governance Problem: Agents

This becomes even more important as AI systems become agentic.

A conventional chatbot primarily produces information.

An AI agent may plan and execute actions.

That introduces new governance questions.

What permissions should an agent have?

What actions require human approval?

How should tool access be controlled?

How can actions be logged?

How can harmful actions be reversed?

How should multi-agent systems be monitored?

How can an organisation demonstrate that an autonomous system remained within authorised boundaries?

These questions push AI governance further toward operational assurance.

The governance of agents may therefore become one of the first major tests of whether existing implementation frameworks are sufficiently adaptable.

From Governance Principles to Governance Infrastructure

The deeper transformation is therefore not simply regulatory.

AI governance is becoming infrastructure.

Standards are infrastructure.

Evaluation laboratories are infrastructure.

Testing datasets are infrastructure.

Audit institutions are infrastructure.

Regulatory expertise is infrastructure.

Incident-reporting systems are infrastructure.

University research capacity is infrastructure.

Public-sector AI expertise is infrastructure.

This changes how countries should think about AI governance.

The goal is not simply to write rules.

The goal is to build a system capable of making those rules meaningful.

The Strategic Shift

The global AI governance conversation has therefore entered a new stage.

The first question was:

What values should guide AI?

The second was:

What principles should governments adopt?

The third became:

What laws should regulate AI?

The emerging question is:

How do we know whether those laws and principles are actually being followed?

That question requires measurement.

Measurement requires standards.

Standards require technical expertise.

Technical expertise requires institutions.

Institutions require investment.

And investment requires governments to treat AI governance as a capability rather than merely a compliance exercise.

For Atlas AI Institute, this transition creates a particularly important research direction.

The future of AI governance research should not focus only on what governments announce.

It should examine whether governance systems can actually observe, evaluate, monitor and intervene in AI systems.

That is where policy meets technical reality.

And that is where the next generation of AI governance will increasingly be decided.