> For the complete documentation index, see [llms.txt](https://experience-digital-transform.gitbook.io/experience-digital-transformation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://experience-digital-transform.gitbook.io/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/ai-governance-regulations-global-landscape-and-best-practice.md).

# AI Governance — Global Landscape and Best Practice

The youngest and fastest-moving regulatory domain — three foundational questions every government must answer, four global governance approaches, the Council of Europe treaty anchor, and best practice

{% hint style="info" %}
**How to read this profile.** This is the first of two pages covering Component 3 Category 4 (Artificial Intelligence Governance Regulations), one of five full comparative profiles in Component 3, and the most rapidly developing category in the Primer's landscape — the one where the gap between available frameworks and operational implementation is currently widest. This page surveys the global regulatory landscape, the three foundational regulatory questions every government must answer, the four main governance approaches, and best-practice applications. The second page, **Regulatory Reference and the Education Sector**, surveys published regulations and treaties, summarises key regulatory elements, and addresses the AI governance challenges specific to the education sector. This profile should be read alongside [Component 2 Principle 11](/experience-digital-transformation/regulations/component-2-principles-of-digital-transformation-regulation.md) (Ethical Use of AI and Data) and [Component 3 Category 1](/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/data-protection-and-privacy-global-landscape-and-foundations.md) (Data Protection), with which AI governance shares significant institutional and normative territory.
{% endhint %}

## 1. Global Regulatory Landscape

### 1.1 AI governance as the youngest and fastest-moving regulatory domain

Artificial intelligence governance is the newest regulatory category in this Primer's landscape and the one with the least settled consensus about what regulation should do and how. While data protection has been developing as a regulatory domain since the 1970s and cybersecurity since the 1990s, comprehensive AI governance frameworks have existed only since 2021, and the landscape is still forming rapidly. The EU AI Act — the first comprehensive binding AI regulatory instrument — entered into force in August 2024 and is still in phased implementation. The Council of Europe Framework Convention on Artificial Intelligence — the first international binding treaty — was opened for signature in September 2024. The global governance architecture for AI is in its first decade of serious construction.

This immaturity creates a distinctive challenge for developing countries. On one hand, being a late adopter in AI governance carries none of the penalties it carries in data protection or digital identity: there is no global AI governance adequacy standard developing countries need to meet to access digital markets, no established treaty framework they are excluded from by not having joined, and no significant time lag between early and late adopters, because even the most advanced countries are still building their AI governance capacity. On the other hand, AI systems are already deployed in developing countries — in health care triage, agricultural advisory services, financial credit scoring, educational assessment, and government service delivery — without any governance framework to address the risks they create. The absence of governance is not neutral: it means AI systems are being deployed with no accountability for errors, no transparency for affected individuals, and no mechanism for redress when AI-driven decisions are wrong.

For developing countries, the practical question is therefore not whether to govern AI — the absence of governance is already a policy choice with consequences — but how to govern it proportionately given the institutional capacity available. This Primer's central sequencing argument applies with particular force here: the most important thing is not to have the most comprehensive framework but to have a framework calibrated to what the institutional environment can support and to the AI applications that currently pose the greatest risks in the specific country context.

### 1.2 The three foundational regulatory questions

Every national AI governance framework must answer three foundational questions before it can be designed effectively — prior to the technical choices about risk classification, conformity assessment, and enforcement mechanisms, which are important but secondary to the policy foundations.

**What is the primary threat model?** The EU AI Act's primary concern is fundamental rights: AI systems that discriminate against protected groups, manipulate behaviour, enable mass surveillance, or make opaque decisions about individual rights are the primary targets. The US approach has been more concerned with economic competitiveness and innovation — lighter, more voluntary governance focused on not constraining AI development. China's approach reflects a different primary concern: AI systems that destabilise social order, challenge state authority, or enable foreign influence are the primary targets. A country choosing a governance framework is implicitly choosing a threat model whether it does so consciously or not. For developing countries, the most immediately relevant threat model is typically a combination specific to their context: AI-driven discrimination against marginalised populations in government services; AI systems whose opacity makes accountability for government decisions impossible; and the use of AI for surveillance and social control by governments with limited accountability. These overlap with the EU framework's fundamental rights focus but have a specifically public sector character, because in most developing countries the primary AI deployer is the government, not the private sector.

**What is the appropriate sequencing relative to digital maturity?** AI governance frameworks presuppose certain digital infrastructure foundations that vary significantly across country contexts. The EU AI Act's conformity assessment requirements presuppose AI systems that are documented, versioned, and maintained by identifiable providers — broadly true of the EU's digital ecosystem but not necessarily of developing countries where AI systems may be deployed through informal channels, operated by international companies with no local presence, or integrated into existing digital government infrastructure without clear provider identification. The invisible prerequisites for effective AI governance include documented AI deployment practices, AI literacy in the civil service, data governance frameworks that AI governance builds on, and an institutional authority with the technical capacity to assess AI systems. Countries that lack these foundations should build them in parallel with governance framework development rather than enacting comprehensive legislation and hoping the foundations will follow.

**Is the framework for public sector AI, private sector AI, or both?** In most advanced economies, commercial AI deployment is extensive and the private sector is the primary driver of adoption. In most developing countries, government is the primary AI deployer, the private sector AI ecosystem is less developed, and the most consequential AI decisions affecting citizens are made by public sector systems. A governance framework focused primarily on commercial AI — the orientation of most frameworks designed for advanced economy contexts — will not address the most consequential AI risks in the developing country context. The practical recommendation for most developing countries is to begin with a public sector focus: mandatory requirements for government AI systems, with voluntary frameworks and good practice guidance for private sector AI — both more achievable and more consequential, since public sector AI errors typically have higher stakes for individuals than private sector AI errors in less commercially developed AI ecosystems.

### 1.3 Four approaches to AI governance — a comparative overview

At the global level, four distinct approaches to AI governance have emerged, each with different regulatory philosophies, different institutional architectures, and different consequences for developing countries choosing which approach to draw on.

| Approach                                   | Character and key features                                                                                                                                                                                                                                     | Primary examples                                                                                                                                 | Implications for developing countries                                                                                                                                                                                                    |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Comprehensive rights-based regulation      | Horizontal legislation covering all AI applications. Risk-based classification with prohibitions, high-risk obligations, and lighter-touch requirements. Extraterritorial reach. Independent supervisory authority. Enforcement through fines.                 | EU AI Act (Regulation EU 2024/1689). Council of Europe Framework Convention (CETS 225).                                                          | Highest compliance burden. Brussels effect creates market pressure for non-EU countries supplying EU markets. Most developed reference architecture. Not directly transposable without significant institutional preconditions.          |
| Principles-based and sector-specific       | High-level principles (transparency, fairness, accountability, human oversight) applied through sector regulators. Voluntary frameworks supplemented by sector-specific binding requirements. Less prescriptive on technical design.                           | UK, Singapore, Australia, ASEAN Guide on AI Governance and Ethics (2024), US NIST AI RMF.                                                        | Most flexible for adaptation. Lower institutional demand. Risk: principles without enforcement mechanisms remain aspirational. Suitable for countries building AI governance capacity.                                                   |
| State-directed with innovation priority    | Strong state role in directing AI development toward national objectives. Sector-specific requirements focused on content moderation, data localisation, algorithmic accountability. Less focus on individual rights against the state.                        | China (Generative AI Interim Measures 2023, Algorithm Recommendation Measures), elements of Gulf state approaches.                               | Attractive for countries where state AI use is primary. Risk: governance oriented toward state interests may not protect individuals from government AI. Surveillance risk high.                                                         |
| Development-oriented and capacity-building | AI governance embedded in broader digital development strategy. Focus on AI for public service delivery, financial inclusion, agricultural advisory. Governance emphasis on preventing discrimination and ensuring AI benefits reach marginalised populations. | African Union Continental AI Strategy (2024). Rwanda, Kenya national AI strategies. Santiago Declaration for Latin America and Caribbean (2024). | Closest fit for most developing country contexts. Emphasises AI as a development tool requiring governance rather than AI as a commercial product requiring consumer protection. Emerging consensus — still limited binding instruments. |

### 1.4 The Brussels effect in AI governance — and its limits

The EU AI Act's extraterritorial scope — applying to any AI system placed on the EU market or affecting EU residents regardless of where the provider is established — creates the same Brussels effect dynamic as the GDPR (the mechanism is described in full in the [Data Protection](/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/data-protection-and-privacy-global-landscape-and-foundations.md) profile, Section 1.2): global companies selling to EU customers must comply, raising the effective global standard for AI systems developed by any company with EU market exposure. For developing countries whose AI systems are supplied by European or internationally active companies, this means some baseline AI governance requirements will be met de facto through supplier compliance.

However, the Brussels effect has sharper limits in AI governance than in data protection. AI systems are not as universally subject to a single global standard as personal data — a health AI system deployed only in a West African context by a local company has no EU compliance pressure, and many of the most consequential AI applications in developing countries are precisely these domestically developed or Chinese-supplied systems that face no EU regulatory pressure. No adequacy framework analogous to the GDPR's exists for AI, and none is currently being developed. The practical implication is that developing countries cannot rely on supplier compliance to deliver the AI governance they need for their most important domestic applications — they need their own framework, calibrated to their own context, even if that framework draws extensively on the EU model for inspiration.

### 1.5 The emerging international framework

**The Council of Europe Framework Convention — the global treaty anchor.** The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS 225), adopted May 2024 and opened for signature September 2024, is the world's first internationally binding treaty on AI governance. Its significance for developing countries parallels Convention 108's significance for data protection: it provides a principles-based international anchor that is accessible to non-European states and less demanding to implement than the EU's comprehensive regulatory framework. The Convention's approach is technology-neutral and principles-based: it does not regulate specific AI architectures or use cases but requires that activities within the lifecycle of AI systems are consistent with human rights, democracy, and the rule of law. It mandates risk and impact assessments, establishes procedural safeguards including the right to challenge AI-driven decisions, requires transparency about AI system use, and establishes independent oversight mechanisms. Crucially, it applies to public sector AI — government use of AI systems and private actors operating on behalf of government — while offering flexibility on private sector AI, making it particularly relevant for developing countries where government AI is the primary concern. As of early 2026 it has 37 signatories including the United States, Canada, Japan, Australia, Israel, Argentina, and Uruguay — a genuinely global framework, not merely a Council of Europe instrument.

**The EU AI Act — the regulatory reference architecture.** The EU AI Act (Regulation EU 2024/1689), in force August 2024, is the most detailed regulatory reference architecture currently available. Its risk-based classification system — prohibited practices, high-risk applications, transparency obligations, and minimal-risk applications — provides the most developed framework for thinking about how different AI applications should be treated differently based on their risk profile. The implementation timeline is important for developing countries monitoring the EU's experience: prohibited practices (including real-time biometric surveillance in public spaces, social scoring by governments, and manipulative AI targeting vulnerable groups) entered into application February 2025; governance rules for General Purpose AI model providers became applicable August 2025; high-risk AI system requirements — including those for AI in education, employment, law enforcement, and critical infrastructure — apply from August 2026; the extended transition period for high-risk AI systems embedded in regulated products runs to August 2027; AI systems in large-scale EU IT systems have until December 2030 to comply. Education sector AI is explicitly classified as high-risk. The Act's relevance for developing countries is as a reference architecture for the design of their own frameworks, not as a model for direct transposition: its compliance architecture presupposes conformity assessment bodies, a fully operational AI Office and national market surveillance authorities, sophisticated corporate legal and technical compliance functions, and a developed AI market — none of which can be assumed for most developing countries at this stage.

{% hint style="warning" %}
**The AI governance gap for developing countries.** The EU AI Act and the Council of Europe Convention were developed primarily by and for advanced economies. Of the 118 countries with no formal representation in the bodies establishing international AI standards — primarily countries in Africa, Latin America, Southeast Asia, and the Middle East — the governance frameworks being developed at international level may not address challenges specific to their contexts, technological infrastructure limitations, or cultural and developmental considerations. The African Union Continental AI Strategy (2024) is the most significant attempt to address this gap at a regional level. Endorsed by the AU Executive Council in July 2024, the Strategy takes a development-focused, Africa-centric approach emphasising AI as a driver of economic transformation, capability building, and ethical governance, with phased implementation from 2025 to 2030 and Phase 1 focused on governance structures and national AI strategies. The inaugural Global AI Summit on Africa (Kigali, April 2025) resulted in the Africa Declaration on AI, endorsed by 49 countries. The Santiago Declaration for Latin America and the Caribbean similarly articulates a regional AI governance vision. These emerging regional frameworks are the most important complement to the global instruments for developing countries — they articulate governance principles grounded in development realities rather than advanced economy regulatory assumptions.
{% endhint %}

## 2. Best Practice Applications

### 2.1 European Union — comprehensive risk-based regulation

The EU AI Act's five-year development process — from the Commission's April 2021 proposal through the December 2023 political agreement to August 2024 entry into force — produced the most elaborated risk-based AI governance framework currently in operation. Its key architectural contribution for developing countries is the risk classification system: the insight that not all AI applications pose the same risks and that governance requirements should be proportionate to risk level rather than applying uniformly to all AI systems. The prohibited practices category — AI systems banned entirely regardless of claimed purpose — is perhaps the most practically important element for developing countries to study carefully, because it identifies the categories of AI use the international community has concluded are incompatible with fundamental rights regardless of how they are deployed: social scoring of individuals by public authorities, real-time biometric identification in public spaces for law enforcement (with limited exceptions), AI systems that exploit vulnerabilities of specific groups, and predictive policing based on profiling. Developing countries designing their own frameworks should consider whether their own contexts add to this list rather than treating the EU prohibitions as the ceiling.

### 2.2 Council of Europe Framework Convention — the accessible global anchor

The Framework Convention's contribution to global AI governance is analogous to Convention 108's contribution to data protection: it establishes internationally binding principles achievable without the institutional infrastructure of the EU's comprehensive regulatory framework. Its seven fundamental principles — transparency, accountability, non-discrimination, human rights protection, safety, privacy, and democratic oversight — provide a checklist against which any national AI governance framework can be assessed for baseline compliance. Its public sector focus is its most distinctive and, for developing countries, most useful feature: countries designing their first AI governance frameworks could reasonably begin by implementing the Convention's requirements for public sector AI, with principles-based guidance for private sector AI, and treat this as a complete first-generation framework rather than an inadequate starting point.

### 2.3 Singapore — principles-based with sector-specific guidance

Singapore's AI governance approach combines high-level principles with detailed sector-specific guidance — a model that has influenced the ASEAN regional approach and is particularly instructive for developing countries because it achieves meaningful governance outcomes with lighter institutional infrastructure than the EU model requires. The Model AI Governance Framework, updated for Generative AI in 2024, provides operational guidance for AI developers and deployers on transparency, explainability, data governance, and human oversight — structured as voluntary good practice rather than binding obligation, but with sector-specific mandatory requirements in financial services and other regulated sectors. Singapore's 2024 AI Playbook for Small States, developed in partnership with Rwanda — which has one of Africa's most advanced national AI strategies — is a direct response to the governance challenge developing countries face, and demonstrates that meaningful AI governance knowledge transfer can happen across significantly different development contexts when the knowledge is adapted rather than transplanted.

### 2.4 Rwanda and the African continental approach

Rwanda's national AI strategy is among the most developed on the African continent, notable for its integration of AI governance with digital development strategy and for incorporating African development priorities rather than simply adopting an advanced economy governance model. Rwanda's approach is grounded in its existing data protection framework and digital government infrastructure — demonstrating the sequencing logic this Primer recommends: data governance first as the foundation on which AI governance builds. Approximately 36 of 54 African countries have formal data protection regulations, providing a foundation for AI governance specific to Africa's current situation that can be extended to cover AI-specific risks without requiring an entirely separate governance architecture.

### 2.5 China — state-directed AI governance with sector-specific focus

China's AI governance approach — expressed through the Generative AI Interim Measures (2023), the Algorithm Recommendation Measures (2022), and the Deep Synthesis Provisions (2022) — is the most significant non-Western regulatory reference and is directly relevant to developing countries that use Chinese-supplied AI systems or look to China as a governance reference. China's approach is sector-specific and use-case oriented rather than horizontally comprehensive: each regulation addresses a specific AI use category rather than creating a unified framework, reflecting a different primary concern from the EU's individual rights focus — maintaining social order, preventing information that challenges state authority or social stability, and ensuring AI development serves national economic and security objectives. For developing countries assessing this approach, the key consideration is that governance oriented primarily toward state interests does not automatically protect individuals from AI-driven harms by government actors — which, as this profile has argued, is the most consequential AI risk in most developing country contexts.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://experience-digital-transform.gitbook.io/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/ai-governance-regulations-global-landscape-and-best-practice.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.