AI governance: self-regulate or wait for the law?

In 2019 an independent expert group set up by the European Commission published seven requirements for trustworthy AI, then wrote that the document creates no legal rights and imposes no legal obligations towards third parties (High-Level Expert Group on Artificial Intelligence, 2019, p. 6). It is guidance, not law (the EU ethics guidelines case). If you are buying a chatbot or a CV-ranking tool, you will hear two opposed lines: "the industry will self-regulate" and "just wait for the law". This post reads Thomas Ferretti's argument for the second (the institutionalist approach), tests it on Facebook in Myanmar, and asks what a buyer should do while the law is unsettled.

Where is the "industry will self-regulate" argument strongest?

On speed and information. Ferretti concedes that governments often lack information about fast-moving technology and that regulation is slow to update, so until the law catches up firms seem to have no choice but to self-regulate (Ferretti, 2022, sections 2 and 4).

The Facebook case shows a part firms can fix themselves. BSR records one interviewee saying the Community Standards were "mostly fine" but "not being enforced well enough"; Facebook then had over 60 staff focused on Burmese and Myanmar, with 100 planned by the end of 2018 (BSR, 2018, p. 26). In my reading, hiring and process changes do not need to wait for legislation.

What reasons does Ferretti give for putting law first?

Three: legitimacy, stability and efficiency (Ferretti, 2022, p. 239).

Legitimacy. When Facebook decides what content comes down, it is making value judgments in a society with many viewpoints. For Ferretti, only a democratic process with public scrutiny and checks on power makes such a decision fit to be treated as shared (Ferretti, 2022, section 3.1).

Stability. Competition pushes firms to pursue ethics only as far as their strategy needs, and Vogel (through Ferretti) holds that no systematic link between good behaviour and profit has been shown. Binding law covers a whole sector; voluntary rules bind only those who opt in (Ferretti, 2022, sections 3.2 and 4).

Efficiency. Using AI to forecast customer demand and then schedule on-call or split shifts shifts the risk of slack demand onto workers (Ferretti, 2022, section 3.3).

Can aligning AI with values replace regulation?

No: alignment answers "what should the AI follow", not "who gets to choose". Gabriel lists six targets: instructions, expressed intentions, preferences revealed by behaviour, informed preferences, interests, and moral values; revealed preferences can rest on data already tainted by discrimination (Gabriel, 2020, section 3). His central challenge is to find fair principles that people can endorse on reflection despite differing moral beliefs (Gabriel, 2020, p. 411).

Ferretti calls this a good first step but says it cannot by itself legitimise regulation: implementation must be led by legitimate public institutions (Ferretti, 2024, p. 3). A made-up illustration of mine: for a sales assistant, "do what it is told", "do what customers tend to click" and "do what is good for the customer" are three different rungs; write down which one you chose. See value alignment.

When the state has not done its job, what does Facebook in Myanmar show?

It shows the limit of firms acting alone: BSR says Facebook's impacts in Myanmar "cannot be addressed by Facebook alone" (BSR, 2018, p. 3). Ferretti credits Singer (2018) with coining justice failure; in Singer's abstract, as market failure leaves real markets short of efficiency, real welfare states fall short of equality, so managers carry further duties (Singer, 2018). Even so, Ferretti puts helping to build good regulation first, with self-regulation the last resort, not a licence (Ferretti, 2022, section 4).

BSR carried out its assessment between May and September 2018, funded by Facebook, with BSR retaining editorial control (BSR, 2018, p. 1). It records:

• Myanmar's legal framework is not aligned with international human rights norms (BSR, 2018, p. 3).
• The platform rests on assumptions about free speech and the rule of law that did not hold in Myanmar; one interviewee said "Facebook isn’t the problem; the context is the problem". BSR records that Facebook "has become a means for those seeking to spread hate and cause harm", though the relationship between posts and offline violence is not fully understood (BSR, 2018, p. 24).
• Many stakeholders, Facebook included, said earlier efforts "have fallen short"; civil society had raised concerns since 2012 (BSR, 2018, p. 29).
• Recommendations include that Facebook and other influential companies keep making their views known on legal and regulatory reform, locally and at ASEAN level (BSR, 2018, pp. 6, 31).

In my reading, that last recommendation fits Ferretti's ordering: do your own part and push for legal reform. BSR says this is not an audit and reaches no conclusion on how effectively policies were implemented (BSR, 2018, p. 7); I have read nothing on what happened after 2018.

How long is "wait for the law", and wait for what?

Nobody knows, and the three cases I read show that "the law" has several unfinished layers. On the docket as I read it on 3 November 2026 (latest entry I saw: 26 October 2026), Andersen v. Stability AI, filed on 13 January 2023, still had discovery-dispute letters in October 2026; an order of 28 September 2026 has dispositive motions and the class-certification hearing to be heard by 29 September 2027 (Andersen v. Stability AI Ltd., 2023). I saw no final judgment in the entries I read.

The EU guidelines say existing law still applies ("do not operate in a lawless world") (High-Level Expert Group on Artificial Intelligence, 2019, p. 6), and that governance mechanisms "cannot replace legal oversight" (High-Level Expert Group on Artificial Intelligence, 2019, p. 23). The post on the Air Canada chatbot shows one Canadian tribunal member treating a wrong chatbot answer as negligent misrepresentation, an existing civil wrong.

The UK government's page on the Bletchley AI Safety Summit describes an event bringing together governments, leading AI companies, civil society and researchers to consider risks of AI at the frontier, and links to safety policies the companies set out themselves (UK Government, 2023). In my reading: governments convene, firms self-report.

While the law is unsettled, what should a business buying AI do?

Follow Ferretti's "second-best": self-regulate, but aim at legitimacy, stability and efficiency, and never treat it as a substitute for existing law. For the AI industry he suggests following public standards that many parties have discussed rather than leaders' own morals; building self-binding mechanisms such as impact assessment and independent oversight, since voluntary rules stay shaky without oversight; and adopting early the rules expected in coming legislation (Ferretti, 2022, section 4). The table carries these over to a buyer, using a made-up online homeware shop in Da Nang that runs a chatbot and a CV-ranking tool.

This suits a tool with moderate risk, such as an FAQ chatbot, and a person who owns the job. It does not suit AI that decides about people: hiring, credit, staff monitoring. On workplace monitoring, Ferretti argues individual consent is not enough, because if enough people consent and managers tighten control, everyone bears it, so employees need a voice (Ferretti, 2024, p. 7).

Where is Ferretti taking a position rather than reporting a fact?

In three places, as I read him. First, his opening premise is an assumption he says he does not discuss: that building a just society as quickly as possible is everyone's ethical priority (Ferretti, 2022, section 2). His conclusion is hedged with "in many cases" and "in principle (if not yet in practice)" (Ferretti, 2022, p. 239).

Second, comparing state and firm is a comparison in principle. He says he is not claiming the institutionalist approach holds in every ethical case (Ferretti, 2022, section 2), and the 2024 paper admits some proposed reforms are not feasible in the short term (Ferretti, 2024, p. 9). In the two papers I found no comparison of real outcomes between binding rules and self-regulation.

Third, there are objections. Murphy (1999), as Ferretti reports him, holds that justice does not require us to promote public institutions if acting directly serves the goal better; Ferretti answers with opportunity cost (Ferretti, 2022, section 2). In my own reasoning, binding rules can also be shaped by the industry itself (regulatory capture); Ferretti does not use the term, but asks firms not to finance political campaigns or use economic threats to promote self-serving rules (Ferretti, 2022, section 4).

Going deeper: what I read and what I did not

I read Ferretti (2024, LSE Public Policy Review open-access text) and Ferretti (2022, open copy on LSE Research Online) in full. The 2022 copy is paginated 1–27 as an online-first version, not the journal's 239–265, so I give a page number only for the abstract (p. 239, the first page) and cite the rest by section. Murphy and Vogel I know only through Ferretti.

Gabriel (2020): I read the arXiv version, covering the introduction and section 3; the "central challenge" sentence is in the abstract, and p. 411 follows Ferretti's (2024) citation of it. Singer (2018): public abstract only; everything else about the paper comes through Ferretti.

BSR (2018): I read the summary, methodology, section 5 and the recommendations on advocacy, not the country-context section closely. Andersen docket: entry titles only; the 30 October 2023 line reads "ORDER ON 49, 51, 52, 58 MOTIONS TO DISMISS AND STRIKE" without stating the result. EU guidelines: most of the PDF; of the assessment list, only the introduction (p. 26) and the Accountability section (p. 31). Bletchley: the UK government page only, not the Declaration. I read no AI statute, including the EU AI Act that Ferretti (2024, p. 2) says has been passed, and no Vietnamese law.