Politics and Governance

AI Regulation in a Fragmented World

By 2026, four distinct approaches to AI governance had emerged — each reflecting different political systems, economic interests, and cultural assumptions about the relationship between technology, markets, and the state. The result is a fragmented global landscape where the most powerful technology in a generation is governed by incompatible frameworks.

The European Union moved first and most comprehensively. The AI Act, approved by the European Parliament in March 2024 after three years of negotiation, sorts applications into risk tiers: unacceptable-risk uses (social scoring, real-time biometric identification in public spaces) are banned outright, high-risk systems face conformity assessments and transparency requirements, and penalties reach €35 million or 7% of global annual turnover.

The United States hosts the most powerful AI companies but has the least coherent framework: a 2023 executive order revoked in 2025, no federal AI law through 2026, and a patchwork of state laws — California’s most ambitious safety bill, SB 1047, was vetoed in 2024.

China moved fastest. Binding rules on recommendation algorithms, deep synthesis, and generative AI each arrived within months of the issue appearing — a pace impossible in democratic systems. The rules are targeted rather than comprehensive, and content control is an explicit goal alongside safety.

The United Kingdom sits between the EU and the US: no single AI law, but shared principles applied by existing sector regulators, and an AI Security Institute (founded in 2023 as the AI Safety Institute) that tests frontier models. Critics call it largely voluntary; supporters say it adapts faster than legislation.

Before you open the map, commit to a guess: can any jurisdiction score high on both comprehensiveness and speed — or is one always paid for with the other? Pick your candidate, then click those two rows first.

Surveillance, Data, and Digital Sovereignty

The cases in this section and the next show one pattern from two sides: a few actors gained control of data at a scale no rule anticipated, and governments answered late, unevenly, and mostly by fighting over who holds the data rather than how it is used.

In the early 2000s, Google discovered that the “exhaust” its search engine threw off — queries, clicks, and dwell times far beyond anything needed to improve the service — could predict which ads a user would click. Prediction could be sold: a raw material whose supply was limitless and whose extraction cost was near zero. In 2019, Shoshana Zuboff’s The Age of Surveillance Capitalism gave that residue a name — behavioral surplus — and argued that the power built on it rests on neither ownership nor force, but on predicting and steering behavior at scale.

The concept gave EU lawmakers and regulators a vocabulary, though critics argue it overstates the novelty (behavioral manipulation predates platforms) and casts users as entirely passive.

The GDPR General Data Protection Regulation (GDPR) The EU’s data-protection law, in force since 2018. It gives people rights over their personal data and lets regulators fine companies up to 4% of worldwide annual revenue. (effective May 2018) was the EU’s answer. Enforcement started slowly, then escalated — Amazon was fined €746 million in 2021 over consent for targeted advertising (annulled on appeal in 2026 and sent back to the regulator), Meta €1.2 billion in 2023 for EU-US data transfers — and GDPR-style laws spread to Brazil, India and dozens of other countries. The US remained the outlier among major democracies, with no comprehensive federal data protection law.

Digital sovereignty Digital sovereignty A state’s or region’s ability to control its own digital infrastructure, data and rules rather than depending on foreign companies or governments. became a geopolitical battleground. The EU asserted regulatory sovereignty through the “Brussels Effect” — its large market and strict regulations set de facto global standards because companies find it easier to adopt EU rules globally than maintain separate systems. The European Chips Act (2023) aimed to mobilize €43 billion of public and private investment to reduce dependence on foreign chips.

The US-China semiconductor competition was the sharpest edge of the contest. The US committed $52.7 billion to domestic chipmaking and chip research, $39 billion of it in manufacturing subsidies (CHIPS and Science Act, 2022), and restricted exports of advanced chips and chipmaking equipment to China — above all the extreme-ultraviolet (EUV) lithography machines that only the Dutch firm ASML can build. The TikTok law of April 2024, upheld by the Supreme Court in January 2025, ordered its Chinese owner to sell or face a US ban: national security overriding a platform with, by its own count, 170 million American users. The Detailed view below has the supply-chain numbers and the case law.

The panel below has two depths. The Overview is enough for the rest of the module; open the Detailed view only if you want the supply-chain numbers and the case law.

Algorithms in Government and Society

Governments that automated decisions about citizens produced some of the decade’s most consequential scandals. Three of them — two welfare systems and one court tool — carry the argument of this section: a system tuned for one narrow objective, deployed at scale inside an institution that stopped checking it, multiplied its errors faster than anyone noticed. The others are variations on that theme.

In the Netherlands Toeslagenaffaire (childcare benefits scandal), a self-learning risk-scoring model built to detect benefit fraud used nationality as a risk factor, and dual-nationality families were disproportionately targeted. Some 26,000 parents were wrongly accused and forced to repay benefits, some driven into severe financial hardship. The scandal brought down the Dutch government in January 2021. It was optimized for catching fraud with no safeguard against discrimination — a failure of design and of oversight at once.

Australia’s Robodebt scheme (2015–2019) automated welfare overpayment detection using income data matching. It generated hundreds of thousands of incorrect debt notices, imposing collection pressure on people who owed nothing. A class action ended in a 2020 settlement worth about A$1.8 billion, mostly in debts repaid or wiped, and a royal commission (2023) called the scheme “crude and cruel” and found it unlawful. Like the Toeslagenaffaire, Robodebt demonstrated that automated systems can scale injustice with an efficiency that human bureaucracies never could.

In criminal justice, the COMPAS system (Correctional Offender Management Profiling for Alternative Sanctions) was used across US courts for bail, sentencing, and parole decisions. ProPublica’s 2016 investigation found racial bias: among defendants who did not go on to reoffend, Black defendants were almost twice as likely as white defendants to have been flagged as high-risk (45% against 23%). The debate this triggered — whether algorithmic fairness is even formally possible across multiple criteria at once — is the impossibility result Module 9 develops in full; here the concern is what it does to governance.

Predictive policing shows the mechanism in its purest form, a feedback loop Feedback loop A chain of cause and effect that loops back on itself. A reinforcing loop amplifies change (panic selling triggers more selling); a balancing loop damps it (a thermostat). : historical crime data, itself shaped by where police had patrolled, sent police back to the same neighborhoods, which produced more arrests there and more data confirming the pattern. Los Angeles abandoned its program in 2020, and the EU AI Act EU AI Act The European Union’s law regulating AI by risk level, adopted in 2024 and phased in through 2027. Some uses are banned, high-risk uses face strict obligations, and most face few. bans predicting an individual’s crimes from profiling alone and classes other police risk-assessment systems as high-risk.

Two more cases repeat the theme at other scales. China’s Social Credit System is less a single national score than a patchwork of local blacklists — but those lists have barred millions from trains and flights, and Western credit scores and platform ratings differ in degree rather than kind (the Detailed view below takes this up). Automated content moderation removes content by the billions each quarter, with errors falling hardest on non-English speakers.

Again, two depths: the Overview carries everything the rest of the module needs; the Detailed view adds the institutional post-mortems, for readers who want to know how these systems failed from the inside.

Information, Democracy, and Epistemic Collapse

Between 2015 and 2026 the view of social media and democracy reversed. The Arab Spring hope that open platforms would strengthen democracy did not survive the 2016 US election, with Russian influence campaigns and the Cambridge Analytica harvesting of up to 87 million Facebook profiles for political targeting. Platforms invested heavily in election integrity afterwards; whether it was enough was argued over at every major election since.

Content moderation became a political battleground — and a small table explains why the loudest battle went nowhere. Take two parties and ask two questions: are their goals compatible, and are the means they want to use compatible? Same goals, same means: cooperation. Same goals, different means: competition. Different goals, same means: coalition — each side backs the instrument for its own reasons. Only when both goals and means are incompatible is there real conflict.

Now classify a real case. Section 230 of the Communications Decency Act (1996) shields platforms from liability for user content, and both US parties wanted it changed: Democrats to hold platforms accountable for harmful content left up, Republicans to stop what they saw as politically biased takedowns. Same instrument, different goals — the table says coalition, and commentators duly predicted bipartisan legislation for years. It never came. The goals were not merely different but opposite: each side’s amendment would have deepened the other’s grievance, so the means turned incompatible after all, and the apparent coalition decayed into conflict. Politics can escape that cell — step back from fixed means and goals, and a zero-sum Zero-sum A situation where one side’s gain is exactly the other side’s loss, so the total stays fixed. Many real interactions are not zero-sum: both sides can win, or both can lose. standoff can widen into compromise — but on Section 230, neither side has.

Elon Musk’s $44 billion purchase of Twitter in October 2022 turned that standoff into a live experiment: about 80% of staff cut and advertising revenue roughly halved within a year (both by Musk’s own account), banned accounts reinstated, and crowd-sourced Community Notes in place of professional fact-checkers — a model Meta adopted for the US in January 2025. Whatever one thinks of the result, it settled one point: content moderation is a political choice about what a platform amplifies, not a neutral technical operation.

Deepfakes represented an escalation from misinformation to epistemological crisis. The UK government estimates that 8 million deepfakes were shared in 2025, up from 500,000 in 2023 — an estimate rather than a count, but a sixteenfold rise in two years. (A more famous figure, that 90% of online content would be synthetic by 2026, is usually credited to Europol; Europol removed it from its report in 2024, citing an inaccurate source.) When the first census was taken, in 2019, 96% of deepfake videos online were non-consensual intimate imagery — AI-generated explicit content using real faces without consent, disproportionately affecting women. This was criminalized in the UK (Online Safety Act 2023), several US states, South Korea, and addressed by the EU AI Act’s transparency requirements.

Political deepfakes reached elections directly: a fake Joe Biden robocall told New Hampshire primary voters in January 2024 to stay home, and the FCC then ruled AI-generated voices in robocalls illegal without the recipient’s consent. Cloning a voice now takes a few seconds of audio — OpenAI’s Voice Engine, previewed in 2024, needed fifteen.

The deepest threat was not any individual fake but the “liar’s dividend”: in a world where any media could plausibly be AI-generated, anyone can dismiss genuine evidence as fabricated. The crisis was not just about creating false information but about destroying the mechanisms society uses to establish truth. The Coalition for Content Provenance and Authenticity (C2PA) was developing technical standards for content provenance, but adoption remained gradual.

Writing in LSE Business Review (2025), a group of researchers named a new category: generative bubbles. Unlike filter bubbles Filter bubble The narrowing of what a person sees online when recommendation algorithms keep showing more of what they already clicked on. (where algorithms curate content reaching users), a generative bubble forms when a user engages with an AI tool in a narrow or skewed way — out of habit, limited skill, or the tool’s own design — so that the narrowing comes from the user’s own prompts rather than from a ranking algorithm. The user becomes the curator of their own epistemic bubble.

Why Traditional Governance Struggles

The failures and difficulties documented in the previous sections share a common root: traditional governance was designed for a simpler world. Three structural mismatches explain why.

Pace mismatch: Technology evolves in months; legislation takes years. The EU AI Act took three years from proposal to adoption. During that time, ChatGPT launched, multimodal Multimodal A model that handles more than one kind of input or output — text, images, audio, video — within a single system, rather than one modality each. AI emerged, and the entire generative AI industry was born. This reflects the legitimate needs of democratic deliberation — but nothing in the decade shortened the legislative cycle to match, so the gap between the two timescales is a standing condition, not a lag about to close.

Jurisdictional mismatch: Platforms and AI systems operate globally; governance operates nationally or regionally. A content moderation decision made in Ireland affects users in Brazil. A model trained in the US is deployed in Japan. No existing governance mechanism adequately addresses phenomena that are truly global in scope but regulated by territorial authority.

Complexity mismatch: The most consequential effects of digital systems are emergent properties — they arise from the interaction of millions or billions of actors in ways that are not predictable from individual components. Recommendation algorithms produce societal effects (polarization, mental health impacts, cultural homogenization) that were neither intended nor designed. Traditional regulation assumes identifiable cause-and-effect chains and clear lines of responsibility. Emergent properties have neither — as Module 2’s complexity foundations explain.

Information asymmetry compounds all three. Platform companies understand their systems better than any regulator, and sometimes cannot explain their own AI’s outputs; regulators are asked to govern systems they cannot fully inspect.

From a game-theoretic perspective — building on Game Theory and Cooperation — cybersecurity illustrates the asymmetry vividly. In the goals-and-means table from the content-moderation section, attacker and defender sit squarely in the conflict cell: they share neither. Worse, their game is fundamentally imbalanced: the attacker needs one successful breach; the defender must prevent all of them. AI has intensified both sides: attackers use AI for automated reconnaissance, polymorphic malware, and social engineering at scale; defenders use AI for anomaly detection, automated response, and threat intelligence integration. The Nash equilibrium Nash equilibrium A situation in a game where no player can do better by changing strategy alone, given what the others do. It is stable, but not necessarily good for anyone. in this game involves mixed strategies Mixed strategy In game theory, choosing between moves at random with set probabilities instead of always playing the same move, as a penalty taker varies the side they shoot to. where neither side can guarantee a dominant outcome — a dynamic that mirrors the broader governance challenge of regulating AI.

Governance Innovations

If traditional governance struggles, what alternatives are emerging? Several approaches attempt to close the mismatch by making regulation itself more adaptive.

Regulatory sandboxes Regulatory sandbox A supervised setting where firms can test new products under relaxed rules and close regulator oversight. — supervised settings where new systems are tested under relaxed rules — are the most widely adopted innovation. The UK’s Financial Conduct Authority pioneered them for fintech in 2016; by 2020 the World Bank counted 73 fintech sandboxes in 57 countries, and the EU AI Act provides for them. Regulators learn the technology hands-on; the weakness is the exit, since what a sandbox shows may not generalize and the route from sandbox to ordinary regulation is poorly defined.

Algorithmic impact assessments, modeled on environmental ones, require high-risk systems to be evaluated before deployment (Canada from 2019; the EU AI Act’s conformity assessments). The analogy fits: both target harms that are diffuse, delayed and hard to attribute — the signature of complex system dynamics.

Adaptive regulation borrows from software development: set principles, observe outcomes, adjust, repeat — regulation as an iterative process, as New Zealand, Singapore and the UK are trying. Systemic risk regulation, drawing on post-2008 financial crisis approaches, focuses on low-probability, high-impact events arising from interconnection and complexity — the EU AI Act’s GPAI systemic risk provisions reflect this thinking.

Polycentric governance — multiple overlapping centers of authority rather than a single hierarchy — builds on Elinor Ostrom’s Nobel Prize-winning work on commons governance. The current fragmented AI landscape, while appearing chaotic, may actually be a form of polycentric governance: imperfect and inconsistent, but potentially more resilient than any single global framework would be. The EU, US, China, UK, and dozens of other jurisdictions are running parallel regulatory experiments — a form of evolutionary selection pressure on governance approaches.

Laissez-faire activism is the name the economist David Colander and the consultant Roland Kupers gave to complexity-aware governance — an attempt to say not only how traditional regulation fails but what should replace it. They start by rejecting the usual framing of state versus market: the two, they argue, co-evolved over centuries, each shaping and constraining the other. From that follows a posture organized around the bottom-up / top-down axis — preferring order that emerges from the decentralized interaction of agents (bottom-up) to order imposed by mandate (top-down), because, as Module 2 showed, top-down interventions in a complex system reliably throw off side effects their designers never see. The state’s job, on this account, is to set and tend the framework within which society self-organizes — a midwife rather than a controller — intervening structurally rather than directively. It is a market-friendly position, offered here as one framework among several rather than as a conclusion; it earns its place as the most fully worked-out attempt to turn the complexity critique of governance into a program.

The framework also meets a sharp version of this module’s own pace problem. Setting the rules of the game and letting it play out assumes the rule-setter can at least define the framework faster than the framework is overtaken — and against frontier AI, where capability moves on quarterly cycles and even the firms cannot fully explain their systems, even framework-setting strains. Bottom-up order is not automatically benign either: the same self-organization that produced grassroots environmentalism also produces disinformation cascades. The honest reading is that the bottom-up/top-down axis is a better map of the available choices than the state-versus-market one it replaces, without telling you, in any given case, where on the axis to stand.

Agent-based modeling for policy design offers a direct bridge between complexity science and governance. ABM can simulate the effects of regulatory interventions — antitrust action, content moderation rules, data protection enforcement — before implementation, capturing the emergent effects and unintended consequences that traditional policy analysis misses. The challenge is bridging the gap between academic ABM research and practical policy design.

Before you run the simulator below, commit to two guesses: can any of the five policies keep public trust above 60 at year ten? And which single slider, at its maximum, kills regulatory arbitrage for every policy at once? Check the result cards, then re-run — the decade is noisy, and the occasional scandal dents any trajectory.

The trust answer is narrow. Trust drifts toward wherever harm reduction pushes it, minus a fifteen-point scandal now and then — rarer the more harm is actually reduced. Under weak or no regulation it erodes from its starting 50 into the high 20s; strict regulation at high enforcement roughly holds the line — the 40s, edging past 50 at maximum enforcement; only the outright ban, enforced near its maximum at moderate technology pace, typically ends the decade near or above 60. Harm reduction feeds trust; nothing else in this model does. The arbitrage answer is exact: Global Coordination at 100 pins it to zero for every policy, because firms can only flee regulation somewhere less regulated. And no policy dominates all five metrics — the trade-offs are the structure of the problem, not a failure of design.

Synthesis: Co-Evolution of Technology and Governance

Six dynamics define the relationship between digital technology and governance as it stands in 2026:

1. Concentration triggers regulation. Search, social media, e-commerce, cloud, and now AI all followed the same trajectory: rapid growth, market concentration, then political backlash. The cycle time has shortened from decades (Microsoft in the 1990s) to years (ChatGPT to AI regulation).

2. The Brussels Effect creates de facto global standards. The EU has established itself as the world’s technology regulator — not through market power but through regulatory gravity. But the US and China pursue fundamentally different approaches, and whether the global landscape will converge or permanently fragment remains open.

3. The pace gap is not closing. Legislation still takes years and capabilities still change within months. The realistic goal may not be “governance catches up” but “governance functions with permanent partial knowledge.”

4. Labor is the persistent fault line. From gig workers to AI-displaced knowledge workers, who gains from digital technology is the most politically charged question, and redistribution lags.

5. The privacy-convenience trade-off is hardening. Despite GDPR and growing awareness, people keep trading data for convenience; the gap between what they say and what they do looks structural, not a temporary lack of information.

6. Complex systems produce complex problems. Misinformation, bias, concentration, and safety risks are all emergent — the complexity mismatch again, now facing legal frameworks built on individual responsibility and linear causation.

The central insight is that the digital economy and politics are not separate systems that happen to interact. They are one tightly-coupled complex adaptive system, and understanding either in isolation is impossible. Governing technology requires the tools of complexity science — emergence Emergence Patterns of the whole that no single part intends or contains: a traffic jam from individual drivers, a price from individual trades. The whole behaves in ways you cannot read off the parts. , feedback loops, path dependence Path dependence When where a system ends up depends on the order of events along the way, not only on where it started. It is why the QWERTY keyboard layout persists long after its original reason disappeared. , adaptation, nonlinearity — not the linear cause-and-effect models that traditional policy assumes.

What complexity science offers and what governance practice uses remain far apart. The next module follows where these trajectories lead.