The history of artificial intelligence governance is usually told through visible episodes: a breakthrough model, a ministerial summit, a landmark statute, a courtroom challenge. That account captures the headlines but misses the machinery. By mid-2026, the more revealing timeline runs through meeting rooms of standards bodies, national institutes, regulators, procurement offices and accreditation agencies. There, the language of abstract values has been translated into risk taxonomies, documentation duties, red-teaming protocols, quality management systems and conformity assessment procedures.
This may sound pedestrian. It is not. Standards are where political compromise becomes operational reality. They decide what counts as a safety test, which evidence is sufficient to show robustness, how bias is measured, when human oversight is considered meaningful, and whether a foundation model developer or downstream deployer carries the practical burden of proof. In technology policy, statutes announce intent; standards decide implementation.
The surprise is that this struggle did not begin with generative AI. It emerged from older disputes over product safety, privacy engineering, cybersecurity certification and management systems. AI inherited those institutional pathways. The result is an invisible constitution: not a single global rulebook, but an interlocking set of protocols and standards that increasingly determine market access, liability exposure and administrative legitimacy.
2016-2018: Before AI standards, there was the compliance state
The modern argument over AI standards was prepared by developments that were not initially about AI at all. In Europe, the General Data Protection Regulation reshaped the relationship between digital firms and public authority by insisting on demonstrable accountability, record-keeping and risk-sensitive obligations. Around the same period, cybersecurity moved towards more explicit baseline controls, incident reporting expectations and assurance frameworks. Across sectors, regulators learned that broad legal duties mean little without repeatable methods for inspection and evidence.
This was the first important shift. Policymakers stopped assuming that innovation could be governed mainly through ex post enforcement. Instead, they became interested in ex ante process: design controls, documentation, traceability and auditable governance. AI would later inherit this administrative grammar almost wholesale.
Even then, two camps were visible. One argued that AI was too fluid for hard requirements and should be guided by principles. The other maintained that principles without testable procedures would become symbolic. The second camp did not win immediately, but it set the eventual direction of travel.
2019: Principles proliferate, but implementation remains thin
By 2019, the OECD’s Recommendation on AI and a wider wave of ethical frameworks had created a common diplomatic vocabulary: fairness, transparency, accountability, robustness, human-centred values. UNESCO would later reinforce that normative layer. These texts mattered because they aligned governments around shared ambitions and made AI governance an international policy domain rather than a niche academic concern.
Yet they also exposed a structural weakness. Terms such as fairness and transparency travelled well politically, but poorly technically. Different disciplines meant different things by them. A labour economist, a machine-learning engineer, a procurement officer and an anti-discrimination lawyer could all endorse the same principle while imagining incompatible implementation.
The centre of gravity in AI governance has shifted from ethics principles to test methods, documentation and auditability.
This gap created demand for standards work. If governments were serious about translating high-level commitments into procurement clauses, supervisory guidance or certification pathways, they needed common definitions and methods. The ethics era therefore produced its own successor: the assurance era.
2020-2021: Risk management becomes the lingua franca
In technology policy, statutes announce intent; standards decide implementation.
The next stage was less philosophical and more bureaucratic. Institutions began to reframe AI governance through risk management. This was not accidental. Risk management offered a portable logic that could connect boards, engineers, auditors and regulators. It could also accommodate uncertainty. Rather than claiming that AI systems could be declared universally safe or fair, organisations could be required to identify hazards, document trade-offs, test controls and monitor performance over time.
That shift aligned AI with familiar patterns from finance, aviation, healthcare devices and information security. It also suited a world in which AI systems were rarely static products. Models changed through updates, fine-tuning, new data, new contexts and altered user behaviour. Governance therefore had to be iterative rather than one-off.
By this point, standards bodies were becoming more central. ISO and IEC work on AI management systems and risk management began to offer an organisational architecture for compliance. The significance was subtle but profound. AI governance was moving away from purely model-centric debates towards system-level and institution-level controls: who owns the risk, who signs off changes, how incidents are recorded, how claims are evidenced, how suppliers are vetted.
2022: The foundation model shock changes the scope of the problem
The release and rapid uptake of large generative models disrupted existing assumptions. Earlier policy designs had often imagined relatively bounded use cases: credit scoring, biometric identification, hiring tools, medical support systems. Foundation models complicated that picture because capability and risk could not be cleanly inferred from a single downstream purpose. Generality, scale and repurposability became regulatory variables in their own right.
This changed standards debates in three ways. First, testing could no longer focus only on a narrow intended use. Evaluators needed methods for emergent behaviour, misuse potential and performance variation across contexts. Secondly, documentation had to stretch across a supply chain. The model developer, the fine-tuner, the application provider and the enterprise deployer each possessed only part of the relevant evidence. Thirdly, incident management became more difficult because harms could be diffuse, distributed and delayed.
Generative AI also expanded the constituency for standards. Procurement teams wanted controls before buying tools. Insurers wanted signs of mature governance. Labour regulators, competition authorities and consumer protection agencies all recognised that they would need technical reference points. The result was a scramble not just for rules, but for measurable proxies.
2023: Voluntary frameworks gain strategic importance
In the United States, where comprehensive AI legislation remained politically uncertain, NIST’s AI Risk Management Framework became disproportionately influential. It did not carry the force of law, but it supplied something many organisations needed immediately: a credible and structured vocabulary for identifying, mapping, measuring and managing AI risk. The White House Blueprint for an AI Bill of Rights, while not itself binding, similarly helped consolidate expectations around automated systems in public discussion and procurement thinking.
The lesson of 2023 was that voluntary frameworks can shape markets long before statutes bite. Boards and legal teams do not wait patiently for definitive legislation if procurement contracts, investor due diligence and public-sector tendering already ask for evidence of governance. In practice, soft-law instruments often become quasi-mandatory when they are embedded in commercial process.
This was also the year in which Europe’s regulatory strategy became clearer. The emerging AI Act was not simply another digital law. It was a framework law that depended on a vast downstream apparatus of harmonised standards, implementing acts, notified bodies and guidance. In effect, legislators were writing the outer shell while leaving crucial technical content to later institutional processes.
2024: The EU AI Act formalises the standards economy
When the AI Act was adopted, much attention focused on prohibited uses, high-risk categories and obligations for general-purpose AI models. Those debates were important, but the deeper significance lay elsewhere. The Act entrenched the European habit of governing complex technologies through a combination of legislation and standardisation. That model has a long pedigree in product regulation: lawmakers define essential requirements, while technical standards operationalise compliance.
For AI, this approach created both an opportunity and a struggle. The opportunity was coherence. Firms would not need to guess endlessly what concepts such as accuracy, robustness, logging or human oversight meant if recognised standards and guidance could specify expectations. The struggle was power. Stakeholders now had a strong incentive to influence the standards process because those documents would shape the real burden of compliance.
The centre of gravity in AI governance has shifted from ethics principles to test methods, documentation and auditability.
Who writes the checklists often matters as much as who writes the law.
European institutions understood this. The discussion moved rapidly towards mandates to standards organisations, the role of the Joint Research Centre, and the practical challenge of ensuring that harmonised standards reflected public-interest objectives rather than only incumbent preferences. For critics, there was a risk that technical standardisation might depoliticise choices that were still inherently social. For defenders, standards were the only plausible way to make governance administrable at scale.
2024-2025: Assurance becomes a market function as well as a public one
Once regulation and procurement began asking for evidence, a wider assurance ecosystem started to thicken. Internal audit teams, external assessors, testing labs, legal advisers, standards consultants and certification bodies all found a new role in AI governance. This was not merely professional opportunism. It reflected the reality that most large organisations lack the internal capacity to design rigorous testing programmes, maintain traceability across model supply chains and interpret rapidly changing obligations across jurisdictions.
Still, the expansion of the assurance economy introduced its own hazards. A checklist culture can create compliance theatre: polished documentation masking weak control. A certification stamp can be mistaken for proof of social legitimacy when it may only indicate process maturity. And smaller firms may face a disproportionate burden if complex assurance demands favour organisations with large legal and governance teams.
These tensions were visible in debates over management-system standards such as ISO/IEC 42001 and risk guidance such as ISO/IEC 23894. Supporters viewed them as practical scaffolding for organisational discipline. Critics worried that management systems assess whether an organisation has processes, not whether those processes reliably prevent harm. Both arguments are correct. Process standards matter because governance without process is performative; they are insufficient because process alone does not answer substantive questions about safety, discrimination or democratic legitimacy.
2025: Safety science enters the standards conversation
The publication of international safety assessments and the continuation of intergovernmental work on frontier AI shifted the debate again. Standards discussions could no longer be confined to documentation norms and governance procedures. They now had to engage with the limits of measurement itself. How should one evaluate model autonomy, dangerous capability elicitation, deceptive behaviour, or misuse in domains where ground truth is unstable and benchmarking can quickly be gamed?
This is where AI governance began to resemble other domains of strategic uncertainty. In mature sectors, standards often assume a settled science of testing. In advanced AI, the science of evaluation remains contested and fast-moving. That means standards writers are attempting to codify methods even as those methods are being invented. The result is unusual institutional fluidity. Regulators need stable criteria; researchers keep showing why apparently stable criteria can fail.
Consequently, a two-track model has emerged. On one track sit relatively stable organisational requirements: governance structures, record-keeping, incident response, supplier management, post-deployment monitoring. On the other sit more adaptive technical evaluation regimes that must be revised as capabilities change. The friction between these tracks will define the next phase of policy.
2025-2026: Interoperability, not uniformity, becomes the realistic goal
By mid-2026, it is evident that the world is not converging on a single AI rulebook. Europe continues to build a formal regulatory architecture. The United States relies more heavily on sectoral enforcement, procurement pressure, NIST-led frameworks and state-level initiatives. International organisations provide common principles and vocabulary, but not a universal supervisory regime. The question, then, is not whether one model will prevail globally. It is whether different systems can become interoperable enough to reduce fragmentation without erasing political difference.
Interoperability has several dimensions. A technical dimension concerns whether documentation, testing artefacts and incident reports can travel across borders and supply chains. A legal dimension concerns whether evidence generated for one regime is recognisable in another. An institutional dimension concerns whether regulators and accredited assessors trust one another’s methods. None of this is glamorous, but all of it matters for how global AI markets function.
Who writes the checklists often matters as much as who writes the law.
The temptation is to describe this as a race between blocs. That is incomplete. There is also a race between governance styles. One style privileges bright-line obligations and formal conformity assessment. Another favours flexible frameworks and iterative enforcement. In practice, organisations operating internationally will increasingly have to satisfy both: European-style demonstrability and American-style adaptive risk management.
An unexpected fault line: open technical methods versus closed compliance infrastructures
The least discussed divide in the standards world is not between Washington and Brussels, or between safety and innovation. It is between openness and enclosure. Some of the most consequential elements of AI governance depend on publicly understandable methods: benchmark design, taxonomy development, documentation templates, transparency reporting and incident disclosure patterns. If these remain visible and contestable, standards can evolve through scrutiny. If they harden into opaque proprietary compliance infrastructures, oversight risks becoming dependent on private gatekeepers.
This matters because standards are never neutral. They privilege certain forms of expertise, organisational scale and evidentiary practice. A highly elaborate audit requirement may appear rigorous while effectively excluding smaller entrants. A narrow benchmark may simplify oversight while overlooking harms experienced by minorities or by users outside wealthy markets. The governance question is therefore not only whether standards exist, but whose realities they encode.
Here, older lessons from privacy and cybersecurity are instructive. Public trust is not built simply by multiplying controls. It depends on whether controls are intelligible, challengeable and linked to actual outcomes. AI governance will fail if standards become a secluded technical priesthood disconnected from those affected by automated decisions and generative systems.
What the timeline reveals about power
Viewed in sequence, the past decade suggests that AI governance has become a contest over translation. Legislators translate political anxieties into legal obligations. Standards bodies translate legal obligations into technical procedures. Auditors and procurement officers translate procedures into institutional incentives. Developers then translate those incentives back into product design, release practices and organisational structure.
Power accumulates at each translation point. That is why standards and protocols deserve more attention than they usually receive. They are not ancillary to governance; they are its delivery mechanism. A prohibition that cannot be tested is brittle. A transparency duty without documentation norms is vague. A safety promise without incident taxonomies and evaluation methods is public relations.
The invisible constitution of AI is therefore being written in annexes, risk frameworks, management-system clauses and conformity guidance. It is less dramatic than summit diplomacy and less legible than parliamentary debate. But it may prove more durable because it embeds itself in routine administration: purchasing, certification, logging, reporting, quality assurance and supervisory review.
The next phase
The next challenge is not simply to produce more standards. It is to ensure that standards remain empirically grounded, internationally intelligible and politically accountable. As models become more capable and more embedded in public and economic life, static compliance documents will age quickly. Governance systems will need mechanisms for rapid revision without sacrificing legitimacy.
Expect three pressures to intensify. First, a demand for better evidence that process compliance correlates with real-world safety and fairness outcomes. Secondly, growing negotiation over mutual recognition and cross-border conformity, especially for firms operating across Europe, North America and Asia. Thirdly, sharper scrutiny of who participates in standard-setting and whether public-interest actors can match the influence of well-resourced incumbents.
The broad direction, however, is already clear. The age of aspirational AI ethics has not disappeared, but it has been subordinated to an age of implementation. What matters now is less the proclamation of values than the architecture of verification. The future of AI governance will be decided not only in legislatures and laboratories, but in the quieter places where criteria are fixed, evidence is standardised and compliance is made legible.
That is why the standards story, though easy to overlook, is the more consequential one. It tells us how power is organised after the speeches end.
