Deep Dive Analysis

Detailed examination of regulatory approaches, Swedish AI governance, and multilateral bodies

Paxterra · March 2026 · Complete reference with concrete details, cases, and data points

Regulatory Landscape: How Countries Approach AI

By early 2026, six distinct national models for AI regulation have crystallized. Each reflects a different theory of how technology should be governed, a different tolerance for risk, and different assumptions about where power over AI systems should ultimately sit — with governments, companies, international bodies, or some combination of the three.

EU AI Act — The Comprehensive Model

The EU AI Act is the world's first comprehensive AI legislation. As a regulation (not a directive), it applies directly in all member states including Sweden — companies don't need to wait for national transposition. At approximately 460 pages with 180 explanatory recitals and 113 articles, it is an enormously detailed piece of legislation, which is both its strength (specificity) and its challenge (complexity, particularly for smaller organizations).

Implementation Timeline

Risk Classification Architecture

Identified Gaps & Criticisms

• At approximately 460 pages, the Act creates an enormous compliance burden, particularly for small and mid-sized enterprises that lack dedicated legal and compliance teams
• Most high-risk AI systems will be self-assessed (the company evaluates its own compliance), meaning the quality of conformity assessment depends entirely on the provider's rigor — the same dynamic that produced near-zero compliance with NYC Law 144
• National security and military AI are explicitly exempted (Article 2(3)), which is significant given that many AI systems are dual-use — the same model can serve commercial and military purposes
• The risk classification system (Annex III) is static, listing specific categories of high-risk AI. As the technology evolves, new high-risk applications may emerge that don't fit neatly into the existing categories. More broadly, the Act's eight high-risk areas were designed around AI used in institutional decision-making (employment, credit, law enforcement), not around generative AI that produces content at scale. A model that generates adult content, for instance, falls outside every risk tier except "minimal" or at most "limited" (transparency labeling). The Digital Omnibus partially addresses one edge of this by adding AI-generated non-consensual intimate imagery and CSAM to the prohibited practices list, but the broader question of how the risk framework applies to generative content remains open
• Enforcement will be fragmented across 27 member states, each with its own competent authority. The uneven enforcement of GDPR across Europe is a cautionary precedent
• Key concepts remain operationally undefined: what counts as "meaningful" human oversight? What makes training data "representative"? Without clear definitions, compliance becomes subjective
• The Digital Omnibus creates a reinforcing feedback loop: missing standards justified postponement, which reduces urgency for standards completion, which could justify further delay. The removal of Article 49(2) (mandatory database registration for self-assessed non-high-risk systems) is particularly concerning because it erodes the public transparency mechanism that would allow external scrutiny of provider self-classification. Without the registration requirement, a provider can assess its own system as "non-high-risk" with no obligation to make that determination publicly visible
• The competitiveness framing is reshaping the Act's purpose. The original AI Act was justified primarily through fundamental rights protection; the Omnibus justification centers on burden reduction, innovation, and competing with the US and China. Corporate Europe Observatory documented that tech lobby spending rose 33.6% (EUR 113M to EUR 151M) between 2023 and 2025, with near-identical language between industry submissions and Commission proposals. The stated goal of the system (protect fundamental rights) is diverging from its actual output (extended periods of unregulated high-risk deployment)

United States — From Executive Order to Innovation-First Framework

What Was Lost: Biden's Executive Order 14110

What Replaced It: Three Waves of Trump-Era AI Policy

NIST AI RMF: Still Standing, Politically Constrained

The NIST AI Risk Management Framework (RMF 1.0, January 2023) remains the most influential US governance document. It provides a structured approach organized around four functions: GOVERN (establishing organizational culture and policies), MAP (identifying where AI risks exist), MEASURE (tracking and quantifying those risks), and MANAGE (taking action to mitigate them). In July 2024, NIST added a Generative AI Profile (AI 600-1) identifying 12 risks specific to generative AI systems like large language models.

Key limitation: The framework is entirely voluntary. There is no enforcement mechanism, no certification process, and no consequences for non-compliance. Companies can claim "alignment with NIST RMF" while doing very little in practice. Under the July 2025 Action Plan, NIST was directed to strip references to "misinformation," DEI, and climate change from the framework, effectively narrowing the scope of recognized AI risks. NIST retains its standards-setting role but now operates within tighter political parameters.

State-Level Patchwork (Now Under Federal Pressure)

China — Prescriptive, State-Directed, Operational

China has enacted more binding, AI-specific regulations than any other country — a fact that often surprises Western observers who assume authoritarian states don't regulate technology. Three core regulations form the backbone: rules on Algorithmic Recommendations (2022), Deep Synthesis/Deepfakes (2023), and Generative AI (2023). All require that AI systems align with "Core Socialist Values" — making clear that China's regulatory model serves state control, not individual rights. The Cyberspace Administration of China (CAC) maintains an Algorithm Registry with over 1,000 algorithms registered, giving the government unprecedented visibility into how AI systems work across the economy.

United Kingdom — Pro-Innovation with Institutional Shift

The UK has chosen not to pass comprehensive AI legislation. Instead, it takes a sectoral approach: existing regulators — the Financial Conduct Authority, Ofcom (communications), the Competition and Markets Authority, and the Information Commissioner's Office — each apply five cross-cutting AI principles (safety, transparency, fairness, accountability, and contestability) within their own domains.

AI Security Institute (formerly AI Safety Institute)

Established after the Bletchley Park Summit in 2023 as the world's first government-backed institution dedicated to testing frontier AI models. Under the Labour government, it was renamed from "AI Safety Institute" to "AI Security Institute" — a subtle but telling shift that signals the incorporation of national security considerations alongside the original safety mandate.

India — Innovation-First, Light-Touch

India has built a deliberate counter-model to the EU's regulatory approach. There is no comprehensive AI legislation, and the government has signaled clearly that it does not intend to create one. Instead, the IndiaAI Mission (launched March 2024, approximately $1.25 billion over five years) focuses on building AI capacity — compute infrastructure, foundation models, datasets, applications, skills, startup financing, and (last on the list) safe and trusted AI.

India AI Impact Summit (February 2026)

The fourth global AI summit and the first hosted by a Global South economy. India organized the summit around seven "Chakras" (energy centers, drawn from Hindu philosophy) within the MANAV vision — an acronym standing for Moral, Accountable, National sovereignty, Accessible, and Valid.

India vs. EU — Philosophical Divide

Singapore — Practical, Implementation-Oriented

AI Verify is an open-source testing toolkit released by the Singapore government in 2022. It allows organizations to test their AI systems against 11 governance principles spanning fairness, explainability, robustness, and data governance. It is one of the very few practical, technical AI governance tools produced by any government — most countries have produced principles documents, while Singapore built working software.

The AI Verify Foundation (established 2023) has attracted over 90 member organizations including Google, Microsoft, IBM, Salesforce, and DBS Bank. Crucially, it has published a "crosswalk" with the US NIST Risk Management Framework, mapping each framework's requirements to the other — allowing companies to satisfy both governance standards through a single process rather than duplicating effort.

Swedish AI Strategy & Governance

Official Swedish AI Strategy (2026)

Sweden's official AI strategy (Sveriges AI-strategi), signed by Prime Minister Ulf Kristersson and Civil Minister Erik Slottner, replaces the country's 2018 national AI direction. It draws heavily on the AI Commission report (SOU 2025:12) and is aligned with Sweden's broader digitalization strategy for 2025–2030.

Three Overarching Goals

14 Policy Areas

AI Commission Report (SOU 2024:73)

Published in November 2024 under the title "AI i allas intresse" (AI in everyone's interest), this was the report that set the tone of urgency which ultimately shaped the national strategy.

The Commission's key proposals included putting political leadership into "crisis mode" on AI, creating a free-access AI Hub for all citizens, transforming the education system, accelerating public sector AI deployment, and investing SEK 1.8 billion in research and computing infrastructure.

AI Act Adaptation (SOU 2025:101)

This is the Swedish government inquiry that determined how the country will implement the EU AI Act at the national level. Its most consequential decision:

• Swedish Medicinal Products Agency for medical device AI
• New national law and ordinance to supplement EU AI Act
• At least one regulatory sandbox by August 2, 2026 (PTS-operated)
• Enforcement powers: administrative fines, reprimands, injunctions, system withdrawal, on-site inspections
• Applies from August 2, 2026

Governance Infrastructure

Swedish Companies with AI Governance Relevance

Distinctive Nordic Characteristics

Sweden-Specific Challenges

• SME compliance burden: Sweden's tech economy relies heavily on small and mid-sized companies and startups. For these organizations, a 460-page regulation with detailed conformity assessment requirements is genuinely daunting — they lack the legal and compliance teams that larger companies can deploy.
• Public sector AI exposure: Sweden has a strong digital government tradition, which means many public agencies are already deploying AI systems. Under the AI Act, many of these will be classified as high-risk and will need to conduct Fundamental Rights Impact Assessments — creating significant new obligations for agencies that may not yet have the expertise to meet them.
• GPT-SW3: Sweden's homegrown Nordic language model may trigger obligations under the EU AI Act's general-purpose AI (GPAI) rules, depending on its size and how widely it is distributed. If it crosses the relevant thresholds, AI Sweden would face the same compliance requirements as major international model providers.
• Sami data sovereignty: The strategy mentions developing AI for minority languages, but says nothing about who governs the underlying language data. The Sami Parliament is not named as a stakeholder, and no principles for indigenous data sovereignty have been articulated.
• PTS capacity: As a novel choice for AI authority, PTS must build AI-specific expertise quickly. How it will coordinate with IMY on the inevitable overlaps between AI governance and data protection remains an open question.
• Ranking anxiety: The drop to 25th in global AI rankings creates intense political pressure to move fast, which risks deprioritizing responsible AI governance in favor of visible speed and investment metrics.

AI Summits & International Bodies

Bletchley Park (November 2023)

The first global summit dedicated to AI safety, bringing together 28 countries including the US, China, and EU member states. The framing was dominated by existential and frontier risk concerns.

• Bletchley Declaration: The first multilateral statement formally acknowledging that frontier AI models pose serious risks. Represented a breakthrough in getting major powers to agree on the basic premise that AI safety is a legitimate international concern.
• UK AI Safety Institute: The summit led to the creation of the first government-backed AI testing body, which has since tested more than 30 frontier models and produced some of the most concrete evidence on evolving AI capabilities (see UK section above).
• Significance: Established a safety-first narrative at the highest political level and created the institutional precedent that other countries subsequently followed.

Seoul (May 2024)

Focused specifically on frontier model safety, this summit represented the peak of multilateral AI safety ambition.

• Frontier AI Safety Commitments: Sixteen major AI companies pledged "not to develop or deploy a model at all, if mitigations cannot keep risks below thresholds." These were the most concrete and far-reaching corporate safety pledges ever made in the AI industry.
• Seoul Ministerial Statement: Government signatories committed to "assess risks across the AI lifecycle" — a principle that, if enforced, would require risk evaluation from the design stage through deployment and ongoing monitoring.
• Significance: The high-water mark for binding company-level safety commitments. Set specific thresholds and concrete obligations rather than aspirational language. This is the standard against which subsequent backsliding should be measured.

New Delhi (February 2026)

The first global AI summit hosted by a Global South economy, and a dramatic departure from the safety focus of its predecessors.

• New Delhi Declaration: Adopted by 88+ countries. Notably omits all reference to frontier AI risks — the central topic of both previous summits. Organized around the Seven Chakras framework. All initiatives described as "voluntary and non-binding."
• Investment pledges: Approximately $250 billion in total, led by Reliance ($110B), Adani ($100B), Microsoft ($50B), Google ($30M for governance), and Blackstone ($600M). The scale of investment commitments dwarfed any governance commitments.
• Pax Silica Alliance: India joined the US-led semiconductor supply chain alliance, a geopolitically significant move that ties India's AI infrastructure development to American technology.
• Significance: The safety momentum that built from Bletchley through Seoul dissipated at Delhi. Commercial investment and digital sovereignty priorities displaced safety governance. The frontier AI safety window that opened at Bletchley appears to be closing.

UN Bodies

UN Scientific Panel on AI

UNESCO Recommendation on AI Ethics (2021)

The first global normative instrument on AI ethics, adopted by all 193 UN member states. While non-binding, it represents the broadest consensus any AI governance document has achieved. It articulates 10 principles (including proportionality, safety, fairness, sustainability, privacy, human oversight, transparency, and accountability) across 11 policy areas.

Readiness Assessment Methodology (RAM): A practical tool that has been applied in more than 60 countries to assess how prepared nations are to govern AI, across five dimensions: legal/regulatory, social/cultural, scientific/economic, education, and infrastructure. Chile was the first country to complete the assessment, and uptake has been particularly strong in Latin America. Key criticism: RAM measures whether a country has the right structures in place, but not whether those structures produce better outcomes — a country can score well on the assessment while its AI systems still produce discriminatory results in practice.

Global Digital Compact (September 2024)

A non-binding intergovernmental agreement that endorsed the creation of the UN Scientific Panel on AI and committed signatories to working toward an inclusive, safe digital future. It reaffirms the principle that human rights protections apply online just as they do offline — a statement that, while seemingly obvious, carries weight in debates about whether AI-mediated decisions should be held to the same standards as human decisions.

OECD AI Principles

The OECD AI Principles, first adopted in 2019 and updated in May 2024, were the first intergovernmental AI standard and remain the most widely referenced governance framework globally. Adopted by 47 jurisdictions, they also served as the basis for the G20 AI Principles, giving them influence well beyond the OECD's own membership.

OECD AI Policy Observatory (oecd.ai) tracks AI policies in more than 70 countries and maintains the most comprehensive database of national AI strategies available. Its AI Incidents Monitor documents real-world AI harms — a valuable resource for understanding what goes wrong in practice, not just in theory.

Reporting Framework (February 2025): A standardized template for companies to report on how they are implementing the G7 Hiroshima AI principles. The first reporting cycle runs 2025–2026. The key limitation, as with most international AI governance tools, is that participation is voluntary and there are no consequences for companies that choose not to participate.

G7 Hiroshima AI Process

Launched in October 2023 as a rapid response to the emergence of generative AI (post-GPT-4), the Hiroshima Process produced 11 Guiding Principles for advanced AI systems, covering areas from lifecycle risk management and vulnerability disclosure to content provenance (ensuring AI-generated content can be identified as such), safety research, and data governance.

Strengths: It was a notably fast political response, carried G7 political backing, engaged industry directly, and was specifically designed for generative AI rather than AI in general. Weaknesses: Like most international AI governance efforts, it is voluntary with no enforcement mechanism. Being G7-led, it faces legitimacy questions from the Global South. Corporate involvement in writing the rules was heavy, and there is no independent verification of compliance. The gap between these 11 principles and what companies actually do in practice remains largely unmeasured — making the Hiroshima Process, for now, more aspirational than operational.

Independent & Civil Society Voices

Research Institutes

Risk-Focused Organizations

Advocacy & Accountability Organizations

International AI Safety Report 2026

The second edition of this landmark report, chaired by Yoshua Bengio (a Turing Award-winning AI researcher) with contributions from more than 100 experts across 30+ countries. It provides the most authoritative independent assessment of AI risks and capabilities available. Key findings:

Risk Taxonomy

The "Evidence Dilemma": The report identifies a fundamental tension in AI governance: acting too early risks imposing unnecessary restrictions on a technology that could deliver significant benefits; waiting too long risks allowing harms that become unmanageable once they emerge. The recommended approach is "defence-in-depth" — layered safety measures at multiple points in the AI lifecycle, rather than relying on any single mechanism (like pre-deployment testing alone).

Four capability scenarios for 2030: The report models four possible trajectories for AI development: (1) progress stalls at current levels, (2) progress slows significantly, (3) exponential improvement continues at its current rate, or (4) progress accelerates beyond current trends. The report argues that given the potential severity of harms under scenarios 3 and 4, precautionary governance approaches are warranted even if the probability of the worst outcomes is uncertain.

Key challenge — the "evaluation gap": Pre-deployment testing (evaluating AI models before they are released) consistently fails to predict how models will perform and what risks they will pose once deployed in the real world. This is a fundamental problem for any regulation that relies on pre-market assessment. In 2025, twelve companies published Frontier AI Safety Frameworks, but all were voluntary, self-assessed, and self-reported — with no independent verification that companies are following their own stated commitments.