Frontier AI, global governance and building a compliance program

The final lesson looks at the frontier and at the whole. At the frontier, the most capable AI models raise governance questions beyond those of ordinary AI applications: potential misuse for weapons and cyberattacks, loss of control, concentration of power, and geopolitical competition over chips and compute. Governments have responded with frontier-specific transparency laws, safety institutes, export controls and international cooperation. At the level of the whole, organizations operating across jurisdictions must turn the many laws and standards covered in this course into one coherent compliance program that can adapt as rules change. This lesson covers frontier AI governance, compute and export controls, international coordination, debates that will shape future law, how to build and maintain a cross-jurisdictional compliance program, and a capstone project.

Frontier AI governance

Frontier models are the most capable general-purpose AI models, trained with very large amounts of compute. Their governance combines several instruments, discussed in AI-430:

• Developer safety frameworks: published policies linking dangerous capability thresholds to required safeguards.
• Transparency and incident reporting laws: California's SB 53 (in force since January 2026) and New York's RAISE Act (from 2027) require large frontier developers to publish safety frameworks and report critical safety incidents; the EU AI Act imposes systemic-risk obligations on general-purpose models above 10^25 FLOPs.
• Government evaluation: AI safety and security institutes in Canada, the United States, the United Kingdom and elsewhere test models, often before release, under voluntary agreements.
• Compute thresholds: rules triggered by training compute, combined with capability evaluations.

Frontier governance is distinctive because the risks are uncertain, potentially severe and cross-border, because a few companies control the most capable systems, and because governments see frontier AI as strategically important. This makes it an area of rapid policy change and intense debate.

Compute, chips and export controls

Advanced AI depends on specialized chips, mostly designed by a few companies and manufactured by fewer, and on the equipment to make them. Governments use this concentration as a lever. The United States has imposed export controls since 2022 on advanced AI chips, chip-making equipment and, in some periods, model weights, primarily targeting China, with allied countries such as the Netherlands and Japan restricting equipment exports. A comprehensive "AI diffusion" rule issued in January 2025 to control chip exports worldwide was rescinded in May 2025 and replaced by more targeted measures and bilateral arrangements. Canada controls exports of sensitive technologies under its Export Control List, aligned with multilateral regimes, and coordinates with allies. For organizations, export controls affect where data centres can be built and which customers can be served, and require screening of customers and transactions. Compute governance proposals, such as reporting of very large training runs or chip tracking, aim to give governments visibility of frontier development.

International coordination

Because AI risks and markets cross borders, governments coordinate through several channels: summits (Bletchley Park 2023, Seoul 2024, Paris 2025 and New Delhi 2026), the international network of AI safety institutes, the OECD and G7 Hiroshima Process (Lesson 3), the Council of Europe Framework Convention, the United Nations' scientific panel and global dialogue on AI governance, and the International AI Safety Report, a scientific assessment of general-purpose AI risks first published in January 2025 by experts from over thirty countries. Standards bodies provide another channel of convergence (Lesson 10). Yet coordination is limited by competition: major powers view AI leadership as an economic and security priority, and approaches diverge between the EU's comprehensive regulation, the United States' innovation-first approach, China's state-directed rules, and the varied paths of other countries.

Canada participates actively: it has signed the Council of Europe Convention, hosts the Canadian AI Safety Institute, co-founded the Global Partnership on AI, and held the G7 presidency in 2025. Its 2026 strategy emphasized international coordination and sovereign compute capacity.

Debates that will shape future law

Several unresolved debates will determine how AI law develops:

• Comprehensive versus sectoral regulation: whether horizontal AI laws like the EU's are needed, or whether existing laws and sector regulators suffice.
• Federal versus state or provincial authority: in the United States, preemption of state laws; in Canada, the division of powers.
• Open-weight models: openness supports research, competition and sovereignty, but released weights cannot be recalled and safeguards can be removed.
• Liability: whether developers of general-purpose models should bear liability for downstream harms, and how product liability should apply to software.
• Copyright and data: whether training requires permission or payment, and how creators are compensated.
• Labour and economic effects: how to address job displacement, algorithmic management and the distribution of AI's benefits.
• Frontier risk: how much regulation catastrophic and loss-of-control risks justify, given uncertainty.

Practitioners can contribute to these debates through consultations, standards work and professional bodies, bringing technical understanding that policymakers need.

Building a cross-jurisdictional compliance program

An organization operating in several jurisdictions cannot run a separate program for every law. A practical approach:

• Map obligations: list the laws, regulations and standards applicable to each AI system by jurisdiction, role and risk category, and the dates they apply.
• Build a common control framework: identify the controls that satisfy most obligations, such as inventory, risk tiering, impact assessments, data governance, documentation, testing (performance, bias, robustness, security), human oversight, transparency notices, monitoring, incident response, vendor management and training, and map each control to the requirements it satisfies.
• Add jurisdiction-specific controls only where necessary, such as EU conformity assessment and registration, New York City bias audit publication, Quebec automated decision notices, or state-specific notices.
• Set the baseline at the strictest common requirement where feasible, to avoid maintaining many variants.
• Maintain a regulatory calendar and horizon scanning, so new obligations are planned for before they take effect.
• Assign owners and evidence for each control, and test them (Lesson 10).

from datetime import date
# Which obligations apply on a given date? A simplified compliance calendar for a multinational AI deployer
obligations = [
    ("EU AI Act prohibited practices", date(2025, 2, 2)),
    ("EU AI Act general-purpose AI model duties", date(2025, 8, 2)),
    ("California SB 53 frontier transparency", date(2026, 1, 1)),
    ("Texas TRAIGA", date(2026, 1, 1)),
    ("EU AI Act Article 50 transparency (new systems)", date(2026, 8, 2)),
    ("EU AI Act nudifier and CSAM prohibitions", date(2026, 12, 2)),
    ("New York RAISE Act", date(2027, 1, 1)),
    ("Colorado ADMT Act (subject to rulemaking)", date(2027, 1, 1)),
    ("OSFI Guideline E-23 (Canadian banks and insurers)", date(2027, 5, 1)),
    ("EU AI Act high-risk (Annex III)", date(2027, 12, 2)),
    ("EU AI Act high-risk (Annex I products)", date(2028, 8, 2)),
]
for check in (date(2026, 10, 19), date(2028, 1, 1)):
    live = [n for n, d in obligations if d <= check]
    upcoming = [(n, (d - check).days) for n, d in obligations if d > check]
    print(f"As of {check}: {len(live)} in force; next: {upcoming[0][0]} in {upcoming[0][1]} days" if upcoming else f"As of {check}: all {len(live)} in force")

As of 2026-10-19: 5 in force; next: EU AI Act nudifier and CSAM prohibitions in 44 days
As of 2028-01-01: 10 in force; next: EU AI Act high-risk (Annex I products) in 214 days

On October 19, 2026, five of the eleven listed obligations are in force, and the next, the EU's new prohibitions on non-consensual intimate imagery and child abuse material, is 44 days away. By January 2028, ten are in force, with only the EU's Annex I high-risk obligations still to come. Real calendars track many more obligations, including guidance deadlines and rulemaking dates, and must be updated as laws change; as this course has shown, dates have already moved several times.

Capstone project

The capstone asks you to design an AI compliance program for a realistic organization. The scenario: a mid-sized software company headquartered in Canada with offices in the United States and Germany. It sells (1) an AI-powered applicant screening product to employers in Canada, the United States and the EU, and (2) a generative AI customer service assistant built on a third-party foundation model, sold to retailers and banks. It also uses generative AI tools internally for coding and marketing.

Your submission, about 4,000 to 6,000 words with supporting tables and code, should include:

• An AI inventory and risk tiering of the company's products and internal uses, with roles (provider, deployer) under each applicable law (Lessons 1 and 3).
• An obligations map for each product across Canada, the United States (including at least two states or cities), and the EU, covering AI-specific law, privacy, discrimination, consumer protection, IP and sector rules for bank customers (Lessons 2 to 9).
• A common control framework with jurisdiction-specific additions, and a compliance calendar to 2028 (this lesson).
• An algorithmic impact assessment and a bias testing plan for the screening product, including adverse impact analysis on sample data (Lessons 2 and 5).
• A privacy impact assessment summary for the customer service assistant, including training data, logs and rights requests (Lesson 4).
• A vendor due diligence assessment and key contract terms for the foundation model provider, and the terms the company should offer its own customers (Lessons 7 and 11).
• A governance structure, AI policy outline, acceptable use policy and incident response plan (Lesson 11).
• A plan for ISO/IEC 42001 certification or alignment with the NIST AI RMF, with audit readiness steps (Lesson 10).

Assessment focuses on the accuracy of the legal mapping, the practicality and coherence of the controls, the quality of the impact and bias analysis, and clear communication suitable for the company's board. As in practice, your plan should state its assumptions and identify where legal advice is needed.

Keeping the program alive

A compliance program is never finished. New AI systems are adopted, existing ones change, vendors update their models, and laws and guidance evolve. Effective programs schedule regular reviews of the inventory and risk tiers, refresh assessments when systems or laws change, test controls through internal audit, and report to leadership on emerging risks and upcoming obligations. They also learn from incidents, complaints and enforcement actions against others, treating each as a prompt to check whether similar problems could arise in their own systems.