Public Policy & Governance

A senior OpenAI official stated publicly this week that AI policymaking will continue to run through US states and be shaped by California's legislative activity, a remarkable acknowledgment from the industry's most prominent actor that federal pre-emption — long the industry's preferred outcome — is not imminent. Politico reported the comments without qualification. This is a significant strategic repositioning: OpenAI had previously lobbied hard for a unified federal framework that would override California's more assertive posture. The reversal likely reflects the collapse of any realistic Congressional consensus under the current administration.

The political economy around this is being actively contested. Democratic New York Assemblymember Alex Bores, who championed state-level AI regulation, narrowly lost a House primary in June after Silicon Valley PAC money flooded the race — yet Politico reports his influence over state AI rulemaking is rising rather than falling. The industry's willingness to spend against individual state legislators signals it views state regulation as the real near-term threat, even while nominally conceding that states will lead. This dual posture — accept state primacy rhetorically, undermine pro-regulation state legislators electorally — is the operative industry strategy heading into 2027 state legislative cycles.

Chatham House analysis published this week sets out Beijing's increasingly coherent two-track AI strategy: close the frontier model gap with US competitors — evidenced by Moonshot AI's Kimi K3 — while simultaneously institutionalising Chinese-led governance norms through the World AI Governance Organization (WAICO). Chatham House notes that China is replicating the playbook it used in telecommunications standards bodies: build credible technical capability first, then leverage that credibility to shape international norms before Western frameworks consolidate.

The contrast with US domestic politics is analytically important. Foreign Policy reports that AI development in China faces far less domestic political resistance than in the United States — there is no equivalent of the Sanders letter, no state-level regulatory fragmentation, and no significant organised civil society opposition. This structural advantage means Beijing can deploy coordinated industrial and governance policy at speed that democratic systems structurally cannot match. The question for Western policy advisors is whether WAICO develops genuine multilateral legitimacy or remains a vehicle for Chinese norm projection — and which developing-country governments prove receptive to joining on Beijing's terms.

Following Australia's first reported automated hacking incident involving an AI agent, legal experts have confirmed the liability framework is unresolved at the regulatory level. The Guardian cites Professor Jeannie Paterson's analysis that deployers bear primary liability under existing tort law — the AI agent itself has no legal personality — but notes that the accountability chain between deployers and developers remains genuinely contested, particularly when harm arises from emergent agent behaviour that neither party explicitly programmed. No jurisdiction currently has AI-agent-specific liability legislation in force.

This is a concrete implementation gap with immediate public sector implications. Governments deploying AI agents for administrative, law enforcement, or service-delivery functions currently do so without a settled liability framework. The EU AI Act's high-risk classification system addresses some categories of harm but does not resolve the deployer-developer chain question when agents operate autonomously across multiple task steps. Australia's incident may accelerate calls for specific AI agent liability regulation in common law jurisdictions — watch for Australian government response legislation and whether the UK's AI Opportunities Action Plan, which is silent on agent liability, faces pressure to address the gap.

Taiwan's Ministry of Digital Affairs has formally attributed AI-assisted cyberattacks on government agencies to overseas actors, with reporting linking the activity to China-connected threat actors. The Guardian reports that Taiwan's National Institute of Cyber Security detected the abnormal attack pattern beginning 20 July. The formal governmental attribution — even without naming China explicitly — represents a significant escalation in state-level acknowledgment of AI-enabled offensive cyber operations targeting public sector infrastructure.

The governance gap this exposes is acute. Existing bilateral and multilateral cybersecurity frameworks — including NATO cyber defence commitments and ASEAN cybersecurity cooperation mechanisms — were designed around human-directed attack vectors. AI-assisted attacks that can adapt in real time to defensive responses create a category problem for incident response protocols, attribution standards, and proportionality thresholds under international law. Taiwan's Ministry of Digital Affairs calling this a 'first-of-a-kind breach' is a signal that current governance instruments are operating outside their design parameters.