For years, AI development was governed mostly by voluntary principles. That era is ending. Governments are adopting binding rules, standards bodies are publishing management frameworks, and organisations — including humanitarian and development agencies — are creating internal AI governance. As an AI professional, you need a working knowledge of this landscape: it shapes what you may build, how you must document it, and how you must monitor it.
(This lecture summarises the landscape for educational purposes; it is not legal advice, and regulations evolve — always check the current text and seek legal counsel for specific cases.)
The EU AI Act#
Adopted in 2024, the EU Artificial Intelligence Act is the first comprehensive horizontal AI law. It applies to providers and deployers of AI systems placed on the EU market or whose outputs are used in the EU, with obligations phased in over several years. It follows a risk-based approach:
| Risk level | Examples | Obligations |
|---|---|---|
| Unacceptable (prohibited) | Social scoring by public authorities; manipulative techniques exploiting vulnerabilities; untargeted scraping of facial images to build recognition databases; emotion recognition in workplaces and schools (with exceptions); most real-time remote biometric identification in public spaces for law enforcement (narrow exceptions) | Banned |
| High risk | AI in critical infrastructure, education (e.g. exam scoring), employment (CV screening), access to essential services and benefits, credit scoring, law enforcement, migration, asylum and border control, administration of justice, certain medical devices | Risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy/robustness/cybersecurity, conformity assessment, registration, post-market monitoring |
| Limited risk / transparency | Chatbots, deepfakes and AI-generated content | Disclose AI interaction; label synthetic content |
| Minimal risk | Spam filters, AI in video games | No specific obligations (voluntary codes) |
General-purpose AI (GPAI) models — such as large language models — have their own obligations: technical documentation, information for downstream providers, a copyright policy and a summary of training content; models with systemic risk (very high training compute) face additional duties including evaluations, adversarial testing, incident reporting and cybersecurity.
Note that migration, asylum and border control, and access to public assistance, are explicitly listed high-risk areas — directly relevant to humanitarian and public-service contexts.
Data protection law#
Many AI systems process personal data, so data-protection law applies regardless of AI-specific rules:
- GDPR (EU) principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.
- Special categories (health, biometrics, ethnicity, religion…) require stronger protection.
- Automated decision-making (Article 22): individuals have rights regarding decisions based solely on automated processing that significantly affect them, including human intervention and contesting the decision.
- Data Protection Impact Assessments for high-risk processing.
Many countries have comparable laws (e.g. Brazil's LGPD, India's Digital Personal Data Protection Act 2023, and data-protection legislation developing in Bangladesh and elsewhere). International organisations often have their own data-protection policies and frameworks.
Other frameworks around the world#
- OECD AI Principles (2019, updated 2024) — adopted by many countries.
- UNESCO Recommendation on the Ethics of AI (2021) — adopted by all UNESCO member states; emphasises human rights, inclusion and environmental sustainability.
- United States: sector-specific rules and agency guidance, the NIST AI Risk Management Framework (voluntary: Govern, Map, Measure, Manage), and state-level laws.
- China: regulations on recommendation algorithms, deep synthesis (deepfakes) and generative AI services.
- Council of Europe Framework Convention on AI and Human Rights (2024) — the first international treaty on AI.
- International standards: ISO/IEC 42001 (AI management systems), ISO/IEC 23894 (AI risk management).
Building AI governance in an organisation#
Regulation sets the floor; good governance builds on it:
- Inventory: know which AI systems you develop, buy and use.
- Risk classification: identify high-impact systems (those affecting rights, safety, access to services).
- Policies and roles: who approves, owns, monitors and can shut down each system.
- Impact assessments: algorithmic/AI impact assessments covering human rights, fairness, privacy and security, with stakeholder input.
- Documentation: datasheets, model cards, system cards, decision logs.
- Human oversight: meaningful review with authority and competence, not rubber-stamping.
- Procurement standards: require documentation, testing evidence and audit rights from vendors.
- Incident management: report, investigate and learn from failures.
- Training: AI literacy for staff (the EU AI Act includes AI-literacy obligations for providers and deployers).