AI Governance Needs a Protocol Layer

A position paper from Azmine Toushik Wasi and five co-authors, accepted to ICML 2026, argues that AI governance needs a technical layer the law has been missing: ISO-like interoperability protocols that let risk information move across borders in a standard, machine-readable form. Laws set the obligations; the protocols would make them portable.

The authors lay out the problem. The EU AI Act, the NIST AI Risk Management Framework, and China's algorithm regulations each create real obligations, but none of them speak a common language, so compliance fragments across borders. Their fix draws on how GDPR became operational through standards like ISO 27001 and Privacy by Design. They propose standardized nutrition labels for AI: machine-readable metrics for bias, energy use, and data provenance that a company produces once and a regulator anywhere can read. The payoff they see is a lower barrier for small and mid-size companies, the players least able to absorb a different compliance regime in each market.

A law tells you what you owe. A protocol tells you how to show it. The lasting part of governance is the record a system can read, and making a risk claim machine-readable is what turns a legal obligation into something a regulator can check without taking your word for it.