The Standard Is the Law

The rule arrived before the law that could name it.

The Code of Federal Regulations runs to roughly 185,000 pages.

The NIST AI Risk Management Framework runs to roughly 50.

Guess which one governs how a hospital decides whether to deploy an AI diagnostic tool, how a bank determines whether a model satisfies its risk committee, how a defense contractor qualifies a system for procurement, and how a cloud provider assures enterprise clients that its AI services are safe enough to use.

The 50 pages are not law. Congress did ask for them: the National Artificial Intelligence Initiative Act of 2020 directed NIST to produce a voluntary risk management framework, and more than 240 organizations from industry, academia, civil society, and government contributed across eighteen months of drafting. The document carries no penalty for non-compliance. Nobody was given authority to make it binding on anyone. [1]

They govern anyway.

The authorization question and the governing question are different questions, and most arguments about AI standards collapse them. Congress authorized NIST to write voluntary guidance. Legislatures later decided to give that guidance legal weight, and two of them decided differently about it. What no one decided is the cumulative thing: that a single document should sit underneath procurement, audit, supervisory examination, insurance underwriting, and statutory defense at once. Each institution reached for it separately, at the moment it needed something, and none was deciding for the others.

The Legislative Function Has Always Migrated

Governance has never been coextensive with statute. The formal picture is that the legislature writes law, the executive enforces it, and the judiciary interprets it. That describes an authorization chain, not an operational reality. Operational reality has always involved a second layer: the rules that shape behavior before anyone consults a statute.

Building codes did not wait for legislatures to specify the tensile strength of rebar. Pharmaceutical good manufacturing practices were written by chemists, adopted by regulators, and made binding through inspection rather than legislation. Capital adequacy ratios were set by a committee of central bankers with no treaty authority behind it, and became mandatory through market access: a bank that did not satisfy them could not get favorable terms from counterparties who did.

The Basel Committee published Basel I in 1988 with no power to compel anyone. National supervisors wrote it into domestic rules within four years, and by 1993 the committee reported that banks across the G10 were meeting its minimum ratios. The statutes and regulations arrived quickly. What they codified was a text the committee had already finished. [2]

That is the original mechanism. The standard achieves binding force through necessity rather than penalty: satisfy it or lose access to the market, the license, the insurance, the counterparty, the procurement contract, the platform. No electorate voted on it. Everyone in the market had to satisfy it.

AI has not invented this mechanism. It has accelerated it, concentrated it, and made it harder to contest than any prior version. Standards themselves are not the problem, and complex societies cannot function without them. The difficulty is that the power to write them increasingly precedes the institutions supposed to authorize governance, and that the writing, once enough institutions build on it, is expensive for any of them to undo alone.

The Voluntary Framework That Is Not Voluntary

In January 2023, NIST published the AI Risk Management Framework. The document gave institutions a vocabulary for AI trustworthiness and a checklist for demonstrating responsible governance. It organized AI risk into functions, categories, subcategories, and practices that could be translated into procurement, audit, insurance, and compliance language.

The framework is officially voluntary. Under the Biden-era AI executive order and OMB guidance it moved from voluntary framework toward procurement expectation, with agencies directed to organize AI acquisition, risk management, and governance around NIST-linked frameworks. That executive order was later rescinded and federal AI policy shifted. The compliance architecture did not dissolve with it, because auditors, vendors, and buyers had already built around it.

The states are where the mechanism becomes legible. Under the Texas Responsible Artificial Intelligence Governance Act, effective January 1, 2026, substantial compliance with the NIST generative AI profile, or with another nationally or internationally recognized risk management framework, appears among the enumerated affirmative defenses, tied to discovery of the violation through an internal review process meeting the statute’s conditions rather than operating as a blanket shield for any compliant firm. Colorado had done something broader two years earlier and then undid it. Its 2024 AI Act made compliance with the NIST framework or ISO/IEC 42001 a defense; the operative date was postponed twice, a court stayed enforcement after a suit the federal government intervened to support, and in May 2026 the legislature repealed the statute and reenacted it as a narrower disclosure regime with the framework defense removed. [3]

The pair is the finding, and it pays to be careful about what the pair shows. A voluntary federal document became a statutory defense in Austin and stopped being one in Denver, and neither outcome turned on anyone assessing whether the framework measures what it claims to measure. Incorporation is reversible. What Colorado demonstrates is narrower than dependence: a legislature can withdraw formal recognition of a framework while keeping the duties the framework was built to discharge. Its replacement still requires notices, explanations of adverse outcomes, human review, developer documentation, and years of record retention. Whether firms keep running framework-based procedures to satisfy those duties is an inference rather than a finding, and a testable one, which drafting history and the behavior of compliance teams after January 2027 would settle. The legislature repealed the safe harbor. Whether the vocabulary goes with it is the question the next two years answer.

NIST is not the only candidate. ISO/IEC 42001, published in 2023, specifies requirements for an AI management system and can be certified against by an accredited body, which makes it a different kind of instrument from voluntary risk-management guidance rather than a copy of it; NIST publishes a crosswalk between the two. Colorado’s repealed provision named it expressly. Texas names no alternative at all, extending its defense to any nationally or internationally recognized framework, which leaves open how much practical diversity that phrase admits once a buyer or an attorney general is asked to accept a substitute. What is not open is the size of the recognized set, or the fact that one member of it is published by an American agency at no cost.

Bank supervisors reach AI governance through the established language of model risk management: controls, documentation, monitoring, accountability. None of that guidance is mandatory in the way a statute is mandatory. An examiner who finds a bank without credible governance cites the absence as a deficiency, deficiencies affect supervisory posture, supervisory posture affects capital treatment, and capital treatment affects everything.

Insurance underwriting for AI liability appears to be moving the same way, with underwriters asking for evidence of a recognized framework before quoting terms. What is known about that market comes mostly from practitioner reporting rather than filed policy language, so the claim should be held loosely. It is named because it is the least visible of these channels.

Safety as Market Access

The AI safety evaluation is the most consequential standard currently being written. It determines whether a model is safe enough to deploy, safe enough for a given use case, and safe enough to cross the threshold that triggers additional requirements. Getting it wrong in either direction has real consequences: models deployed that should not have been, or models withheld that could have done good.

Who writes it? Primarily the labs themselves, third-party evaluators who depend on lab access to do their work, and standards bodies that rely on technical input from the same labs they are trying to evaluate.

Anthropic’s Responsible Scaling Policy, first published in 2023 and now in its third version, established capability thresholds, safety levels, and evaluation language that helped make frontier-model risk governable in institutional terms. British and European frontier-model policy discussions and the U.S. voluntary safety commitments all became legible through vocabulary a private laboratory had already made operational. The question of who authorized that laboratory to write public vocabulary has its own treatment elsewhere. [4]

Across the AI safety landscape, the dominant evaluation frameworks are produced by institutions whose continued access to frontier models depends on maintaining cooperative relationships with the labs being evaluated. The dynamic requires nobody to act in bad faith. It follows from the fact that the evaluated party controls access to the thing being evaluated.

In September 2026 that dynamic was addressed in public by one of the parties it describes. Anthropic’s chief executive published an essay arguing that the industry must slow the rate at which model capabilities improve, and set out a three-step plan. The first step is embedded third-party evaluators with employee-like access and permissions comparable to internal risk assessment teams, under a contract that lets reviewers publish their findings without editorial control, limits redaction to security-sensitive, privileged, commercially sensitive, or third-party confidential material, and forbids redacting a finding merely for being unfavorable. Anthropic committed to it unilaterally and called on governments to require the other frontier companies to match. OpenAI’s chief executive said within a day that his company would do the same. [5]

Take the proposal on its merits first, because it is a substantial improvement on what exists. An evaluator with a badge and a publication right sees more than one with a contract and a delivery date, and a firm that agrees to be reported on by people sitting in its own building has given up something it was under no obligation to give up.

Then look at its shape. The evaluator is selected by the evaluated. The access is granted rather than owed. The redaction categories are drafted by the party under review. The commitment is contractual and voluntarily undertaken, and how it can be wound down, on what notice, and with what consequence are questions the contract settles and the public has not seen it. Each of those is a reasonable arrangement for a private firm to offer, and none of them is a public authorization.

The second step states the sequence outright. The essay’s own first preference is regulation reaching every American frontier company, and it says so plainly. But passing laws takes time and the technology is moving quickly, so companies should coordinate voluntarily in parallel to establish common safety standards, and for antitrust reasons it helps for the United States government to mediate those discussions or at minimum to issue a narrow waiver permitting them. The parallel track is the one that can start immediately. What is asked of government on that track is procedural rather than substantive: not what the standard should say, but whether the firms may lawfully agree on it among themselves. If the parallel track moves first, as its own author expects it to, the legislation arrives to a field already running on the answer. [5]

The dependency that proposal is trying to repair has surfaced in documented form before. FrontierMath, a benchmark of expert-level mathematics problems built by the nonprofit Epoch AI, was used to demonstrate OpenAI’s o3 model in December 2024. Only at that demonstration did Epoch disclose that OpenAI had funded the benchmark, had visibility into many of its problems and solutions, and had bound Epoch contractually in ways Epoch said limited earlier disclosure. The mathematicians who wrote the problems were not told. The benchmark was real. The math was real. The independence the scores implied was not. The episode does not show that evaluators are punished for unfavorable findings. It shows something narrower: the terms on which an evaluation is produced are set by the party with the most to gain from the result. [6]

Drug regulation reached its current arrangement in stages. The 1938 Food, Drug, and Cosmetic Act required evidence of safety before marketing. The 1962 Kefauver-Harris Amendments added proof of effectiveness and affirmative approval from a regulator empowered to refuse. Each stage moved the decisive judgment further from the manufacturer. AI safety evaluation, in most jurisdictions, has not completed the first: the firms with the most to gain from favorable evaluations are still deeply involved in producing the frameworks by which their systems become deployable, and the most ambitious proposal on the table asks the state, in the near term, for a waiver rather than for a power to refuse. [7]

The Standard Writes Itself Through Procurement

Technical safety standards are one channel. Procurement is a more powerful one. The United States federal government is the world’s largest institutional buyer, and its procurement requirements function as market-shaping instruments. When a procurement standard requires something, the market produces it. When a procurement standard excludes something, the market either fixes it or loses access to the most creditworthy customer class in the economy.

FedRAMP is the certification framework that governs cloud service adoption across the federal government. A cloud provider that is not FedRAMP authorized cannot sell cloud services to most federal agencies. FedRAMP was not created by statute. It was created by a memorandum from the Office of Management and Budget in 2011, inside authority the Federal Information Security Management Act had already given the executive branch to set security requirements for federal systems, and it became mandatory for federal cloud procurement through the ordinary operation of acquisition policy. [8]

FedRAMP is now a de facto standard for cloud security in high-compliance environments. Healthcare organizations, financial institutions, and regulated industries adopt FedRAMP-equivalent controls without being required to, because FedRAMP became one of the most credible available signals of security posture. Congress gave the program a statute of its own in December 2022, more than a decade after it had reorganized federal cloud adoption. The authority to set the requirements was there from the beginning, and the executive branch used it. What arrived late was Congress. [8]

The same dynamic is forming around AI. Federal procurement requirements increasingly ask agencies to identify high-impact AI use cases, maintain inventories of AI systems, document risks, and ensure human oversight for certain categories of decisions. These requirements apply directly to agencies. They apply indirectly to every vendor trying to sell AI systems to those agencies, which is most of the industry. [3]

The procurement standard does not need to become law to function as law. It needs only to be the condition of access to the market that matters most.

The Export Control as Standard

Export controls show the same instrument in its hardest form. The October 2022 semiconductor controls and their successors did more than restrict Chinese access to chips. They sorted the world into jurisdictions with different levels of access to AI capability, and made licensing determinations by the Commerce Department the thing that decides which countries and which firms can build frontier infrastructure. The tier is set case by case, by an agency, against thresholds it writes itself, and then it propagates. A contract manufacturer at advanced nodes that wants American equipment, customers, and licenses applies the American tier to every order it accepts, including orders from firms whose own legislatures have passed nothing. Those firms meet the control through their foundry rather than their government. [9]

The safety proposal above rests on this. Its case for slowing down depends on keeping the capability gap between democratic and authoritarian states wide, and it names the measures that keep it wide: no advanced chips or semiconductor manufacturing equipment to China, a crackdown on unauthorized distillation, and security against model weight theft. The safety standard and the licensing tier belong to the same architecture. The second is the condition on which the first is offered. [5]

Who Writes the Standard

The question of who writes the standard is the question of who governs. In the history of technical standard-setting it has been answered in four ways.

The first is industry self-regulation: firms write the standard through trade associations, often to define competition, create entry barriers, or forestall government regulation. Standardized shipping-container dimensions emerged through technical and industry coordination rather than democratic legislation, and became infrastructure because everyone had to build around them. Once adopted widely enough, a specification is embedded in every crane, ship, port, and logistics system in the world, and deviating from it costs more than complying. [10]

The second is expert consensus: technical professionals write the standard through bodies like IEEE, ISO, and ANSI. The process is slower and more pluralistic than industry self-regulation, but the product still derives authority from expert legitimacy rather than democratic authorization.

The third is regulatory codification: a government agency translates existing practice or expert consensus into binding rule through notice-and-comment procedure. This is the most democratically accountable version of standard-setting. It is also slow, tends to arrive after the standard is already operationally entrenched, and tends to codify what dominant actors are already doing.

The fourth is what might be called first-mover constitutionalism: the institution that arrives earliest with a working framework that others can adopt produces the standard by default. The framework achieves authority not through expertise, industry representation, or regulatory process, but through availability. It was there when the need arrived. That is enough.

Arriving first is not always decisive, and the condition under which it becomes decisive is specific. It matters when several institutions build their own procedures on the same framework, so that changing it would require them to move together. Procurement officers write it into solicitations, auditors into their programs, insurers into questionnaires, legislatures into defenses. Each is cheap to do once and expensive to undo jointly. Durability is therefore a matter of dependency rather than influence, and the question to ask of any early framework is whether the institutions built on it would have to coordinate in order to replace it. Where they would not, arriving first buys very little.

Lawrence Lessig’s argument in Code is that software architecture functions as regulation, because it operates at the level of possibility rather than permission. The extension in the AI case is that the architecture is also conceptual: the vocabulary, the risk taxonomy, the evaluation methodology. Whoever produces the conceptual architecture defines what governance means. [11]

The European Union’s AI Act is the most serious attempt to make democratic institutions the primary standard-setters for AI. The Act establishes risk tiers, prohibitions, conformity requirements, and a general-purpose AI model regime. It created a legal framework, and it relied heavily on input from the firms it was regulating.

The technical specifications and implementation guidance that populate AI governance are developed through standard-setting and consultation processes in which the most technically capable actors are often the frontier labs, hyperscalers, and large platform operators. The democratic authorization and the technical dependency coexist in the same document. [12]

The Speed Asymmetry

Underneath the authorship question is a timing question. A technical standard can become binding through procurement, insurance, market convention, and counterparty requirements in months. An administrative rule under notice-and-comment procedure takes years. A statute takes longer. An international treaty takes longer than that.

By the time democratic institutions are capable of producing authoritative governance for a technology, its operational governance has already been established by faster mechanisms. The statute arrives to find a world organized around the standard. It can amend at the margins. It cannot easily undo the compliance infrastructure, vocabulary, and institutional positioning the standard has already created.

When Basel norms emerged, they were mediated through a broad ecosystem of national supervisors, central banks, regulated institutions, and finance ministries across multiple jurisdictions. When AI safety standards are written, the institutions holding the model access, the capability, and the operational data required to write them are few, are concentrated in a small number of countries, and hold direct financial interests in the outcome. The pluralism that made earlier standard-setting more accountable, even informally, is thinner here. [2]

Compliance Becomes the Gate

A market organized around price competition can be disrupted by a better offer. A market organized around eligibility compliance can only be disrupted by satisfying the eligibility criteria, which are set by the institutions whose incumbency the criteria happen to protect.

None of that is coincidence; it is the normal logic of standard-setting by established actors. A benchmark requiring a dedicated red-teaming team, a model card with specific fields, an interpretability methodology of a particular kind, and a third-party evaluation by an approved evaluator: each requirement may be substantively justified. Together they define a compliance infrastructure only large, well-capitalized incumbents can maintain at scale.

The strongest case against reading that as exclusion is that common standards help the small firm more than the incumbent. Before a shared framework exists, a startup selling into twenty enterprises answers twenty incompatible security questionnaires and twenty bespoke governance riders. One recognized framework replaces all of them, and the cost of proving trustworthiness falls fastest for the party that could least afford to prove it twenty times. That benefit is real, and it is why procurement officers adopt frameworks at all. It gives way at identifiable points: when the framework prescribes costly procedures rather than outcomes, when equivalent alternatives go unrecognized in practice even where the text permits them, and when the revision process is open to the firms already inside and closed to everyone else. Those three are answerable about any particular standard, and they are the questions worth asking.

A startup that produces a safer model by some objective measure, but cannot produce the compliance documentation at the required density, does not clear the gate. An open-source project that distributes model weights for scrutiny may satisfy the spirit of transparency more completely than a proprietary system with a published model card, but the model card is what the procurement standard asks for.

What the compliance process measures reliably is the ability to produce documentation that satisfies it. Red-teaming, interpretability work, and evaluation are aimed at safety itself, some of that work is serious, and some gates do look behind the record. The exposure is narrower and harder to see: documentary compliance can become the substitute for examining whether the safeguards work, and the party with the most riding on that substitution is the one producing the documents.

This is credential inflation at the institutional level. The compliance cost rises. Whether the underlying safety rises with it is not something the process reports. The institutions that can afford to keep producing credentials retain market access. The institutions that cannot are excluded, for being unable to perform safety in the required register rather than for being unsafe.

When the compliance framework drifts from the underlying risk, it does not automatically self-correct. It continues to extract resources, shape market access, and exclude competitors. The gate remains long after the thing it was built to protect has moved somewhere else.

The Site of Power

The wage organized production. The market organized exchange. The state organized coercion. The standard organizes access.

Every arrangement described here moves the decisive act upstream of the institution that appears to be deciding. The standard is what makes those movements durable, because it is the layer the others are written on.

The standard does not eliminate politics. It relocates politics into a register where most citizens cannot participate: the technical annex, the evaluation methodology, the procurement specification, the working group comment period, the model card template. None of it is secret. All of it is public, and almost none of it is legible to anyone without the resources to follow it.

That illegibility is what technical governance produces when it moves faster than democratic institutions and is written by actors with stronger interests in the outcome than in the accountability of the process.

None of this is a temporary condition awaiting correction. It is what governance looks like when technical change outruns democratic capacity. Basel was in domestic banking rules within four years. FedRAMP waited a decade for a statute. Colorado repealed its framework defense before the defense ever took effect. The standard is not beyond reach.

But reach is not replacement. Colorado removed the shield and kept the documentation, the explanations, the human review, and the retention rules, which is to say it kept everything the framework had been built to produce. Whether it also kept the framework is the thing to watch, and the sharpest test available of everything argued here.

AI is that pattern running faster, at higher stakes, with fewer actors writing the rules, and less time for any slower institution to catch up.

The institution that writes the standard writes the law.

The rule arrived before the law that could name it.

Notes

[1] National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 26, 2023. https://doi.org/10.6028/NIST.AI.100-1. NIST produced the framework as directed by the National Artificial Intelligence Initiative Act of 2020 (P.L. 116-283), through an eighteen-month consensus process that NIST describes as drawing on more than 240 contributing organizations across private industry, academia, civil society, and government. The framework is expressly voluntary. NIST released the Generative AI Profile (NIST-AI-600-1) in July 2024, and AI RMF 1.0 is under revision under the current federal AI action plan.

[2] Basel Committee on Banking Supervision, International Convergence of Capital Measurement and Capital Standards, July 1988 (Basel I). The accord set a target ratio to be met by the end of 1992, and the committee subsequently reported that banks in the G10 countries were meeting the minimum requirements. Domestic implementation therefore belongs near the beginning of the Basel account rather than at its end. The pluralism observation in the Speed Asymmetry section draws on the structure of that process, whose participation across national regulators, central banks, and finance ministries contrasts with the narrower concentration of AI standard-writing capacity.

[3] On federal incorporation: OMB M-24-10, “Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence,” March 2024, and Executive Order 14110, October 2023, since rescinded. On state incorporation: Texas Responsible Artificial Intelligence Governance Act, HB 149 (2025), codified at Texas Business and Commerce Code subtitle D, chapters 551 through 554, effective January 1, 2026; the affirmative defenses appear at section 552.105(e), and the framework provision at (e)(2)(D) names substantial compliance with the most current version of the NIST generative AI profile or another nationally or internationally recognized risk management framework, within the internal-review discovery pathway rather than as a freestanding shield. Colorado Artificial Intelligence Act, SB 24-205, signed May 2024, provided an affirmative defense for substantial compliance with the NIST AI RMF, ISO/IEC 42001, or another recognized framework; its operative date was postponed twice and enforcement was stayed in litigation, and SB 26-189, signed May 14, 2026 and effective January 1, 2027, repealed and reenacted the statute as an automated-decision-making disclosure regime retaining notice, explanation, human-review, documentation, and record-retention duties without carrying the framework defense forward. ISO/IEC 42001:2023, which specifies requirements for an AI management system, was named expressly in the repealed Colorado provision; the Texas provision names no alternative framework by title, extending only to any nationally or internationally recognized one.

[4] Anthropic, Responsible Scaling Policy, first published September 2023; version 3.0 effective February 24, 2026. https://www.anthropic.com/responsible-scaling-policy. The structural point is that private governance frameworks can become public vocabulary before public law develops its own. On the legitimacy of a private laboratory writing that vocabulary, see Who Elected Anthropic?, https://vizierprime.substack.com/p/who-elected-anthropic.

[5] Dario Amodei, “We Must Pace the Frontier,” September 2026. https://darioamodei.com/post/we-must-pace-the-frontier. The essay proposes embedded third-party evaluators with employee-like access as step one, coordination among frontier companies in democratic countries to establish common safety standards as step two, and coordination with authoritarian governments as step three. Step one specifies permissions comparable to internal risk assessment teams, a right for reviewers to publish key findings without editorial control, redaction confined to security-sensitive, legally privileged, commercially sensitive, or third-party confidential material, and an express inability to redact findings for being unfavorable; Anthropic commits to it unilaterally and calls on governments to require other frontier companies to match. On step two the essay states that the most effective method of pacing is regulation covering all United States frontier companies, that passing laws can take time while AI advances quickly, that companies should therefore work voluntarily to set standards in parallel, and that for antitrust reasons it is helpful for the government to mediate or at least to issue a narrow waiver enabling such discussions. The essay also names export controls on advanced chips and semiconductor manufacturing equipment, a crackdown on unauthorized distillation, and security against model weight theft as the measures preserving the capability gap on which pacing depends. Sam Altman stated publicly within a day that OpenAI would match the first commitment.

[6] Kyle Wiggers, “AI benchmarking organization criticized for waiting to disclose funding from OpenAI,” TechCrunch, January 19, 2025. https://techcrunch.com/2025/01/19/ai-benchmarking-organization-criticized-for-waiting-to-disclose-funding-from-openai. Epoch AI disclosed on December 20, 2024, the day OpenAI demonstrated o3 against FrontierMath, that OpenAI had funded the benchmark’s creation and had visibility into many of its problems and solutions; Epoch cited contractual constraints for the timing, maintained a holdout set as an integrity safeguard, and acknowledged that contributing mathematicians had not been informed.

[7] Federal Food, Drug, and Cosmetic Act, 1938, which required manufacturers to submit evidence of safety to the Food and Drug Administration before a new drug could be marketed; Drug Amendments of 1962 (Kefauver-Harris), which added a requirement of substantial evidence of effectiveness and affirmative agency approval. The staged history is the analogy: each stage moved the decisive judgment further from the manufacturer and closer to a regulator with authority to refuse.

[8] Office of Management and Budget, “Security Authorization of Information Systems in Cloud Computing Environments,” December 2011, issued within the framework of the Federal Information Security Management Act. FedRAMP received a statute of its own through the FedRAMP Authorization Act, enacted as part of the FY2023 National Defense Authorization Act in December 2022, more than a decade after the program was already operating. https://www.fedramp.gov/program-history/. The sequence illustrates codification following operational reality rather than a program operating outside legal authority.

[9] Bureau of Industry and Security, U.S. Department of Commerce, export controls on advanced computing and semiconductor manufacturing items, beginning October 7, 2022, with subsequent expansions. The controls define performance thresholds, license requirements, and differentiated country treatment. Propagation through contract manufacturing is the mechanism described in the text: a foundry dependent on American equipment, customers, and licenses applies the resulting tier to its order book regardless of what any customer’s jurisdiction has legislated.

[10] Marc Levinson, The Box: How the Shipping Container Made the World Smaller and the World Economy Bigger, Princeton University Press, 2006. Levinson documents how the standardization of container dimensions, through ISO processes and industry coordination in the 1960s, became globally binding infrastructure. The mechanism was network effect rather than mandate.

[11] Lawrence Lessig, Code and Other Laws of Cyberspace, Basic Books, 1999; revised as Code: Version 2.0, Basic Books, 2006. Lessig’s core argument: software architecture constrains behavior by determining what is possible rather than merely what is permitted. The AI-governance extension is that conceptual architecture, including taxonomies, benchmarks, evaluation frameworks, and governance vocabularies, can govern before law appears and shape what law can say when it does.

[12] Regulation (EU) 2024/1689, the Artificial Intelligence Act. The Act establishes four risk tiers, prohibitions, mandatory conformity assessments for high-risk systems, and a general-purpose AI model regime. Obligations attach to general-purpose models generally; cumulative training compute above 10^25 floating-point operations creates a presumption of systemic risk triggering additional obligations, rather than defining the general-purpose regime as a whole. Technical annexes defining coverage and conformity requirements were developed through extensive industry consultation. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689