There is a characteristic pattern in how societies have responded to transformative technologies. First comes the technology, deployed at speed by those with the resources and motivation to move fast. Then come the consequences — some anticipated, many not. Then come the debates about those consequences, conducted in public forums and legislative chambers by people who are, understandably, working to understand a technology that is already embedded in the infrastructure of daily life. Finally — slowly, imperfectly, often decades after the fact — comes regulation.
We have lived through versions of this cycle with social media, with financial derivatives, with pharmaceutical approvals, and with the environmental consequences of industrial production. In each case, the gap between deployment and governance produced harms that regulation could document and partially address but could not undo. The consequences of systems already running are sticky. They embed in economic incentives, in legal precedents, in organisational cultures, and in the expectations of millions of people who have built their lives around the systems as they exist.
Artificial intelligence is moving through this cycle faster than any technology before it, with consequences that are broader and deeper than any previous technological transition. And we are, once again, reaching for regulation after deployment rather than building governance before it.
"By the time a regulation arrives, the system it governs is already embedded in infrastructure, economic incentives, and human behaviour. The work of governance is not reactive. It is anticipatory, relational, and slow in exactly the ways that AI development is not."
The EU AI Act, which entered into force in August 2024, is the most comprehensive AI regulatory framework yet produced by any major jurisdiction. It is the product of over three years of legislative process, multiple rounds of stakeholder consultation, and substantial technical expertise.1 It is a serious and important document. And it was drafted in response to AI systems that were already deployed, already producing consequences, and already generating the harms and concerns that motivated the regulation.
Large-scale transformer architectures first published — the technical foundation of modern generative AI systems
GPT-3 deployed; facial recognition systems in commercial production at scale; algorithmic hiring tools in widespread enterprise use
EU publishes draft AI Act proposal — the beginning of the legislative process
ChatGPT launches and reaches 100M users in two months; generative AI enters mainstream deployment across every sector
EU AI Act enters into force — with phased implementation extending to 2027
The timeline illustrates the structural problem. The regulatory process, conducted with appropriate diligence and democratic legitimacy, took seven years from initial proposal to force of law — with full implementation still years away. The technology it governs moved from research curiosity to global infrastructure in roughly the same period. Regulation arrived, as it always does, to govern a world that had already reorganised itself around the technology being regulated.
The distinction I want to draw is between governance and regulation. Regulation is a specific legal instrument — a set of rules backed by enforcement mechanisms and state authority. Governance is broader: it encompasses the values, structures, relationships, and practices that shape how a technology is developed, deployed, and experienced. Governance can exist without regulation. Regulation, if it is to be effective, must engage with the governance that already exists in the institutions it addresses.
The most important governance decisions about any AI system are not made in a regulatory consultation process. They are made in product meetings, in design reviews, in decisions about which training data to use and which populations to include in testing, in choices about what the system will and will not do and who it will and will not serve. By the time a regulator arrives to assess the system, these decisions have been made. They are baked in.
This is why governance must begin before regulation. Not because regulation is unimportant — it is essential — but because regulation acting alone, on systems already in production, cannot achieve what governance embedded in the development process can achieve. The goal is not to slow down AI development. It is to ensure that development happens with sufficient attention to what is being built, for whom, and at what cost to whom, that regulation becomes a confirmation of good practice rather than an attempt to remediate bad practice after the fact.
The question then is what governance before regulation looks like in practice. My work on the HOF-AIDE framework — Human Oversight Frameworks for Agentic AI in Enterprise Decision Systems — represents one attempt to answer this at the organisational level.2 But the principles generalise.
Pre-regulatory governance requires, first, that the people building AI systems accept responsibility for the consequences of those systems before those consequences are required by law. This is harder than it sounds. The incentive structures of technology development reward speed and capability over caution and accountability. Governance that runs against these incentives requires either strong internal culture — which some organisations have — or external pressure from customers, investors, or regulators that makes the cost of governance failure visible and material.
Second, it requires that the populations most affected by AI systems have meaningful input into their design before deployment rather than after. The history of technology development is a history of systems designed for some people that were then extended to others, with predictable consequences for those others. Diverse representation in the design process is not a soft commitment to inclusion. It is a technical requirement for building systems that work for everyone they are meant to serve.3
Third, it requires ongoing monitoring — not as a compliance exercise but as a genuine practice of learning. AI systems change as their contexts change. A model trained on data from one period may behave differently in another. A system that works well for one population may fail for another. Governance is not a state that is achieved and then maintained. It is a practice that must be sustained over the lifetime of the system it governs.4
"Governance is not a state that is achieved and then maintained. It is a practice that must be sustained over the lifetime of the system it governs."
Universities and research institutions have a specific and important role in pre-regulatory governance that I believe is currently underutilised. Academic research is one of the few institutions with both the independence to study AI systems critically and the technical capacity to understand what is actually happening inside them. The research base on AI harms, on algorithmic bias, on the gap between AI capability claims and AI real-world performance, exists almost entirely in academic literature — and reaches policymakers slowly, if at all.
The work of translating research evidence into governance practice — of sitting in the spaces between laboratory and legislature, between finding and framework — is not glamorous. It does not produce the publications that academic incentive structures reward most highly. But it is among the most consequential work that researchers in this field can do. I have tried to do some of it myself. I know how difficult it is. I also know that it is necessary.
The future of AI governance will be determined not in moments of crisis — though crises will occur — but in the daily decisions of researchers who choose to engage with practice, of practitioners who choose to engage with evidence, and of institutions that create the conditions for those conversations to happen with the seriousness and continuity they require.
Governance begins before regulation. Which means it begins now.