AI Governance Tracker

Every AI safety announcement is also a procurement document.

The instruments below — the EU AI Act, the US compute export controls, the national AI Safety Institutes, the C2PA watermarking standard — were all sold as guardrails against existential-tier risk from frontier models. They are also, simultaneously, an implementation calendar for who-gets-to-build-what, who-gets-to-import-what, who-gets-audit-rights-into-whose-stack. Both readings are correct. The instruments do not care which one motivates you.

Each row sources to the regulation text, an agency notice, or a real-time tracker. The argument these instruments converge on — who operates the grid, and what held versus what reversed in 2025–26 — is laid out in The AI Governance Ratchet. Update triggers: regulation enters into force, enforcement action announced, executive order signed or rescinded, AI Safety Institute report dropped.

Where it appears in print: Evil Robots (Book 1) Convergence chapter (regulation as backdrop) and The Ratchet (Book 2) Chapter 20 (“The Blueprint”) (regulation as control infrastructure). The page consolidates both books’ tracking.

EU AI Act Timeline

Enforcement signals to watch: European AI Office staffing and guidance; national Market Surveillance Authorities; complaints to data protection authorities under the Article-5-overlapping prohibitions.

Standing tracker: artificialintelligenceact.eu (FLI / Future of Life Institute) — most comprehensive non-official monitor of EU AI Act implementation.

US Compute Export Controls

Status under Trump II: Executive Order 14110 (Biden EO of October 2023) was revoked by Executive Order 14148 of January 20, 2025. The AI Diffusion Framework was rescinded by BIS announcement of May 13, 2025 — enforcement officials were instructed not to enforce it ahead of its May 15, 2025 compliance date. The formalizing Federal Register rule was never published, so the framework’s text remains in the CFR; GAO held in May 2026 (B-337935) that the press-release rescission was itself a rule subject to the Congressional Review Act.

DeepSeek-R1 / V3 impact: Released January 20, 2025 (R1) on the same day as the Trump EO revocation. Demonstrated frontier reasoning on training compute roughly an order of magnitude below US lab estimates (DeepSeek-V3 technical report). Triggered the policy question whether export controls accelerate Chinese architectural innovation; track CSIS, RAND, and CNAS for analysis updates.

C2PA Content Provenance

Coalition for Content Provenance and Authenticity — cryptographic content credentials.

Government mandates:

• China Deep Synthesis Provisions (effective Jan 10, 2023) — labeling required for synthetic media
• EU AI Act Article 50 — disclosure for AI-generated content (Aug 2026)
• No US federal mandate. California AB 3211 vetoed Sep 2024. California SB 942 (AI Transparency Act) signed Sep 2024.

Standing source: C2PA technical specifications — the actual standard.

Open Source / Open Weight Frontier Releases

Jurisdiction restrictions on open-weight releases: No outright bans.

• California SB 1047 vetoed by Governor Newsom Sep 29, 2024
• EU AI Act Article 53(2) — exempts free-and-open-source providers from most documentation obligations, except for systemic-risk GPAI models (10^25 FLOPs threshold)
• Compute threshold mirrored in Biden EO 14110 (10^26 FLOPs reporting requirement) — now revoked

AI Safety Institutes

International cooperation:

• Bletchley Declaration (Nov 2023)
• Seoul Declaration (May 2024)
• International AI Safety Report 2025 (Bengio et al.) — first inter-government scientific assessment

Who Governs the Governors (the capture read)

Every instrument above has an author, and the authors are not neutral. Run the same test on the AI-safety apparatus that this project runs on any other captured institution — who funds it, who staffs it, who writes its standard — and the answer, at each layer, is the industry it governs. The finding is structural; it alleges no bad faith by any safety researcher.

The counter-case (kept, per present-all-sides): the least-captured artifact in the apparatus is NIST’s AI Risk Management Framework, assembled from 240+ organizations across industry, academia, and civil society through open public comment — and it is the one that persists across the administration change. The picture is not that every safety body is a front; it is that the closer you get to the money, the access, and the board seats, the more the safety of the machines is defined by the people who own them.

Principal dossiers (Watching the Watchers): Nakasone, Kratsios, Prabhakar, Cuéllar, Buchanan, Kelly, Chowdhury, Brundage, Krishnan, Sankar. Full research: IGO capture / the F3 finding. The Record’s AI policy-council view renders the same people as a graph.

State-Level US AI Legislation (Tracking)

Standing tracker: IAPP US State AI Governance Legislation Tracker — comprehensive monthly-updated state-by-state.

Bridges

• convergence-table — AI governance situated inside the broader infrastructure stack
• the-record — click 18 (“The Blueprint”) points here
• the-record — AI Industry → Government → AI Industry pipeline
• economic-statecraft-tracker — compute export controls as one instrument in the wider economic-warfare set

Sources

Inline above. Standing trackers:

• artificialintelligenceact.eu — FLI EU AI Act tracker
• BIS Federal Register feed — official US export controls
• C2PA specifications — content provenance standard
• IAPP US State AI Governance Legislation Tracker — US state law
• EPIC AI Policy — rights-focused commentary and primary-source archive
• Stanford HAI AI Index — annual cross-cutting governance + capability data

Companion research: The AI Governance Ratchet.