A Governance Framework for Deployed AI
The Eight Core Principles of AI Governance
AI governance must evolve alongside the technology it seeks to regulate. Each of these eight principles holds a tension between two things that are both true. Someone has to make the call on where the line falls. These principles say who, and require that the call is written down.
🔍
Transparent yet secure
⚖️
Ethical yet adaptable
🛡️
Accountable to a person
Where the rules stand · September 2026
| Date | What applies |
|---|---|
| 2 Aug 2026 | EU: Article 50 disclosure and labelling, new systems |
| 2 Dec 2026 | EU: labelling for legacy systems; new Article 5 prohibitions |
| 2 Aug 2027 | EU: every Member State runs an AI sandbox (Article 57) |
| 2 Dec 2027 | EU: high-risk duties, stand-alone systems (Annex III) |
| 2 Aug 2028 | EU: high-risk duties, AI in regulated products (Annex I) |
US: no federal law. Connecticut Public Act 26-15 (May 2026) and California’s chatbot child-protection laws (September 2026) set the pace at state level. Washington is arguing for less regulation; Brussels is enforcing more. Both ask the same three things after an incident: documentation, a responsible person, and a record of what the system did.
Transparency & the Observed System
“A system must justify its decisions, yet disclosure changes the system and informs whoever is watching.”
Why it matters
- People must know they are dealing with a machine and be able to learn how a result was reached.
- Full disclosure of prompts and safeguards gives a manipulator the map.
Guiding approach
- Layered disclosure: users see one layer, deployers hold a second, authorities can demand a third.
- Named custodian: every withheld detail has an owner and a release condition.
In law: EU AI Act Article 50 (user disclosure), Annex IV (technical documentation). Commission guidelines on Article 50, 20 July 2026.
Check: Is the disclosure visible before the interaction starts? Who signed off on what is withheld?
Outcome: Systems that are accountable without handing out their vulnerabilities.
Control & the Location of Authority
“Humans must remain in control, yet a system held too tightly cannot handle what it was deployed for.”
Why it matters
- A system that escalates everything turns its human overseer into a rubber stamp.
- A system that sets its own latitude is the failure behind the recent chatbot cases.
Guiding approach
- Granted latitude: a recorded human decision defines what the system may decide alone.
- Revocable grants: every grant has a date, a reviewer and a tested stop.
In law: EU AI Act Article 14 (human oversight).
Check: Where is the document that says what this system decides without a person, and who signed it?
Outcome: Systems that operate inside a decision someone made, and someone can undo.
Bias & the Limits of Neutrality
“A system must be fair, yet no intelligence, human or machine, works without bias.”
Why it matters
- Models trained on human data carry human patterns.
- Scrubbing bias to zero hides it behind undocumented corrections.
Guiding approach
- Continuous assessment: measure on live traffic, not only test sets, and name the groups measured.
- Use the new legal basis: the 2026 Omnibus lets all providers and deployers process sensitive data for bias detection, under safeguards.
In law: EU AI Act Article 10, bias-detection data basis extended to all systems by Regulation (EU) 2026/1744 (Digital Omnibus on AI).
Check: When was bias last measured on live outputs, against which groups, and what changed?
Outcome: Systems that show their bias work instead of claiming neutrality.
Time & the Horizons of Accountability
“A system must act now, yet each action must survive review later.”
Why it matters
- Systems respond in milliseconds; harm appears in months.
- A decision defensible in real time must still be explainable when the record is pulled.
Guiding approach
- Three horizons: immediate intervention, scheduled review, long-term retention.
- Legacy is not exemption: older systems get later dates, not a permanent pass.
In law: EU AI Act Article 12 (logging), Article 19 and Article 26(6) (six-month minimum retention); legacy labelling date set by Regulation (EU) 2026/1744.
Check: Can you reproduce what the system did for a given user on a given date? For how long?
Outcome: Systems that are fast in the moment and answerable years later.
Accountability & the Chain of Custody
“A system must be answerable, yet responsibility slides between developer, operator and machine until it lands nowhere.”
Why it matters
- Every live regime assigns duties to legal persons. None assigns them to the model.
- A framework that gives “the AI itself” a share of responsibility creates the gap regulators are closing.
Guiding approach
- Mapped roles: provider owns design and documentation; deployer owns use and monitoring; both own the hand-off.
- System as evidence: its logs establish what happened. Its intent establishes nothing.
In law: EU AI Act Article 16 (providers) and Article 26 (deployers); Connecticut Public Act 26-15 and California’s chatbot laws assign duties to companies.
Check: If a user was harmed yesterday, who receives the complaint and who answers it?
Outcome: Responsibility that is shared but always traceable to a signature.
Capability & the Bounded Room
“Systems need room to develop, yet concentrated capability must stay inside limits set from outside.”
Why it matters
- Rules written for one model generation bind the next one badly.
- Self-imposed limits dissolve under competitive pressure.
Guiding approach
- Two kinds of limit: external (law, sandbox terms, sector rules) and internal (thresholds, staged release, kill switch). One kind alone is not enough.
- Sandboxes first: test latitude at small scale before granting it at large.
In law: EU AI Act Article 57 (sandboxes, mandatory by 2 Aug 2027); Connecticut Public Act 26-15 (AI Learning Laboratory Program).
Check: Which external limits apply, and where is the evidence they were met? Which internal limits exist, and what triggers them?
Outcome: Systems that grow inside a room someone else can measure.
Adaptation & the Fragility of Fixed Rules
“Governance must rest on stable principles, yet a rule that never changes becomes wrong.”
Why it matters
- The AI Act was amended before its central duties took effect. Rules that cannot be revised get abandoned instead.
- Rules that change without record cannot be trusted either.
Guiding approach
- Living framework: principles fixed, implementations versioned. This page carries a version number for that reason.
- Move dates, keep duties: the Omnibus did exactly this. Internal policies should be able to as well.
In law: Regulation (EU) 2026/1744, Digital Omnibus on AI, in force 27 July 2026, amending Regulation (EU) 2024/1689.
Check: When was this policy last revised, why, and can you show the previous version?
Outcome: Governance that changes on purpose and on the record.
Exceptions & the Documented Override
“A system must follow its rules, yet some situations demand that a rule be set aside.”
Why it matters
- Rigid rule-following fails in the cases the rules did not foresee. Every emergency service has an override.
- A system that grants itself exceptions is the behaviour courts and regulators are now penalising.
Guiding approach
- Human override: pre-defined conditions, named authority, full logging.
- Stop, record, escalate: at a boundary the system halts and hands over. It does not decide the case is special.
In law: California companion chatbot laws (10 Sep 2026) and SB 243 (Oct 2025) require pre-rollout risk assessment and self-harm protocols; Connecticut Public Act 26-15 covers AI companions.
Check: Show last quarter’s override log. Who invoked each one, and what did the review conclude?
Outcome: Flexibility that belongs to people and leaves a trail.
One case, eight checks
An AI companion app deployed to teenagers.
| # | Passes if… |
|---|---|
| 1 | Disclosure shows before the first message; safety prompts held by a named person |
| 2 | A signed document lists what the app may say alone; halting has been tested |
| 3 | Live chats sampled monthly across age, gender and language |
| 4 | Logs retained long enough for a complaint filed a year later |
| 5 | Provider and app company have a written division of duties |
| 6 | Piloted in a sandbox with a user cap before release |
| 7 | Safety policy is versioned and reviewed quarterly |
| 8 | Crisis talk triggers stop, record, hand to a human; each hand-off reviewed |
A deployment that answers all eight is not guaranteed safe. One that cannot will not be able to defend itself.
Why these principles hold
Testable. Each ends in a question a reviewer can ask today.
Located. Each places authority with a named person or institution.
Versioned. Each can change, on the record.
Governance covers systems. Harm and investigation happen at the output, in front of a real person. Triadica applies these principles to the record of deployed behaviour and to the AI literacy that Article 4 asks providers and deployers to support.
Primary sources
- Regulation (EU) 2024/1689, the AI Act, EUR-Lex.
- Regulation (EU) 2026/1744, Digital Omnibus on AI, EUR-Lex. Published 24 July 2026, in force 27 July 2026.
- AI Act Service Desk, European Commission, article-by-article text.
- Guidelines on Article 50 transparency obligations, European Commission, 20 July 2026.
- Connecticut Public Act 26-15 (SB 5, 2026), Connecticut General Assembly.
- Governor Newsom signs child safety chatbot and social media laws, 10 September 2026.
- Governor Newsom signs SB 243 and related bills, 13 October 2025.
Commentary used for dates and summaries
- Cooley, Digital AI Omnibus delays key deadlines, 4 August 2026.
- Gibson Dunn, EU AI Act Omnibus Agreement, 27 May 2026.
- Center for Democracy and Technology, 2026 State and Federal AI Legislation Updates, August 2026.
- Al Jazeera, US pushes looser approach to AI regulation, 2 September 2026.
Related reading: “The Eight Core Principles vs. The EU AI Act” (Feb 2026) is being updated for the Omnibus timetable.
Related Reading
Explore These Ideas Further
-
The Eight Core Principles vs. The EU AI Act: A Comparative Analysis
The Eight Core Principles treat AI governance as a living system that must contain its own contradictions. The EU AI…