In late August 2026, Dynamo AI posted a clip on its official social media account from a session at the second Global Conference on AI, Security and Ethics (AISE26). The remarks went directly to the question of enforceability in AI governance. The clip reprised a question that runs through the field: how do principles formed around AI safety become institutional arrangements capable of constraining the behaviour of actual systems?
The remarks originated at AISE26 itself, held on 18–19 June 2026 at the Palais des Nations in Geneva under the auspices of the United Nations Institute for Disarmament Research (UNIDIR). Framed around the implications of AI for international peace and security, the conference focused on safeguards for high-risk systems across their full life cycle, the governance of AI agents, and the allocation of responsibility.
Member states’ flags outside the Palais des Nations in Geneva. The second Global Conference on AI, Security and Ethics (AISE26) was held at the Palais des Nations on 18–19 June 2026.
Source: UN Photo/Violaine Martin
Yasmin Afina, a researcher at UNIDIR, observed in a personal social-media post reviewing the conference that AISE26 is not a negotiating forum but a platform for parties to listen to, exchange with, and understand one another’s positions. Proposals raised at the conference may feed into subsequent policy discussion, but they are not standards that states have already accepted.
The value of multilateral dialogue lies in breaking broad disagreement down into concrete questions that can be studied and worked on jointly. Parties can begin by exchanging experience on risk identification, testing methods and incident information, before moving gradually to more complex institutional arrangements. Whether the conference leaves a lasting effect will depend on whether these discussions actually progress to implementation.
01 From model testing to system safety
The AISE26 agenda placed testing and evaluation, product life cycles, and human responsibility within a single analytical frame. A model is only one part of a complete system: risk also depends on what data and tools a model is connected to, and how people actually use it. A single round of model testing offers little basis for judging whether a system is reliable under real-world conditions.
When a model is used to organise publicly available material, errors can generally be caught on review. When the same model is used to support decisions about public services, omissions or bias may directly affect individuals. Safety requirements should therefore vary with the use and its consequences. Research on sociotechnical safety evaluation has likewise argued that assessment should look beyond model capability to human–AI interaction and broader system-level effects, since the context of use changes both the nature and the degree of risk.
AI agents sharpen this distinction further. One assistant may only read files and generate summaries; another can call external systems and initiate business transactions. Even where both run on the same underlying model, the safety arrangements they require are entirely different. For actions with potentially serious consequences, systems need bounded permissions, review at critical steps, and a workable mechanism for suspension and recovery. A prompt tells a system what not to do; permission design determines what it can actually do.
The interface of Inspect Evals, an open-source model evaluation framework released by the UK’s AI Security Institute, showing the configuration, execution and review of an evaluation task.
Source: UK AI Security Institute (AISI)
Human oversight, too, must be judged by whether it is genuinely effective. If key information has already been filtered by the system, alternatives are not presented, and the operator lacks sufficient time to check the output, the final sign-off easily becomes a formality. Effective oversight should let a person understand the basis for a recommendation, raise objections, and refuse or halt an action when necessary. Keeping an “approve” button does not, by itself, leave judgment in human hands.
02 Making evaluation actually shape deployment decisions
A complete system is typically the joint product of multiple parties, so responsibility must also be clearly assigned across development, integration and deployment. Whoever holds the key information, and whoever controls the risk, should bear responsibility commensurate with that capacity. Model developers need to state the boundaries of a model’s capabilities and its known limitations. System integrators should examine the new risks that emerge once a model is connected to data and tools. Deployment operators, in turn, need to arrange oversight suited to actual use and to deal with operational anomalies as they arise.
The US National Institute of Standards and Technology (NIST) released its AI Risk Management Framework (AI RMF 1.0) in 2023, followed in 2024 by a companion Generative AI Profile (NIST AI 600-1). As a voluntary risk-management resource, the framework calls for continuous risk management and evaluation across the full life cycle of AI products, services and systems.
In November 2023, the US National Institute of Standards and Technology (NIST) held a workshop of the U.S. AI Safety Institute at the Department of Commerce, where participants discussed AI safety measurement, risk management, and collaboration on evaluation.
Source: NIST (video still)
Evaluation becomes a governance tool only once it feeds into the decision-making process. Where testing finds the risk of a particular use to be too high, permissions should be restricted or the scope of deployment narrowed. A major update that changes system behaviour calls for retesting. New anomalies that emerge in operation should trigger investigation and correction. If an evaluation’s findings change no decision at all, even the most thorough report does little to lower real-world risk.
Transparency, too, should be designed around information that can actually be verified. The public needs to know a system’s basic purpose, the boundaries of its capabilities, and its principal risks. Regulators should be able to obtain the data and materials their mandate requires. Qualified professional bodies can further conduct independent inspection under conditions of confidentiality. Providing information in tiers protects legitimate commercial and security interests while preventing companies from substituting broad assurances for evidence.
Conflicts of interest are a problem that independent testing must confront directly. If the entity being evaluated determines the testing method, the scope of disclosure, and the judgment of risk, companies are more likely to highlight the metrics that favour them. Requirements that are costly yet fail to test for actual risk reduction can also raise barriers to market entry.Industry participation is indispensable, but the definition of risk and the conclusions of evaluation cannot be left entirely to the party being evaluated. Public bodies and independent institutions need a stable professional workforce, the necessary access to information, and sustained resources.
China’s labelling regime for AI-generated and synthetic content applies transparency requirements to the dissemination process itself. In March 2025, the Cyberspace Administration of China (CAC) and three other departments jointly issued the Measures for Labelling AI-Generated and Synthetic Content, which took effect on 1 September of the same year. The Measures distinguish between explicit labels and implicit labels embedded in file data, and assign obligations across content generation, dissemination, and application-store review.
A label can offer clues to how content was generated and where it came from, but the authenticity of the content itself still has to be verified separately. The real value of the regime lies in keeping the label attached as content is disseminated, so that when impersonation or misleading use occurs, there is a basis for verification and accountability. For a principle to carry binding force, it must be tied to a specific actor, a specific operational step, and specific consequences and response measures.
An “AI info” label as displayed on Meta’s platforms. Labels of this kind flag that content may have been generated or edited with AI, giving users clues to how it was made and where it came from.
Source: Meta Newsroom
A safety evaluation is not a certificate of compliance that remains valid indefinitely. It should specify the conditions under which a system may be used, who is responsible for reassessing it once those conditions change, and what measures that reassessment triggers. The number of reports produced is merely process information; governance should be judged by whether evaluation actually changes risky development and use behaviour.
03 Building the capacity of more countries to judge for themselves
AISE26 also brought in regional perspectives from Africa, the Caribbean and Latin America, and discussed dependence on infrastructure. For countries with weaker technical capacity, gaining access to advanced models is only a starting point. What determines whether the use of such technology builds genuine capability or simply creates a new dependency is whether a country can test systems using its own language and local data, judge whether a system is fit for public-service use, and require suppliers to correct problems.
If public institutions base deployment decisions mainly on a supplier’s own representations, while lacking the professional talent and evaluation capacity to check them, then the wider the application, the more exposed governance is likely to become. The AI divide can thus extend beyond gaps in connectivity and computing power into a gap in the capacity for independent judgment. Capacity-building must therefore leave behind a working team and a lasting institutional arrangement — not merely a tally of usage quotas or training sessions held.
Data infrastructure is a critical underpinning of AI capacity-building. For low- and middle-income countries, access to models alone is not enough; connectivity, computing power, data and skills are equally necessary foundations.
Source: World Bank Group
On 18 October 2023, China put forward the Global AI Governance Initiative, which calls for strengthening the representation and voice of developing countries in the global governance of AI, and for closing the AI divide and the gap in governance capacity through international cooperation and assistance. The substance of inclusive governance is to enable more countries to define local risks, take part in designing tests, and have real influence over how rules are formed.
Standing cooperation mechanisms can support the accumulation of such capacity. In an account of a visit to Beijing published on 9 July, UNIDIR reported that its Director, during a visit to China from 30 June to 3 July, signed a cooperation agreement with Tsinghua University and held exchanges with relevant government departments, research institutions and AI companies. A newly established centre of excellence has likewise listed capacity-building for member states among its priorities. What such cooperation ultimately amounts to depends on whether it builds a sustainable research relationship and translates knowledge into tools that can actually be used on the ground.
International cooperation could begin with jointly developing cross-lingual tests and compiling case studies of risk. Training needs to proceed continuously alongside real applications, and experience with incident response should also be channelled through a stable exchange mechanism. Only on this basis does it become possible to discuss comparing evaluation results or mutually recognising regulatory conclusions — and only then can one see clearly whether the standards, procedures and conditions of liability across different parties are actually compatible.
Whether evaluation can change a high-risk deployment, and whether an anomaly can trigger correction and accountability, are the key tests of whether AI governance is actually working. Countries with weaker capacity must, in addition, build the capacity for independent judgment. Only when both are achieved will a stated commitment to principle become a real constraint on how systems operate.
Authors
Zhang Ao and Li Ziyi
Original Link: https://mp.weixin.qq.com/s/xK56QCGj-cU2cBBL46RrgA
