Politics and Governance

AI Regulation in a Fragmented World

By 2026, four distinct approaches to AI governance had emerged — each reflecting different political systems, economic interests, and cultural assumptions about the relationship between technology, markets, and the state. The result is a fragmented global landscape where the most powerful technology in a generation is governed by incompatible frameworks.

The European Union moved first and most comprehensively. The AI Act, adopted in March 2024 after three years of negotiation, established a risk-based classification system. Unacceptable risk applications — social scoring by governments, real-time biometric identification in public spaces, manipulation of vulnerable groups, emotion recognition in workplaces — are banned outright. High-risk systems in critical infrastructure, education, employment, law enforcement, and democratic processes face conformity assessments, risk management systems, and transparency requirements. General-purpose AI models above a systemic risk threshold (>10²⁵ FLOPs) require model evaluations and adversarial testing — a provision added after ChatGPT transformed the landscape mid-negotiation. Penalties reach €35 million or 7% of global annual turnover. High-risk enforcement begins August 2, 2026, though the Digital Omnibus package may push some obligations to December 2027.

The United States hosts the world’s most powerful AI companies but has the least coherent regulatory framework. President Biden’s Executive Order on AI (October 30, 2023) was the most comprehensive executive action in US history on the topic — requiring foundation model developers to share safety tests and directing agencies to develop standards. The Trump administration revoked it early in 2025, emphasizing deregulation for competitiveness. Congressional efforts (Schumer’s AI Insight Forums, multiple introduced bills) produced no federal legislation through 2026. A patchwork of state laws emerged instead: NYC’s Local Law 144 requiring automated employment decision bias audits, Illinois HB 3773 prohibiting AI employment discrimination, Colorado’s AI Act covering high-risk systems broadly. California’s SB 1047 — the most ambitious safety bill — was vetoed by Governor Newsom in 2024 amid industry lobbying.

China moved fastest. Algorithm Recommendation Regulations (2022), Deep Synthesis Regulations (2023), and Generative AI Regulations (2023) were enacted within months of identifying issues — a pace impossible in democratic systems. The approach is pragmatic and targeted: consumer-facing AI services require provider licensing, content labeling, and adherence to “core socialist values,” while enterprise and B2B applications have more freedom. The explicit goals include content control and social stability alongside safety.

The United Kingdom positioned itself between the EU and the US. Rather than a single AI law, the “Pro-Innovation Approach” white paper (2023) directed existing sector regulators to apply shared principles: safety, transparency, fairness, accountability, and contestability. The AI Safety Institute, established after the Bletchley Park summit (November 2023, 28 countries), focuses on frontier model evaluation. Critics note the approach is largely voluntary — but proponents argue it adapts faster than legislation.

Surveillance, Data, and Digital Sovereignty

In 2019, Shoshana Zuboff’s The Age of Surveillance Capitalism gave a name to what many had sensed: the business model of the dominant technology companies was not selling products to users but extracting behavioral surplus — data beyond what’s needed to improve services — and feeding it into prediction products sold in behavioral futures markets. Zuboff’s framework identified a new form of power: instrumentarian power, which unlike ownership or force, operates by predicting and modifying behavior at scale.

The concept influenced EU legislative processes (DMA, DSA, AI Act), provided vocabulary for regulators and civil society, and was widely cited in policy debates. But it also drew criticism: for underplaying the political-economic context of neoliberal deregulation and weakened labor power, for overstating the novelty (behavioral manipulation predates digital platforms), and for portraying users as entirely passive victims of extraction.

The GDPR (effective May 2018) was the EU’s most significant data protection reform. Enforcement was slow initially but escalated: Amazon was fined €746 million in 2021; Meta was fined €1.2 billion in 2023 for EU-US data transfers. The Schrems II decision (2020) invalidated the Privacy Shield framework. A new EU-US Data Privacy Framework (2023) provided a legal basis for transfers but the fundamental tension — between EU protection standards and US surveillance law — remained. GDPR-inspired laws spread globally: Brazil’s LGPD (2020), India’s DPDP Act (2023), and dozens more. The US remained the outlier among major democracies with no comprehensive federal data protection.

Digital sovereignty became a geopolitical battleground. The EU asserted regulatory sovereignty through the “Brussels Effect” — its large market and strict regulations set de facto global standards because companies find it easier to adopt EU rules globally than maintain separate systems. The European Chips Act (2023) targeted €43 billion in public and private investment to reduce semiconductor dependence.

The US-China semiconductor competition was the sharpest edge of the tech cold war. The CHIPS and Science Act (August 2022) committed $52.7 billion in subsidies for domestic manufacturing — a dramatic departure from US industrial policy orthodoxy. Sweeping export controls (October 2022, updated 2023) restricted advanced chip and manufacturing equipment sales to China, targeting performance thresholds and specifically ASML’s EUV lithography equipment — a Dutch company that holds a global monopoly on the machines essential for cutting-edge chips. The TikTok saga crystallized the tensions: the “Protecting Americans from Foreign Adversary Controlled Applications Act” (April 2024) gave ByteDance nine months to divest or face a US ban. The Supreme Court rejected a First Amendment challenge in January 2025. No single case better illustrated the collision between digital globalization and national security.

Algorithms in Government and Society

The deployment of algorithmic decision-making in government produced some of the decade’s most consequential scandals — each illustrating how complex systems amplify bias rather than correct it.

The Netherlands Toeslagenaffaire (childcare benefits scandal) became a global cautionary tale. A machine learning system designed to detect welfare fraud disproportionately targeted dual-nationality families. Over 26,000 families were wrongly accused and forced to repay benefits, some driven into severe financial hardship. The scandal brought down the Dutch government in January 2021. The system’s designers had optimized for fraud detection without adequate safeguards against discriminatory impact — a failure of both technical design and institutional oversight.

Australia’s Robodebt scheme (2015–2019) automated welfare overpayment detection using income data matching. It generated hundreds of thousands of incorrect debt notices, imposing collection pressure on people who owed nothing. A royal commission (2023) found the scheme unlawful. The government settled for $1.8 billion in compensation. Like the Toeslagenaffaire, Robodebt demonstrated that automated systems can scale injustice with an efficiency that human bureaucracies never could.

In criminal justice, the COMPAS system (Correctional Offender Management Profiling for Alternative Sanctions) was used across US courts for bail, sentencing, and parole decisions. ProPublica’s 2016 investigation found racial bias: Black defendants were almost twice as likely as white defendants to be incorrectly flagged as high-risk. The debate this triggered — whether algorithmic fairness is even formally possible across multiple criteria at once — is the impossibility result Module 9 develops in full; here the concern is what it does to governance.

Predictive policing created algorithmic feedback loops: historical crime data (itself shaped by biased enforcement patterns) trained models that directed police to the same neighborhoods, producing more arrests and more data reinforcing the pattern. Chicago’s “heat list” risk-scored individuals based on social networks and arrest history; a RAND evaluation found no measurable effect on reducing gun violence. After the 2020 racial justice protests, Los Angeles abandoned predictive policing. The EU AI Act classifies it as high-risk requiring strict oversight.

China’s Social Credit System is often portrayed in Western media as a unified Black Mirror-style dystopia. The reality is more fragmented: multiple local government pilots with varying methodologies, separate commercial systems (Ant Group’s Sesame Credit most prominent), and no single national score. But the consequences are real: government blacklists restrict millions from airline and train tickets, financial services, and private school enrollment — over 30 million individuals on the “untrustworthy” list by 2023. And the concept is not uniquely Chinese: FICO scores, tenant screening, Uber ratings, and insurance assessments are Western equivalents. The difference is degree and state involvement, not kind.

Automated content moderation operates at staggering scale: Meta removes billions of pieces of content per quarter via automation; YouTube’s systems flag over 90% of removed videos before any human review. Errors disproportionately affect Arabic and non-English content. Marginalized groups’ descriptions of discrimination are sometimes removed as “hate speech.” And the human cost is severe: content reviewers — often low-paid contractors in the Philippines, Kenya, and India — develop PTSD and depression from constant exposure to violent and sexual content.

Information, Democracy, and Epistemic Collapse

The relationship between social media and democracy underwent a dramatic reversal during 2015–2026. The optimism of the Arab Spring era — social media as democratizing force — gave way to a darker assessment. The 2016 US election was the watershed: the Russian Internet Research Agency’s social media campaigns and the Cambridge Analytica scandal (which harvested data from 87 million Facebook users for political targeting) shattered the narrative that open information platforms naturally strengthen democracy.

Platforms responded with heavy investment in election integrity: removing coordinated inauthentic behavior, labeling state-controlled media, restricting political ad targeting, and partnering with fact-checkers. But the adequacy of these measures was debated across every subsequent election — Brexit, Brazilian (2018, 2022), Indian (2019, 2024), Philippine (2022).

Content moderation became a political battleground. Section 230 of the Communications Decency Act (1996) — which shields platforms from liability for user content — was targeted from both sides: Democrats wanted platform accountability for harmful content; Republicans saw moderation decisions as politically biased. The bipartisan desire to modify Section 230 never produced legislation because the two sides wanted opposite changes.

Elon Musk’s acquisition of Twitter ($44 billion, October 2022) was a live experiment in content moderation policy. Staff was reduced by roughly 80%, banned accounts were reinstated, and the platform rebranded as X. Advertiser revenue declined by over 50% in the first year. The crowd-sourced “Community Notes” fact-checking system was widely praised. But X’s evolution illustrated a fundamental tension: content moderation is not a neutral technical operation but a political choice about what speech a platform amplifies. Meta’s January 2025 decision to end US third-party fact-checking and adopt X’s community notes model confirmed the political winds.

Deepfakes represented an escalation from misinformation to epistemological crisis. The numbers were staggering: from an estimated 500,000 deepfake videos in 2023 to a projected 8 million by 2025. Europol estimated that 90% of online content could be synthetically generated by 2026. Over 90% of deepfake videos were non-consensual intimate imagery — AI-generated explicit content using real faces without consent, disproportionately affecting women. This was criminalized in the UK (Online Safety Act 2023), several US states, South Korea, and addressed by the EU AI Act’s transparency requirements.

Political deepfakes tested democratic resilience directly. A fake Joe Biden robocall during the January 2024 New Hampshire primary discouraged voters from participating — prompting the FCC to make AI-generated robocalls illegal. A deepfake video in the 2025 Irish presidential election falsely depicted the eventual winner withdrawing from the race. Voice cloning — once requiring specialized equipment — now needs only seconds of smartphone audio and has crossed the “indistinguishable threshold.”

The deepest threat was not any individual fake but the “liar’s dividend”: in a world where any media could plausibly be AI-generated, anyone can dismiss genuine evidence as fabricated. The crisis was not just about creating false information but about destroying the mechanisms society uses to establish truth. The Content Authenticity Initiative (C2PA) was developing technical standards for content provenance, but adoption remained gradual.

LSE researchers (2025) identified a new category: generative bubbles. Unlike filter bubbles (where algorithms curate content reaching users), generative bubbles emerge when users repeatedly query AI systems from a particular perspective, receiving increasingly fine-tuned responses. The user becomes the curator of their own epistemic bubble — a dynamic that operates through user agency directed toward cognitive closure rather than algorithmic opacity.

Why Traditional Governance Struggles

The failures and difficulties documented in the previous sections share a common root: traditional governance was designed for a simpler world. Three structural mismatches explain why.

Pace mismatch: Technology evolves in months; legislation takes years. The EU AI Act took three years from proposal to adoption. During that time, ChatGPT launched, multimodal AI emerged, and the entire generative AI industry was born. This reflects the legitimate needs of democratic deliberation — but the structural gap between technological and regulatory timescales is widening, not closing.

Jurisdictional mismatch: Platforms and AI systems operate globally; governance operates nationally or regionally. A content moderation decision made in Ireland affects users in Brazil. A model trained in the US is deployed in Japan. No existing governance mechanism adequately addresses phenomena that are truly global in scope but regulated by territorial authority.

Complexity mismatch: The most consequential effects of digital systems are emergent properties — they arise from the interaction of millions or billions of actors in ways that are not predictable from individual components. Recommendation algorithms produce societal effects (polarization, mental health impacts, cultural homogenization) that were neither intended nor designed. Traditional regulation assumes identifiable cause-and-effect chains and clear lines of responsibility. Emergent properties have neither — as Module 2’s complexity foundations explain.

Information asymmetry compounds all three. Platform companies understand their own systems better than any regulator. The technical complexity of modern AI exceeds most government agencies’ expertise. Even the companies themselves sometimes cannot fully explain their AI systems’ outputs. This creates a fundamental oversight challenge: regulators are asked to govern systems they cannot fully inspect or understand.

From a game-theoretic perspective — building on Game Theory and Cooperation — cybersecurity illustrates the asymmetry vividly. The attacker-defender game is fundamentally imbalanced: the attacker needs one successful breach; the defender must prevent all of them. AI has intensified both sides: attackers use AI for automated reconnaissance, polymorphic malware, and social engineering at scale; defenders use AI for anomaly detection, automated response, and threat intelligence integration. The Nash equilibrium in this game involves mixed strategies where neither side can guarantee a dominant outcome — a dynamic that mirrors the broader governance challenge of regulating AI.

Governance Innovations

If traditional governance struggles, what alternatives are emerging? Several approaches attempt to close the mismatch by making regulation itself more adaptive.

Regulatory sandboxes — controlled environments where AI systems can be tested without full compliance requirements — are the most widely adopted innovation. The UK’s Financial Conduct Authority pioneered the model for fintech in 2016; by 2025, over 70 countries had at least one sandbox program. The EU AI Act includes sandbox provisions. The advantages are real: regulators gain hands-on understanding of the technology, and firms can innovate without regulatory paralysis. But sandboxes have limitations: results may not generalize, participant selection may bias outcomes, and the transition from sandbox to mainstream regulation is poorly defined.

Algorithmic impact assessments, modeled on environmental impact assessments, require pre-deployment evaluation of high-risk AI systems. Canada’s Algorithmic Impact Assessment Tool (2019) was an early example. The EU AI Act’s conformity assessment for high-risk systems serves a similar function. The analogy to environmental regulation is apt: both address harms that are diffuse, delayed, and difficult to attribute to specific actors — characteristics of complex system dynamics.

Adaptive regulation borrows from software development methodology: set principles, observe outcomes, adjust, repeat. New Zealand, Singapore, and the UK are experimenting with approaches that treat regulation as an iterative process rather than a one-time legislative act. Systemic risk regulation, drawing on post-2008 financial crisis approaches, focuses on low-probability, high-impact events arising from interconnection and complexity — the EU AI Act’s GPAI systemic risk provisions reflect this thinking.

Polycentric governance — multiple overlapping centers of authority rather than a single hierarchy — builds on Elinor Ostrom’s Nobel Prize-winning work on commons governance. The current fragmented AI landscape, while appearing chaotic, may actually be a form of polycentric governance: imperfect and inconsistent, but potentially more resilient than any single global framework would be. The EU, US, China, UK, and dozens of other jurisdictions are running parallel regulatory experiments — a form of evolutionary selection pressure on governance approaches.

Laissez-faire activism is the name the economist David Colander and the management consultant Roland Kupers gave to a positive theory of complexity-aware governance — an attempt to say not merely how traditional regulation fails but what should replace it. Their opening move is to reject the framing the whole debate usually assumes, state versus market: the two, they argue, are not opposites but a symbiosis that coevolved, each shaping and constraining the other over centuries. From that follows a posture organized around the bottom-up / top-down axis — preferring order that emerges from the decentralized interaction of agents (bottom-up) to order imposed by mandate (top-down), because, as Module 2 showed, top-down interventions in a complex system reliably throw off side effects their designers never see. The state’s job, on this account, is to set and tend the framework within which society self-organizes — a midwife rather than a controller — intervening structurally rather than directively. It is a recognizably argued position, market-friendly in temperament, and it is offered here as one named framework among the several in this section rather than as a conclusion; what earns it a place is that it is the most fully worked-out attempt to turn the complexity critique of governance into a constructive program.

The framework also meets a sharp version of this module’s own pace problem. Setting the rules of the game and letting it play out assumes the rule-setter can at least define the framework faster than the framework is overtaken — and against frontier AI, where capability moves on quarterly cycles and even the firms cannot fully explain their systems, even framework-setting strains. Bottom-up order is not automatically benign either: the same self-organization that produced grassroots environmentalism also produces disinformation cascades. The honest reading is that the bottom-up/top-down axis is a better map of the available choices than the state-versus-market one it replaces, without telling you, in any given case, where on the axis to stand.

Agent-based modeling for policy design offers a direct bridge between complexity science and governance. ABM can simulate the effects of regulatory interventions — antitrust action, content moderation rules, data protection enforcement — before implementation, capturing the emergent effects and unintended consequences that traditional policy analysis misses. The challenge is bridging the gap between academic ABM research and practical policy design.

Synthesis: Co-Evolution of Technology and Governance

Six dynamics define the relationship between digital technology and governance as it stands in 2026:

1. Concentration triggers regulation. Search, social media, e-commerce, cloud, and now AI all followed the same trajectory: rapid growth, market concentration, then political backlash. The cycle time has shortened from decades (Microsoft in the 1990s) to years (ChatGPT to AI regulation).

2. The Brussels Effect creates de facto global standards. The EU has established itself as the world’s technology regulator — not through market power but through regulatory gravity. But the US and China pursue fundamentally different approaches, and whether the global landscape will converge or permanently fragment remains open.

3. The pace gap is widening, not closing. If anything, the mismatch between technological and regulatory timescales has grown. The realistic goal may not be “governance catches up” but “governance functions with permanent partial knowledge.”

4. Labor is the persistent fault line. From gig workers to AI-displaced knowledge workers, the distribution consequences of digital technology are the most politically salient. Aggregate wealth creation is real, but distribution is deeply uneven. Redistribution systems lag.

5. The privacy-convenience trade-off is hardening. Despite GDPR, protection movements, and growing awareness, consumers continue accepting surveillance models for convenience. The gap between stated and revealed preferences is a structural feature, not a temporary information deficit.

6. Complex systems produce complex problems. Misinformation, algorithmic bias, market concentration, and safety risks are all emergent — they arise from interactions within complex systems, not from individual bad actors. Traditional legal frameworks built around individual responsibility and linear causation are structurally inadequate for emergent harms.

The central insight is that the digital economy and politics are not separate systems that happen to interact. They are one tightly-coupled complex adaptive system, and understanding either in isolation is impossible. Governing technology requires the tools of complexity science — emergence, feedback loops, path dependence, adaptation, nonlinearity — not the linear cause-and-effect models that traditional policy assumes.

The gap between what complexity science offers and what governance practice uses remains wide. Closing it is both an intellectual challenge and a practical necessity. The next module explores where these trajectories lead.