For Policymakers: Governance Lag in the Agent Era

You are regulating against a moving target that moves faster than you can regulate.

AI capabilities are advancing on the scale of months. Policy processes operate on the scale of years. This mismatch—governance lag—is not new, but AI makes it acute.

Agency multiplication means single actors can deploy autonomous systems at scale. Traditional regulatory approaches assumed humans in the loop. That assumption is breaking.

This is not a technology primer. It is a governance orientation.

The Core Problem

Governance lag occurs when:

1. Technology capability advances
2. Harms or risks from that capability emerge
3. Society recognizes the harms
4. Political will forms to address them
5. Policy is drafted, debated, and passed
6. Agencies develop implementation rules
7. Enforcement mechanisms are established
8. ...and by then, technology has advanced further

In slow-moving technology domains, this lag is tolerable. In fast-moving domains, you are always regulating the previous generation of problems while new ones emerge.

AI is the fastest-moving domain governance has ever faced.

AI capabilities are improving faster than any previous technology:

What Makes AI Different

Speed of Change

AI capabilities are improving faster than any previous technology:

• Foundation models improve with each generation (annually or faster)
• Open-source proliferation happens in months after major advances
• Cost of capability drops rapidly (what required millions now requires thousands)

By the time you understand the current generation, the next generation is deployed.

Dual-Use Nature

AI is general-purpose. You cannot regulate "AI" like you regulate pharmaceuticals or nuclear materials. The same technology that threatens can also cure.

Tight restrictions on AI development may:

• Slow beneficial applications
• Push development to less regulated jurisdictions
• Advantage adversaries who do not restrict

This is not an argument against regulation. It is an argument for precision.

Distributed Development

Nuclear weapons require nation-state resources. Bioweapons require specialized facilities. AI capability is increasingly available to individuals with consumer hardware.

You cannot control AI by controlling a small number of actors. The proliferation has already happened.

Agent Autonomy

Autonomous agents act without per-action human oversight. When a human is in the loop for every action, you can assign responsibility. When thousands of agents act autonomously, responsibility diffuses.

Current liability frameworks assume identifiable human decisions. Agent systems challenge that assumption.

What Traditional Approaches Miss

Input-Based Regulation

Regulating the inputs to AI (compute, data, training) is technically feasible but has limits:

• Compute thresholds: The current approach (regulating models above certain compute thresholds) is already being gamed. Capabilities that once required large compute are being achieved with less.
• Data regulation: Useful for some purposes, but training data is not the only determinant of capability.
• Export controls: Partially effective for hardware, but software and weights are harder to control.

Input regulation buys time. It does not solve the problem.

Output-Based Regulation

Regulating what AI systems produce or do has different limits:

• Defining harms: Hard to specify in advance what outputs are harmful. "Misinformation" is not a bright line.
• Attribution: Determining whether an output came from AI or humans is increasingly difficult.
• Jurisdiction: AI systems can operate from anywhere. Outputs can flow across borders.
• Enforcement: How do you monitor and enforce at the scale AI operates?

Output regulation is necessary but insufficient.

Sector-Specific Approaches

Regulating AI in specific sectors (healthcare, finance, transportation) leverages existing frameworks. This is useful but:

• General-purpose AI does not fit neatly into sectors
• Sector regulators may lack AI expertise
• Coordination across sectors is weak
• Novel uses emerge that do not fit existing categories

Sector-specific regulation is valuable but incomplete.

What Might Actually Work

1. Adaptive Regulation

Static rules cannot keep pace with dynamic technology. Consider:

• Regulatory sandboxes: Controlled environments for testing AI applications before broad deployment
• Sunset provisions: Rules that automatically expire and must be renewed, forcing regular review
• Trigger mechanisms: Regulations that activate when certain capability or harm thresholds are crossed
• Delegated authority: Giving agencies broader mandates to adapt rules as technology evolves

The tradeoff is democratic accountability. Delegated authority is faster but less subject to direct political oversight.

2. Liability Frameworks for Agents

Agent systems need clear liability assignment:

• Deployer liability: Those who deploy agents bear responsibility for their actions
• Strict liability for certain domains: In high-risk areas, liability regardless of negligence
• Disclosure requirements: Agents must identify themselves in certain interactions
• Audit trails: Agent actions must be traceable

The goal is to create incentives for safe deployment without prohibiting deployment entirely.

3. Institutional Capacity Building

Governance institutions need AI-specific capability:

• Technical expertise in regulatory agencies: You cannot regulate what you do not understand
• Interagency coordination mechanisms: AI crosses traditional regulatory boundaries
• International cooperation forums: Unilateral regulation is limited in a global technology
• Early warning systems: Mechanisms to detect emerging harms before they become crises

This is investment, not regulation. But regulation without institutional capacity is hollow.

4. Standards and Certification

Voluntary or mandatory standards can shape behavior:

• Safety standards: For development and deployment practices
• Transparency standards: For disclosure of capabilities and limitations
• Auditing standards: For third-party evaluation of systems
• Certification regimes: For high-stakes applications

Standards can move faster than legislation. Industry participation is essential for practicality.

5. Strategic Prioritization

You cannot regulate everything. Prioritize:

• Existential risks: Misaligned superintelligence, if it emerges, is the highest-stakes domain
• Democratic integrity: AI threats to elections, public discourse, and institutional trust
• Critical infrastructure: AI in energy, finance, transportation, healthcare
• National security: AI in defense, intelligence, and geopolitical competition

General-purpose AI regulation may be less tractable than these focused domains.

The International Dimension

AI governance is fundamentally international:

• Development happens globally
• Deployment crosses borders
• Race dynamics create pressure against regulation
• No single nation can govern global technology

Realistic international approaches:

• Bilateral coordination: Start with key relationships (US-China, US-EU)
• Plurilateral clubs: Groups of aligned nations with shared standards
• Information sharing: Early warning and incident reporting across borders
• Mutual recognition: Accepting other jurisdictions' certifications

Full international consensus is unlikely near-term. Partial coordination is achievable.

Fast governance responses may miss important considerations. Deliberative processes may arrive too late.

The Uncomfortable Tradeoffs

Speed vs. Deliberation

Fast governance responses may miss important considerations. Deliberative processes may arrive too late.

There is no right answer. You must choose which errors to risk.

Innovation vs. Safety

Tight regulation may slow beneficial AI development. Light regulation may allow harmful development.

The optimum is unknowable. You must decide what you are willing to risk.

National Interest vs. Global Welfare

Strong national AI may disadvantage other nations. Coordinated restraint may disadvantage your nation if others do not follow.

This is the classic international cooperation problem. AI does not solve it.

Certainty vs. Adaptability

Clear, predictable rules help industry plan. Adaptive approaches create uncertainty.

Some uncertainty may be necessary in fast-moving domains. But too much uncertainty paralyzes.

What to Do This Term

1. Build institutional expertise. If your agency lacks AI technical capacity, you cannot govern effectively. Invest in expertise.

2. Focus on high-stakes domains first. General-purpose AI regulation is hard. Sector-specific regulation in critical areas is more tractable.

3. Create liability clarity for agents. Autonomous systems need clear accountability assignment. This enables rather than restricts deployment.

4. Establish coordination mechanisms. Interagency, international, and public-private. AI governance cannot be siloed.

5. Plan for adaptation. Whatever you pass today will need revision. Build in review mechanisms.

The Meta-Point

The deepest challenge is not specific policies. It is the mismatch between the pace of AI and the pace of governance.

You will not solve this mismatch. You will manage it.

Managing it means:

• Accepting imperfection
• Building adaptability into governance structures
• Investing in institutional capacity
• Prioritizing ruthlessly
• Acting despite uncertainty

The alternative—waiting until you fully understand the technology—means never acting.

Governance lag is the condition. Adaptive governance is the response.

---

This is a translational piece connecting speculative mechanics to practitioner needs. For the underlying mechanics, see Agency Multiplication and Control & Governance. For related analysis, see The Governance Fork.