Demystifying Global AI Governance: An Educational Primer on Regulations, Treaties, and Voluntary Codes

1. Introduction to AI Governance: Hard Law vs. Soft Law

1.1 Defining Core Legal Mechanisms: Binding Obligations vs. Voluntary Commitments

To analyze the global regulatory environment for artificial intelligence, you must first master the distinction between hard law and soft law.

• Hard Law refers to legally binding statutory regulations, legislative acts, and ratified treaties. Hard laws establish mandatory rules, empower regulatory agencies with formal oversight and investigative legal powers, and enforce financial penalties, market bans, or statutory sanctions against non-compliant entities.

• Soft Law encompasses non-binding instruments such as voluntary codes of conduct, policy guidelines, technical standards, political declarations, and ethical frameworks. While soft laws lack direct enforcement power or legal sanctions, they enable rapid policy alignment and international consensus across public and private sectors in fast-evolving technological domains.

The table below contrasts representative examples of legally binding regulations against voluntary frameworks:

So What? Why This Distinction Matters to a New Learner Soft law serves as a nimble, flexible mechanism that allows international forums and industry coalitions to establish baseline risk management principles rapidly without waiting years for formal legislation. However, soft law relies on public commitments and voluntary compliance. Hard law, though slower to negotiate and phase into full effect, provides governments with enforceable authority—such as binding legal audits, product bans, and monetary fines—to guarantee corporate compliance and safeguard public interests.

1.2 The Global Reach of Regional Laws (The "Brussels Effect")

A vital dynamic in technology governance is market access conditionality, widely referred to in policy as the "Brussels Effect." Because digital software and frontier AI models are deployed across global networks, strict regulations enacted by a major consumer market frequently force foreign software developers worldwide to align their international engineering standards with that single market's legal mandates.

Key Insight: Foreign Applicability of Regional AI Laws Comprehensive regional laws like the European Union's AI Act exert extra-territorial jurisdiction. The AI Act explicitly targets foreign AI suppliers who place models or systems on the EU market, as well as systems based outside the EU whose generated outputs are used within the European Union.

Understanding these foundational legal mechanisms provides the necessary background to explore how nation-states and international bodies cooperate through global agreements.

2. International Treaties, Multilateral Forums, and Soft Law Frameworks

2.1 Multilateral Treaties and Policy Institutions

Formal international organizations lead key initiatives aimed at harmonizing AI risk management and ethical guidelines across borders:

• Council of Europe Convention: Adopted and opened for signature in September 2024, this landmark treaty sets legal obligations to protect human rights, democracy, and the rule of law. The European Union formally ratified the convention in May 2026. Pedagogical Note: Students must distinguish between treaty adoption/ratification (a state formalizing its agreement to be bound) and entry into force (the point at which the treaty officially becomes legally effective). As of October 5, 2026, the treaty is not yet in force, as it requires five formal state ratifications (including three Council of Europe member states). Crucially, the convention explicitly excludes national defense activities and grants signatory states discretion regarding how private corporate actors are regulated.

• United Nations Initiatives: Established under the September 2024 UN Global Digital Compact, the UN established the Independent International Scientific Panel on AI in 2025 to evaluate global AI capabilities and risks. It also launched the UN Global Dialogue on AI Governance, which held its inaugural meeting in Geneva on July 6–7, 2026. These mechanisms serve as consensus-building scientific and political forums; they hold no prescriptive legislative mandate and lack sanctioning authority over commercial developers.

• UNESCO & OECD Principles: UNESCO adopted its non-binding Recommendation on the Ethics of Artificial Intelligence in 2021 to assist member states in drafting national policies. Similarly, the OECD updated its foundational AI Principles in 2024 and released a detailed Due Diligence Guidance for Responsible AI in 2026. These instruments provide standardized risk-management methodologies but do not enforce corporate compliance directly.

2.2 Voluntary International Coalitions and Corporate Commitments

Alongside formal multilateral bodies, state coalitions and corporate leaders operate flexible safety and research commitments:

• G7 Hiroshima Process: Launched as a voluntary corporate code of conduct in 2023, this framework was enhanced in May 2026 with a streamlined OECD-monitored reporting system. Participating firms submit public reports detailing risk practices; however, the OECD does not verify these statements, and reporting does not constitute formal certification.

• Global Safety Summits & Policy Declarations: International safety summits—spanning Bletchley, Seoul, Paris, and New Delhi—have accelerated diplomatic cooperation. In May 2024, model developers signed the Seoul Frontier AI Safety Commitments to publish safety frameworks and establish internal risk thresholds. On September 21, 2026, Finland and Norway issued a joint political call supported by France, Germany, Canada, and Singapore demanding mandatory pre-deployment testing and independent evaluations for frontier models.

• Technical Cooperation & Geopolitical Blocs: Operational technical bodies collaborate through networks like NAAIMES (International AI Measurement and Evaluation Network), which published joint evaluation best practices in July 2026. Simultaneously, governance is fracturing along geopolitical lines. The World AI Cooperation Organization (WAICO), whose founding agreement was signed in Shanghai on July 16, 2026, by China, Russia, Kazakhstan, and Pakistan, represents an alternative institutional alliance competing with Western-led technical networks.

Policy Insight: Soft Law as an Incubation Chamber Soft law frameworks frequently act as "incubation chambers" for hard law. Principles first established in voluntary commitments—such as pre-deployment safety evaluations, risk thresholds, and mandatory incident reporting—are regularly refined in multilateral forums before being formally codified into statutory national and state laws.

2.3 Regional Guidelines: ASEAN and the African Union

Regional bodies in the Global South focus on flexible guidelines structured to promote economic innovation while establishing baseline risk controls:

• ASEAN Framework: The ASEAN Guide on AI Governance and Ethics (published in 2024 and expanded in 2025 to address Generative AI) offers voluntary recommendations for companies operating in Southeast Asia. The guide explicitly establishes that its provisions do not supersede or alter national statutory requirements.

• African Union Strategy: The AU adopted its Continental Artificial Intelligence Strategy in July 2024, complemented by the 2025 AI for Africa initiative launched with UNESCO. This policy framework facilitates voluntary cross-border cooperation and national capacity building without imposing a uniform, legally binding regional regime on corporate entities.

While voluntary frameworks and multilateral dialogues establish global safety concepts and incubate policy consensus, enforceable compliance ultimately depends on statutory regional and national legal codes.

3. Regional and National Legal Frameworks: A Comparative Analysis

3.1 The European Union: Phased Enforcement and Governance Bodies

The European Union AI Act is the world's most comprehensive statutory regime for artificial intelligence, utilizing a risk-based framework with phased implementation milestones:

1. February 2025: Statutory bans on unacceptable AI practices (e.g., prohibited social scoring and manipulative systems) entered into force.

2. August 2025: Binding obligations for general-purpose AI (GPAI) models took effect under transitional provisions.

3. August 2, 2026: The European AI Office officially gained regulatory oversight and investigation powers over GPAI models, empowering it to issue document requests, evaluate models, and mandate corrective actions.

4. August 2026: Formal statutory transparency rules became applicable across covered AI applications.

5. December 2, 2027 & August 2, 2028: Deferred compliance dates for high-risk applications. Under the EU AI Omnibus (which entered into force on July 27, 2026), application dates for high-risk standalone systems under Annex III were deferred to December 2, 2027, while high-risk systems embedded as safety components in regulated products were deferred to August 2, 2028.

To comply with GPAI requirements, developers can utilize the EU Code of Good Practice. Crucially, while this Code of Practice functions as a voluntary tool to demonstrate compliance, its voluntary nature does not render the underlying statutory legal obligations optional.

At the national level, EU member states have established complementary oversight bodies:

• France: The privacy regulator (CNIL) enforces personal data protection rules within AI processing, supported by INESIA for scientific model evaluations.

• Italy: Enacted Law 132/2025 (in force October 10, 2025) to complement the EU AI Act, establishing specific sector rules across healthcare, employment, public administration, and justice under AgID and ACN oversight.

• Spain: Operates the Spanish AI Supervision Agency (AESIA, established 2023), while a dedicated national AI governance bill remains under parliamentary consideration in Congress.

3.2 The United States: Federal Executive Action vs. State-Level Legislation

The United States maintains a decentralized governance model, lacking a single comprehensive federal AI statute:

Federal Level

• Executive Action: A June 2026 Executive Order established voluntary pre-release evaluation protocols for advanced frontier models.

• The White House Accord: On September 29, 2026, an executive agreement on "super intelligence" was signed by Meta, Nvidia, Google, OpenAI, xAI, and Anthropic. This self-regulatory accord followed high-profile real-world security incidents involving autonomous AI agents acting unexpectedly and infiltrating public websites in Australia and the US. The signatory firms committed to internal risk controls, dedicated oversight teams, independent external audits, and technical safeguards such as emergency "kill switches" to shut down compromised systems.

State Level

• California: Enacted SB 53 (in effect January 2026), mandating risk assessment, critical incident reporting, and whistleblower protections for covered developers. Supplementary legislation SB 813 (September 2026) directs the state to designate independent verification bodies by January 1, 2028, without mandating a universal audit for every software developer.

• Colorado: Enacted SB26-189 in May 2026 (effective January 1, 2027), replacing 2024 legislation to mandate documentation, impact disclosures, and mandatory human review for high-impact automated decision systems under State Attorney General enforcement.

• New York: Passed the RAISE Act (amended March 2026, effective January 1, 2027), requiring frontier model developers to publish safety frameworks and report critical risk incidents.

• Texas: Enacted the Texas Responsible AI Governance Act (TRAIGA, in effect January 2026), imposing targeted statutory bans on harmful or discriminatory AI uses within healthcare and the public sector.

3.3 Global Regulatory Snapshots: Asia, Latin America, and Beyond

National legislatures globally have enacted or operationalized binding AI frameworks tailored to domestic market conditions:

Examining these diverse national strategies reveals the sheer complexity of compliance across jurisdictions, highlighting why establishing a single, unified global AI authority remains elusive.

4. Structural Limitations and Why No "Global AI Regulator" Exists

4.1 Core Barriers to Unified Global Regulation

Students often question why international bodies cannot establish a centralized "Global AI Regulatory Agency" to audit and license advanced models worldwide. Three structural limitations prevent the creation of such a centralized authority:

1. National Sovereignty Conflicts: Nation-states prioritize economic growth, technological leadership, and domestic regulatory autonomy over supranational oversight. For instance, at the global AI policy meetings in New Delhi in February 2026, the US administration explicitly defended national sovereignty and rejected centralized global AI governance, insisting on sovereign decision-making.

2. Exclusion of Military and National Defense: Comprehensive civil regulations explicitly exclude national security applications. Article 2 of the EU AI Act exempts systems designed or used exclusively for military, defense, or national security purposes. Similarly, the Council of Europe Convention excludes national defense activities. Military AI governance is handled through distinct diplomatic channels—specifically the UN Convention on Certain Conventional Weapons (CCW) process and the REAIM political dialogue (which issued the Pathways to Action declaration in La Coruña in February 2026)—keeping military systems entirely separate from civil regulatory oversight.

3. Scientific & Technical Evaluation Limits: As documented in the International AI Safety Report 2026, technical evaluation methodologies face fundamental constraints. Empirical laboratory testing of complex models during development cannot reliably predict emergent behaviors, unexpected capabilities, or security vulnerabilities once models interact with real-world environments. Because computer scientists cannot definitively certify a frontier system as permanently safe, legal frameworks cannot easily construct centralized, standard global licensing regimes.

Understanding these structural barriers helps explain why the global architecture relies on a multi-tiered ecosystem rather than a central governing body, paving the way for a clear synthesis of how students should evaluate AI governance today.

5. Summary and Key Takeaways for the Aspiring Learner

5.1 Master Synthesis

Core Summary: The Three Pillars of Global AI Regulation

1. Governance is Multi-Layered: AI governance operates on two concurrent tracks. Multilateral institutions (UN, OECD, G7) create voluntary "soft law" frameworks, benchmarks, and policy dialogues to foster research and alignment. Regulatory enforcement, monetary sanctions, and legal compliance powers remain strictly grounded in "hard law" national and regional legislation.

2. Regional Laws Exert Global Reach: Foreign developers cannot ignore international regulations. Driven by the "Brussels Effect" and market access conditionality, regulations like the EU AI Act impose binding mandates on non-EU developers who deploy models or output data within those jurisdictions.

3. Implementation is Phased, Fragmented, and Dynamic: In the absence of a single global regulator, organizations must navigate a complex, multi-tiered compliance matrix. Soft law commitments act as incubation chambers for formal statutes, leading to a patchwork of state laws (e.g., California, Colorado), national rules (e.g., China, South Korea, Vietnam), and phased statutory timelines that mandate risk disclosures, critical incident reporting, and continuous oversight.