Incremental thoughts after a week inside the international governance stack — and why they leave the first piece’s argument exactly where it was
15 July 2026
An addendum to “The Nine-Day Window,” not a second essay. That piece argued runtime governance is now the binding constraint on scaling autonomous AI. Since publishing it I’ve spent a week working through the other end of the telescope — the whole international architecture, the treaties and standards and UN panels and encyclicals — half-expecting it to complicate the claim. It doesn’t. It confirms it, and it took the long way round to do so. These are the incremental notes: what the top of the stack changes about the bottom (mostly nothing), and the one place the frameworks are visibly behind.
The standard way to draw AI governance is as a stack. Global norms at the top. Binding law and treaty below that. Soft law and principles. Standards and certification. And at the very bottom, almost as an afterthought, a thin band labelled organisational practice: policies, risk management, model inventories, audits, assurance.
The arrow points down. Norms cascade downward, the diagram says, evidence and practice feed upward.
I’ve been taking that arrow seriously, because if you follow it all the way to the bottom — past the UNESCO Recommendation and the EU AI Act and the ISO certificate and the G7 reporting regime — you arrive at a mechanism the entire architecture rests on and not one instrument in it describes.
It’s the runtime checkpoint: the control that evaluates what an agent is about to do, at the moment it proposes to do it, before it does it.
The whole cascade terminates there. And there’s nothing at the bottom of the diagram to catch it. That’s the addendum, in one line. The rest is showing the work.
The stack, as it’s taught
Two frames, held at once. The vertical one is the stack above: norms → treaty/law → soft law → standards → practice. The horizontal one sorts every instrument by how hard it bites — binding (the EU AI Act, which fines firms up to 7% of turnover; the Council of Europe Convention, which binds ratifying states), voluntary (OECD, UNESCO, NIST, the G7 code — force routed through procurement and peer pressure), and certifiable (ISO/IEC 42001 — optional to adopt, audited once you do).
The best single insight here is that the two frames don’t line up. An instrument’s height in the stack doesn’t predict its bite. The OECD Principles are soft law sitting in the middle, and yet the OECD’s definition of an “AI system” was adopted almost verbatim by the EU AI Act. Soft law, hard downstream effect. That much is right and worth keeping.
But notice what the impressive part of the picture is. It’s the top and the middle — the treaties, the encyclicals, the UN Scientific Panel convening in Geneva this month with every member state at the table. That’s where the legitimacy lives, where the diplomacy happens, and where most of the attention goes. The reader comes away believing AI governance isthat — the superstructure.
The superstructure is real. It’s also, for an autonomous system, entirely inert until it reaches the floor. That was the thing I hadn’t fully sat with when I wrote the first piece, and it’s what this note is for.
Every instrument names a duty. None names the mechanism.
Walk the binding layer and the same thing happens at each stop.
The EU AI Act is the hardest instrument in the world, and for high-risk systems its Article 14 requires human oversightand Article 15 requires accuracy, robustness, and cybersecurity. Read those articles for what they demand of an autonomous agent and you find they demand a record: that a human could intervene, that behaviour is bounded, that failures are caught. What Article 14 does not contain is a single sentence on how you produce that record for a system that acts thousands of times a second without a human in the loop. The Act names the obligation. The obligation is discharged — if it’s discharged at all — at a checkpoint the Act never describes.
ISO/IEC 42001, the only certifiable AI standard, is even more revealing, because it’s honest about its own boundary. The certificate attests to a functioning management system — governance, roles, controls — not to the safety of any single model. It requires you to keep an AI inventory, run impact assessments, log incidents, maintain a corrective-action register. Every one of those artefacts is a record of runtime behaviour. The standard mandates the paperwork that only a runtime control can generate, and then certifies the paperwork.
The G7 Hiroshima code pioneered the model now echoed everywhere: voluntary commitment plus public reporting, hosted on the OECD’s HAIP framework since early 2025, frontier firms filing comparable risk reports. Accountability through disclosure. But disclosure of what? Of incidents, evaluations, mitigations — again, the outputs of a runtime layer, reported upward, with no specification of the layer that produces them.
The Council of Europe Convention, the first binding AI treaty, requires parties to ensure AI-lifecycle activities are “consistent with human rights, democracy and the rule of law” — via domestic law, risk assessment, oversight. A treaty about outcomes. The mechanism that would make an autonomous agent’s actual actions consistent with anything is left, correctly, to be built somewhere below the treaty.
And the UN track — the Scientific Panel and the Global Dialogue that convened in Geneva on 6–7 July — arrived with a warning that ought to be the epigraph for this whole note. The Panel’s preliminary finding, as reported: safeguards can’t yet keep pace with AI capability. The international system’s most legitimate body, at its first universal convening, saying the floor of the stack isn’t built yet.
Six binding and voluntary instruments. Six named duties. Zero specifications of the thing that would discharge them for a system that acts on its own.
The floor the cascade never names
Here’s where the crosswalk — the most transferable idea in the international toolkit — does work it doesn’t know it’s doing.
The crosswalk lines up one control across every framework. Take human oversight: EU AI Act Article 14, NIST’s Govern/Map/Manage, ISO 42001’s lifecycle controls, the OECD/UNESCO accountability principles. Five frameworks, one control. The slogan is build the control once, map it many times — and it’s right. But read the evidence column. What “human oversight” requires as proof is: SOP, escalation log, training. An escalation log. A record of the moments when the system stopped and asked.
That log doesn’t exist unless something in the execution path creates it. You cannot map a control you have not built. And the control — the checkpoint that intercepts a proposed action, checks it against the authority the agent actually holds, and either passes it, blocks it, or escalates it to a human on a deadline — is in none of the five frameworks the crosswalk maps. It’s the thing all five presuppose and none contain.
Which is the whole point of the addendum: the first piece’s argument survives contact with the entire international stack. The choice for an autonomous system isn’t between imperfect runtime governance and the reassuring weight of six international instruments. The six instruments are assurance about the runtime layer — certification of it, reporting from it, treaty obligations discharged through it. They aren’t substitutes for it. Strip the checkpoint out and the crosswalk maps a control that isn’t there, the ISO auditor certifies records that were never generated, and the EU high-risk file documents an oversight capability that exists only on paper.
The cascade lands on a floor. If you haven’t built the floor, it lands on nothing.
The 2026 tell
If that reads like overstatement, the strongest evidence for it comes from the hardest instrument on the map turning against its own schedule.
In June, the EU adopted the Digital Omnibus and deferred the AI Act’s high-risk obligations — Annex III standalone systems pushed from August 2026 to December 2027, embedded systems to August 2028. It’s tempting to file this under “recalibration”: the architecture stayed intact, transparency duties still land this August, the risk-based skeleton is unchanged.
But read why it happened. The harmonised CEN-CENELEC standards and the conformity-assessment infrastructure weren’t ready. In plain terms: the top-down law couldn’t operationalise on schedule because the machinery that would let a firm actually demonstrate high-risk compliance didn’t yet exist. The most powerful AI law on earth blinked on timing because the floor of its own stack was still under construction.
That’s not a footnote about bureaucratic delay. It’s a data point about the direction of causation. The binding law didn’t fail because the norm was weak; it deferred because the operational layer beneath it wasn’t there. Norms are cheap to write and the diplomacy is real, but the constraint is, and has been all along, at the bottom.
Where the frameworks fall behind the machine
One place the international layer isn’t merely silent on the mechanism but visibly behind the technical literature — and it’s worth naming precisely.
The current governance vocabulary gets the agentic shift right — governance moving from model risk → action risk → delegated-authority risk — and it pairs each new risk with a response. Tool misuse gets permissioning and sandboxing. Unauthorised transactions get human approval. Hallucinated action plans get verification. And then the hardest one, emergent chain-of-actions, gets kill switch, audit trail, ex-post review.
Ex-post review. After the fact.
This is the temporal-conformance gap, showing up in the policy framing itself. A violation distributed across a sequence of individually compliant steps — each action permissible in isolation, the trajectory catastrophic in aggregate — isn’t caught by per-action permissioning and isn’t prevented by reviewing the wreckage afterward. The technical literature has known this for a year; it’s the distinction between governing a workflow and governing a trajectory that runs through the whole runtime-enforcement field. The frameworks haven’t caught up. None of the binding instruments distinguishes per-action disposition from trajectory-level violation. The best available policy framing answers the hardest agentic risk with the weakest available control.
That’s the map faithfully recording where the norms stand: one conceptual step behind the systems they’re meant to govern.
The wider map doesn’t move the floor
The architecture is broader than Brussels and Washington, and that’s worth holding onto. There’s a second pole — China regulating specific uses at home through binding vertical rules while proposing a development-first, Global-South-facing multilateralism abroad. There’s a whole regional layer: the African Union’s continental strategy, ASEAN’s deliberately light-touch guide, Latin America’s declarations. There’s the national middle, where only Brazil is heading toward EU-style hard law while the UK, India, and Australia converge on “existing law plus voluntary standards plus a safety institute.” There’s the softest layer of all — the Vatican, whose language on human dignity, fines and audits entirely absent, seeps upward into UNESCO texts and EU recitals.
And there’s a carve-out that’s the cleanest fault line on the whole map: military AI runs on a separate track — the REAIM process, the US-led political declaration — explicitly excluded from the UN Dialogue’s civilian scope. The civilian world is converging; the military world is a thinner, separate, largely US-shaped conversation. More consequential than most of what the summits produce, and stated once and developed nowhere.
All of it widens the map. None of it changes the floor. A billion-strong moral consensus, a Chinese vertical rule, an ASEAN guide, and a Brazilian statute make different claims about which actions an agent should be allowed to take. Not one of them touches the mechanism that would enforce the answer at the moment the agent acts. Breadth at the top doesn’t build the floor at the bottom.
The honest objection
The strongest counter deserves to be met, because a note that treats the international layer as theatre gets dismissed by the first serious reader, rightly.
Surely the stack does real work even without touching runtime. The OECD definition genuinely propagated into binding law. ISO certification genuinely shifts procurement and forces organisations to build inventories and impact assessments they’d otherwise skip. The EU’s transparency duties genuinely land this August. HAIP reporting genuinely creates comparable public accountability where there was none. None of that is nothing.
All true. The stack isn’t inert in general — it’s inert on the specific question of constraining an autonomous agent’s actions in the execution path. And here’s the concession that matters: the stack’s real work is to create the demand for the floor. ISO certification is worthless if the records are fabricated, so it forces you to build the thing that generates real records. The EU high-risk file is a liability if the oversight it documents doesn’t exist, so it forces you to build the oversight. The international layer’s genuine function, for agentic systems, is to make the runtime checkpoint non-optional — to convert “we should probably have runtime governance” into “we cannot pass the audit, file the report, or survive the liability without it.”
Not a small role. But a role played toward the floor, not instead of it. The stack is the reason you have to build the checkpoint. It isn’t, and can’t be, the checkpoint.
What the addendum changes
Not much, and that’s the finding.
Use the crosswalk; it’s the best thing in the international toolkit. Build human oversight once, as a real runtime control with an escalation contract (deadline, decision format, a reviewer with authority, a default on timeout, an audit record), and then map that single control onto Article 14, onto ISO 42001’s lifecycle clauses, onto NIST’s Govern function, onto the OECD’s accountability principle. Build data governance once and map it onto Article 10 and Annex A. Build incident capture once and map it onto the GPAI reporting duty, ISO’s corrective-action clause, and the G7’s HAIP filing. The promise to build once, map many – is genuine, and it’s the most efficient compliance posture available. But every arrow in that crosswalk originates at a control that lives in the execution path, and if that control isn’t there, the whole crosswalk maps a fiction.
Read the silences as the real agenda. The temporal gap the frameworks haven’t closed. The military track walled off from the civilian one. The UN’s own warning that the safeguards trail the capability. The EU’s high-risk deferral, which is the sound of the hardest law on earth waiting for a floor that wasn’t built.
Norms cascade downward -> that’s the arrow, and it’s right. It just doesn’t draw the floor the cascade lands on. The last decade built the top of the stack with extraordinary speed and real legitimacy. The next one gets decided at the checkpoint. Everything above it is the reason to build it. It’s not a reason to think it’s already there.
That’s the whole incremental thought. The first piece stands.
A note on sourcing. The international-governance material here is drawn from the primary instruments themselves – the EU AI Act (Regulation 2024/1689) and its 2026 Digital Omnibus amendment, ISO/IEC 42001, the OECD AI Principles, the UNESCO Recommendation, the G7 Hiroshima code, the Council of Europe Framework Convention, and the UN Global Digital Compact / Scientific Panel / Global Dialogue track. Several load-bearing facts post-date my reliable knowledge and should be verified against primary sources before republication: the Digital Omnibus (adopted June 2026) and its new Article 5 prohibition; the EU’s ratification of the Council of Europe Convention (May 2026); the UN Global Dialogue and Scientific Panel preliminary report (Geneva, 6–7 July 2026); India’s AI Governance Guidelines (November 2025); the UK’s May-2026 King’s Speech; and Australia’s December-2025 National AI Plan. Check EUR-Lex and the EU AI Office, coe.int, un.org, and the relevant national bodies. The runtime-governance argument, the workflow-versus-trajectory distinction, and the escalation-contract standard are carried forward from the first entry in this series.
Genesis: Human Experience in the Age of Artificial Intelligence | Synthesis: The Superintelligence Protocol 
Leave a comment