Public Policy & Governance

A Council on Foreign Relations proposal for a Financial Industry Regulatory Authority-style self-regulatory organisation for AI is reportedly under White House review, according to a Lawfare discussion featuring three authors with direct regulatory pedigree: Vinh Nguyen, former Chief AI Officer at NSA; Elham Tabassi, former Chief AI Advisor at NIST and now director of Brookings' AI and Emerging Technology Initiative; and Kat Duffy of CFR. The proposal positions a FINRA-equivalent as capable of combining industry expertise with enforceable standards — a structure that bypasses the legislative gridlock preventing a dedicated U.S. AI regulatory agency from being established.

The FINRA model is not without critics. Its track record in financial services shows persistent tensions between industry capture and genuine enforcement, and civil society groups have consistently raised concerns that self-regulatory bodies structurally underweight public interest over time. The key implementation question is what statutory authority would underpin such a body — FINRA derives its power from Congressional mandate via the Securities Exchange Act. Without equivalent legislation, a FINRA-style AI SRO would be a voluntary or contractually bound body with limited enforcement teeth. Policy professionals should treat 'under White House review' as a pre-decisional signal, not a policy commitment.

The $3.5 million technical report commissioned to validate the age-assurance technology underpinning Australia's Social Media (Minimum Age) Act — one of the most aggressive youth online safety laws globally — has been revealed to contain citations to academic articles that do not exist, as reported by The Guardian following a Senate hearing. The report's authors conceded ChatGPT was used in editing but deny the citations are AI hallucinations. This distinction matters legally and politically: if hallucinated, it calls into question the evidentiary standard accepted by the government; if editorial error, it raises questions about peer review and procurement standards for government-commissioned research.

This case is a concrete governance failure with direct legislative consequences. The law is already enacted, meaning the defective evidence base cannot unwind it absent a legislative amendment or judicial challenge. However, the Senate hearing creates a formal parliamentary record of concern that opposition parties and civil liberties groups can use to demand review. Cross-jurisdictionally, this is a cautionary signal for any government using AI-assisted research in regulatory impact assessments — the EU, UK, and Canadian governments all have active consultations or frameworks for AI use in public administration that do not yet mandate hallucination audit trails for commissioned reports.

Anthropic has confirmed that Claude will implement text watermarking to comply with EU AI Act requirements, as reported by The Guardian. This is a significant marker: it is among the first publicly confirmed instances of a major AI developer making a specific, product-level change directly attributable to a named EU regulatory obligation rather than voluntary commitments or codes of practice. The watermarking approach — altering small, random generative choices — is a statistical steganography technique; its robustness against adversarial removal is an open technical and enforcement question.

The compliance action also introduces a quality trade-off debate that regulators have not yet formally engaged with: whether watermarking degrades output quality in ways that could constitute a market distortion, particularly for enterprise users. From a regulatory standpoint, the EU AI Act's watermarking provisions apply to general-purpose AI systems at scale, and the Commission has not published detailed technical standards specifying what constitutes compliant watermarking. This means Anthropic is implementing ahead of finalised technical guidance — a common pattern in major regulatory frameworks where industry moves to demonstrate good faith before standards are locked in, but which creates uncertainty about whether current approaches will remain compliant.

The Office of Legislative Counsel — the nonpartisan body responsible for drafting legislation for Members of Congress — is experiencing a surge of AI-generated bill submissions that are substantively error-laden, according to Politico. This is not a peripheral efficiency problem: OLC is a bottleneck institution whose output quality directly determines what reaches the floor for vote. AI-generated drafts with embedded errors require additional attorney time to identify and correct, reducing throughput and creating risk of errors passing through under volume pressure.

There is no current procedural mechanism in Congress to screen or flag AI-generated submissions to OLC, and the Legislative Counsel operates under confidentiality norms that limit public visibility into the problem's scale. This represents an institutional governance gap with direct downstream consequences for legislative quality. Comparatively, the UK Parliament's House of Commons has begun internal discussions on AI use in parliamentary research, but has not addressed AI-generated primary legislation submissions. The U.S. situation is more acute given the volume of Members and the relative accessibility of AI tools to under-resourced congressional offices seeking to demonstrate legislative activity.

The Institute for AI Policy and Strategy has published a detailed implementation guide identifying how U.S. AI chip export controls are being circumvented due to inadequate enforcement resources and absent verification mechanisms, proposing specific technical and procedural fixes deployable within one year. This is a policy-relevant document because it moves beyond the now-familiar critique of export control gaps to provide actionable verification architecture — including end-use monitoring, third-party audits, and chip-level telemetry — that BIS and partner agencies could adopt without new legislation.

The strategic context is critical: the export control regime established under the Biden administration's AI diffusion rules has faced consistent implementation challenges, and the current administration has signalled continued prioritisation of semiconductor geopolitics. The IAPS framing of a twelve-month deployment window is deliberate — it matches the typical planning cycle for BIS rulemaking and aligns with expected renewal reviews of existing entity list designations. The gap between announced controls and actual enforcement is where the policy fails, and this report is explicitly targeting that gap rather than the controls themselves.