AI Governance vs AI Regulation: Who Is Responsible for What

The question of AI governance vs AI regulation is usually answered from inside a company: governance is what you do, regulation is what is done to you. That answer is correct and only half the picture. Regulation is binding law, written by a legislature and enforced by a public authority with the power to fine. Governance is the wider set of rules, standards, roles and controls that shape how AI is built and used, most of them voluntary, some written by companies and some by governments that have decided, for now, not to legislate.

Read from the side that writes the rules, the two stop looking like opposites. They are two settings on the same dial, and in 2026 the dial is being turned in public.

The short answer

The line most explainers draw is the one Void Syntax puts plainly: the NIST AI Risk Management Framework and ISO/IEC 42001 are voluntary, while the EU AI Act is legally binding within its scope, which makes it a compliance matter rather than a governance framework even though it shapes how governance programmes are built.

What AI regulation is

Regulation is the narrow, hard end of the dial. It names who is covered, what they must do, by when, and what happens if they do not. It is slow to write and slower to change, which is both its weakness and the reason it is trusted.

The EU AI Act as the reference case

The EU AI Act is the first comprehensive AI law adopted by a major jurisdiction and the one most other debates are measured against. It sorts systems by risk: a short list of prohibited practices, a heavier regime for high-risk systems, transparency duties for chatbots and synthetic content, and a separate regime for general-purpose AI models.

Its teeth are specific. According to the Commission's enforcement overview, prohibited practices carry fines of up to 35 million euro or 7% of total worldwide annual turnover, whichever is higher. Other breaches, including the obligations on general-purpose AI models, reach 15 million euro or 3%. Supplying incorrect or misleading information about an AI system can cost up to 7.5 million euro or 1%. Enforcement is shared between the Commission's AI Office, the European Data Protection Supervisor and national authorities designated by each Member State.

The 2026 timeline after the AI Omnibus

The Act did not arrive in one piece. The Commission's AI Act page sets out the staging:

• 1 August 2024: entry into force.
• 2 February 2025: prohibited practices and AI literacy duties apply.
• 2 August 2025: governance rules and general-purpose AI obligations apply.
• 2 August 2026: the Act becomes generally applicable and enforcement powers begin.
• 2 December 2027: rules for high-risk uses in areas such as biometrics, employment, education and border control.
• 2 August 2028: rules for high-risk AI embedded in regulated products.

The December 2027 date is new. It exists because of the AI Omnibus, a simplification proposal adopted on 19 November 2025, politically agreed on 7 May 2026 and in force from 27 July 2026. The AI Act Service Desk timeline now describes full roll-out of the main milestones by 2 August 2028. The point for anyone comparing governance with regulation is that even hard law moves. A binding date for high-risk uses, originally August 2026, was pushed back sixteen months by a second binding act.

What AI governance is

Governance is the wider, softer end of the dial, and it operates at two levels that the vendor explainers tend to merge.

Inside an organisation

At company level, governance is the system of roles, policies and controls that decides who can deploy which model, on what data, with what oversight, and who answers when it fails. The IEEE Standards Association frames it against ethics: ethics sets the direction, governance ensures follow-through. A company that believes in fairness has an ethic. A company that runs bias audits on a schedule, records the results and has a named owner for remediation has governance.

Chris Hood adds a useful second cut. What he calls governance of AI is institutional: committees, policies, board oversight, and the law itself. What he calls AI governance is operational: the runtime infrastructure that logs, constrains and can halt a system mid-action. Many organisations have the first and very little of the second, which is how a firm ends up with a responsible AI policy and no way to prove any production system follows it.

Between states: soft law

Governments govern AI without legislating, too. The OECD AI Principles were adopted in May 2019 and updated in 2024. The OECD describes them as the first intergovernmental standard on AI: five values-based principles and five recommendations, none of them enforceable by a fine. They shape national strategies, procurement rules and eventually legislation, but on their own they bind no one.

This is the half of the question the current search results skip. For a ministry or an innovation agency, governance is not an internal control framework. It is the set of instruments available before, instead of, or alongside a statute: principles, guidance, codes of practice, standards, procurement conditions and supervised experiments.

Where the line blurs

The clean table above starts to leak as soon as you read the regulation closely.

The law requires governance. The AI Act obliged the EU to stand up an AI Office, an AI Board, a Scientific Panel and an Advisory Forum, and required Member States to designate competent authorities by August 2025. High-risk providers must run a continuous risk management system, which is a governance obligation written into law.

The law runs on voluntary codes. The Commission describes its General-Purpose AI Code of Practice as a voluntary compliance tool, written by independent experts, that operationalises binding duties on transparency, copyright and safety. A parallel code covers the marking and labelling of AI-generated content. Alongside both sits the AI Pact, a voluntary initiative inviting providers to meet key obligations early. Soft law is how the hard law becomes workable.

Paper compliance is not governance. Sphere makes the sharpest version of this argument: compliance documents what you did, governance controls what happens. A written policy against a prohibited use, with no control that stops it, does not reduce liability. It shows the regulator the organisation knew the rule. Aidoc, writing about clinical AI, calls the relationship between the two a handshake: regulation sets the boundary, internal governance tailors it to a specific use case and risk appetite.

Who is responsible for what

The practical version of the question is about ownership. A reasonable division of labour looks like this:

For the obligations side of that table in more depth, see our guide to AI regulatory compliance.

The policymaker's choice: when to govern and when to legislate

If governance and regulation are two ends of one dial, the policy question is where to set it for a given risk, and when to move it. Legislate too early and the rule fixes an assumption about the technology that will be wrong in two years; the Omnibus is partly a correction of exactly that. Wait too long with only principles and harms accumulate without anyone having the power to stop them. Our earlier piece on whether AI should be regulated at all sets out the evidence on both sides of that trade.

The OECD's own recommendation points to a middle route. Governments, it says, should consider experimentation to provide a controlled environment in which AI systems can be tested and scaled, and should favour outcome-based approaches that give flexibility in reaching governance objectives. In other words: run the rule as governance, in a bounded setting, with real operators and a regulator watching, before deciding whether it needs to become law.

That is the logic behind the Bali Province digital residency sandbox, which opens a cohort at the EX Future Summit with a ninety-day residency, a policy pilot lane and access to municipal data. A bounded jurisdiction is a good place to test a rule because its edges are clear and its results are attributable. We have written separately about why islands as regulatory sandboxes for AI work better than most.

It is also why the summit's programme puts a Government track next to Research, Finance and AI Ethics rather than in a separate policy wing. The people who write the rule, the researchers who understand the system and the operators who will carry the compliance cost rarely sit in the same room. The summit runs 18 to 20 November 2026 as a continuous thirty-hour broadcast between Las Palmas and Bali, with free online attendance for verified researchers and students, so a regulator in one timezone and a founder in another can argue about the same draft.

FAQ

Is AI governance legally required?

Not as a standalone duty in most jurisdictions. Laws such as the EU AI Act do require governance-like practices, such as continuous risk management and human oversight, for high-risk systems, so a covered organisation cannot comply without some governance in place.

Is the NIST AI Risk Management Framework a regulation?

No. It is a voluntary framework for identifying and managing AI risk. Organisations use it to structure both their internal governance and the evidence they later produce for regulators, but no fine attaches to ignoring it.

When does the EU AI Act start being enforced?

Enforcement powers for the AI Office and national authorities apply from 2 August 2026. The rules for high-risk uses in areas such as employment and biometrics follow on 2 December 2027, and the rules for AI embedded in regulated products on 2 August 2028.

What is the difference between AI governance and AI ethics?

Ethics asks what an organisation should do: which outcomes are fair, which uses are acceptable. Governance asks how to make sure it actually happens, through named owners, audits, monitoring and a procedure for when something goes wrong.