What Happened
AI Now Institute reported that its co-executive director Sarah Myers West joined a discussion about AI regulation. The available post links to an interview but does not summarize the speakers’ positions or identify a policy change [1]. It therefore cannot establish a new regulatory requirement, a consensus among safety organizations or a research finding.
Why It Matters to Businesses
Businesses need to distinguish three inputs to AI governance: regulation determines applicable legal duties; standards and frameworks help teams organize controls; and safety research identifies failure modes worth testing. They serve different purposes. A model evaluation may inform a deployment decision, but it does not by itself demonstrate legal compliance or make an application safe.
For organizations operating across markets, the practical question is which rules apply to each use case, who owns the resulting controls, and what evidence can be produced when an incident or audit occurs. The brief AI Now notice does not answer those questions [1].
Kimbodo Engineering Perspective
Governance works best when it is tied to decisions engineers already make: approving a use case, selecting a model, granting an agent access to tools, releasing a change and responding to an incident. NIST’s AI Risk Management Framework can provide a control structure; applicable law, including EU AI rules where relevant, needs separate legal assessment. Research and evaluations from organizations such as Stanford HAI, UK AISI, Center for AI Safety, Partnership on AI, Anthropic and OpenAI can inform test design, but their results should not be treated as certifications for a particular application.
How We Would Implement It
- Inventory use cases: record purpose, users, jurisdictions, data classes, model providers and actions the system can take.
- Set release gates: require an accountable owner, documented risk assessment and approval criteria proportionate to the use case.
- Test the complete application: evaluate task accuracy, harmful outputs, prompt injection, data leakage and tool misuse against representative workflows—not just the base model.
- Control runtime behavior: use least-privilege tool access, human approval for consequential actions, logging, monitoring and a rollback path.
- Retain evidence: version prompts, models, datasets, evaluations, exceptions and incident decisions so controls can be reviewed and repeated.
Risks, Costs and Security
The main trade-off is operational effort: evaluations must be maintained as models, data and workflows change, and human review can slow high-impact processes. Logging creates its own privacy and retention risks. Scope tests to material harms, restrict sensitive records, and assign owners to remediate failures. Do not describe a deployment as compliant or safe solely because it uses a named framework or a model provider’s safety features.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Cost & Governance practice, or Analyze My AI Costs.
