The Widening Gap Between AI Policy and Real-World Enforcement

AI Doesn’t Have a Single Rulebook

AI is being deployed across industries and applications faster than the policies and governance frameworks needed to oversee it can mature. Historically, AI applications were largely governed through existing consumer protection, privacy, and industry-specific regulations, alongside companies’ own internal policies. Governments are now introducing AI-specific requirements, but these remain fragmented and often provide limited guidance on how systems should actually operate. Companies are therefore left to reconcile external requirements with their own risk tolerance, product objectives, and operational realities.

The EU is now actively enforcing parts of the AI Act, while U.S. federal policy explicitly favors a less burdensome national framework, with Executive Order 14365 seeking to limit conflicting state requirements, even as states introduced more than 1,000 AI-related measures in 2025. Each of these authorities describes a different destination, and the work of reconciling them is landing on the companies building and deploying the systems.

But establishing regulatory requirements is only part of the challenge. As AI is deployed across more applications and contexts, companies must translate broad requirements and internal policies into operating controls and individual AI decisions. No regulatory framework can anticipate every application, context, or tradeoff. Organizations therefore need to trace a path from governing requirements and internal policies to system behavior, measurable outcomes, and audit or review. The NIST AI Risk Management Framework takes a similar view by emphasizing ongoing measurement and management rather than treating governance as a standalone compliance exercise. Requirements flow down, and evidence flows back up: regulators and executives may define the desired outcomes, but organizations must demonstrate whether their systems are actually producing them.

This places much of the practical responsibility for AI governance on the organizations deploying these systems.

Governance Gets Hard at the Implementation Layer

Regulations and governance frameworks generally define principles, obligations, and desired outcomes. Production systems, however, have to translate those into individual decisions, and that translation is where governance gets hard. A policy can say prevent discrimination, protect users, provide transparency, or allow meaningful human review, yet an operational system has to answer far more specific questions: at what threshold does it act, based on what evidence and with what confidence, when is human review required, what gets logged, and what happens when the system is uncertain?

Regulators already expect those answers. The FTC, DOJ, CFPB, and EEOC said jointly that they will enforce their existing authorities on automated systems, which means someone will eventually ask a company to explain how its system decides.

Consider a platform with a clear policy against harassment. A message containing profanity may be harmless banter between friends, while a seemingly innocuous message may be part of a sustained campaign targeting another user. The system has to determine what context it can reliably use, how much evidence is enough to intervene, and what intervention is appropriate: block the message, warn the sender, escalate for human review, or take no action. Lowering detection thresholds may catch more harmful behavior, but also suppress legitimate conversation. Requiring human review may improve judgment, but delay intervention. None of these decisions is specified by a general policy prohibiting harassment, yet together they determine how that policy is actually enforced.

No policy document settles those tradeoffs in advance, so someone inside the company has to decide them, document them, and revisit them. That person is effectively writing policy whether or not the org chart says so.

What Responsible AI Actually Requires

If the people who implement a system are effectively the ones writing policy, then responsible AI cannot be treated as a statement of intent, because it has to show up in how the system behaves every day. That means managing how AI is used, measured, and corrected over time, not just approving a policy or passing an initial evaluation. Three ideas matter most in practice, and each follows from the tradeoffs above:

• Governance should be proportional to consequence. An AI system that recommends copy, approves a loan, flags a security threat, or supports a medical decision creates very different risks. Organizations need to determine where stronger controls, review, and oversight are warranted based on the potential consequences.
• Accuracy alone is insufficient. Different errors carry different costs. A false positive in moderation may suppress legitimate speech, while a mistake in lending, healthcare, or security can have far heavier consequences. Governance has to reflect the real-world impact of a decision, not just model performance.
• Continuous evaluation and feedback are essential. Overrides, appeals, incidents, edge cases, and downstream outcomes should all feed ongoing evaluation.

A Practical Framework for Internal AI Governance

Putting these principles into practice requires governance to be built into how AI systems are designed, deployed, and managed. Four practices are particularly important:

• Treat governance requirements as product and system requirements from the start. Compliance controls added after deployment tend to be costly and brittle. Privacy, transparency, auditability, and review mechanisms are much easier to design into a system than to retrofit later.
• Build an auditable chain from policy to decision. Organizations should be able to connect the governing requirement or internal policy to the control applied and the resulting decision. They also need the evidence required to evaluate it.
• Assign clear ownership and accountability. Define who owns the policy, who determines acceptable risk, and who monitors performance. Someone should also have the authority to intervene when the system behaves outside those bounds.
• Build shared, adaptable governance infrastructure. Data controls, audit trails, configurable policies, review workflows, and measurement should support multiple regulatory requirements and use cases. Controls and thresholds should be adaptable by jurisdiction, application, and risk, allowing organizations to respond to changing requirements without rebuilding their systems.

Governance Has to Work in Practice

Regulation can define obligations and principles, but companies still have to translate them into systems that make real decisions at scale. That makes internal governance an operating responsibility, not just a compliance exercise. Every company that deploys AI at scale is already writing policy through its thresholds, its review rules, and its escalation paths, and the only open question is whether it does so on purpose.

Regulators will keep defining the outcomes they want, and they will not always agree, so the company has to decide how those expectations become controls and then show with evidence that the controls work. Companies that build clear ownership, measurable controls, auditability, and adaptable infrastructure now will be better positioned as regulation continues to evolve.

I’ve seen this problem from several sides: in cybersecurity environments, building risk models, and now operating AI systems at scale. Across each, the lesson is similar: a framework only works if it can be translated into clear decisions, measured in practice, and improved when reality exposes the gaps.