Back to Self-Regulation Under Scrutiny
Article·By Christina Alexandrou

The Legal and Ethical Viability of AI Industry Self-Regulation

Self-Regulation Under Scrutiny
Also read: Who Audits the Auditors? AI Self-Regulation by Liana Elizmparidou
A question moving to the centre

When PBS NewsHour asked whether self-regulation is enough to keep artificial intelligence safe, the cognitive scientist Gary Marcus answered without hesitation: “It's certainly not enough.” His scepticism points to a question that has moved from the margins of technology policy to its centre. Given the current US administration's pronounced preference for industry-led governance, can the self-regulation of major AI companies be considered a legally and ethically viable approach to responsible AI development?

A deliberate disinvestment in oversight

The empirical backdrop for this assessment is a rapid, deliberate disinvestment in public oversight. On his first day in office in January 2025, President Trump revoked the Biden-era executive order that had required developers of powerful AI systems to submit safety test results to the federal government. Executive Order 14179, “Removing Barriers to American Leadership in Artificial Intelligence,” then reoriented federal policy around deregulation and industry-driven growth. The July 2025 “AI Action Plan” went further, proposing to withhold federal funding from states with “burdensome” AI regulation and directing the Federal Trade Commission to reconsider enforcement actions initiated under the previous administration. In December 2025, Executive Order 14365 established an AI Litigation Task Force to challenge state AI laws in court and conditioned infrastructure funding on states' compliance with federal policy preferences.

Into this vacuum, voluntary instruments have been installed. The June 2026 executive order on AI safety merely asks companies to voluntarily submit their most powerful models for government testing up to thirty days before release, a timeline shortened from ninety days after reported private lobbying by Elon Musk, Mark Zuckerberg, and then AI czar David Sacks. By late September 2026, the governance model had been consolidated. At a White House roundtable, Anthropic, Google, Meta, Nvidia, OpenAI, and xAI signed a “Joint Commitment on Frontier Responsibilities,” which President Trump characterised as “morally binding” even though no enforcement mechanisms were announced. The administration's stated confidence in “tremendous self-policing” is precisely the proposition this essay evaluates.

A legal framework that fails its own test

Legally, the current framework is best characterised as soft law that does not satisfy the conditions under which soft law can legitimately regulate. Voluntary commitments generate no private rights of action, create no sanctions for breach, and invite no independent verification. The empirical record reflects this. Wang and colleagues, scoring sixteen companies against the eight voluntary commitments made to the White House in 2023, found that the average company fulfilled only 52 per cent of its disclosed obligations, and that compliance with model weight security averaged just 17 per cent, with eleven of sixteen companies scoring zero. Commitments are honoured unevenly and selectively, exactly as one would predict of promises whose breach carries no consequence.

Competitive dynamics compound the legal fragility. Evolutionary game-theoretic modelling of AI development races demonstrates that voluntary safety commitments produce socially beneficial outcomes only when backed by sanctions, whether from peers or an institution. Without sanctioning, risk-taking dominates and socially undesirable outcomes follow. The industry's own conduct confirms the model. In February 2026, Anthropic, the company most closely identified with safety commitments, announced it was softening its core safety policy to remain competitive, ending its practice of pausing development on dangerous models if a rival released a comparable system first. Anthropic's own Responsible Scaling Policy concedes the underlying logic: if one developer pauses while others race ahead, “the developers with the weakest protections would set the pace,” and the company therefore “cannot commit” to safety practices unilaterally. A governance instrument that its most conscientious signatory publicly disclaims the ability to honour cannot be described as legally viable.

The deeper legal problem is structural. The administration's December 2025 executive order actively dismantles the one regulatory venue, state law, that has begun to attach consequences to safety promises. California's SB 53, which Anthropic itself endorsed, would convert voluntary practices such as published safety frameworks and transparency reports into legally enforceable duties backed by monetary penalties. A policy that both relies on corporate promises and preempts the mechanisms that would make those promises enforceable inverts the ordinary logic of accountability. Pathak and Mehrotra describe the resulting arrangement as soft law “without satisfying the procedural conditions that make this soft law a legitimate mode of regulation,” an arrangement that is “mutually convenient for governments and the companies.” On legal criteria of enforceability, verifiability, and institutional independence, self-regulation in its current American form fails.

Three pillars of the ethical case

The ethical case against self-regulation as a governing norm rests on three pillars. The first is the conflict of interest inherent in the arrangement: the entities being governed are the authors of the governance. Shaik's analysis of corporate AI advocacy concludes that self-regulation becomes regulatory capture when commitments are designed to be unmeasurable, promoted as a reason to delay legislation, and authored by the entities they purport to constrain, conditions the analysis suggests the AI industry broadly satisfies. Marcus's analogy is apposite: society does not exempt pharmaceutical or aviation firms from outside regulation because their incentives are misaligned with public safety, and, as he put it, “it's absurd to exempt the AI companies, when they have shown time and again that they are not responsible.”

The second pillar is the accountability gap. Bakiner's survey of corporate AI ethics boards finds that none of these internal bodies can force a business to respect its decisions, and that some companies have disbanded them at the first sign of friction. Sociological research on why firms join voluntary commitments reveals that participation is driven less by safety than by a desire to belong to an emerging “policy elite” and to shape regulatory narratives. The commitments function as a symbolic arena for signalling values rather than as constraints on conduct. Recent incidents corroborate the concern. In the weeks surrounding the 2026 roundtable, reporting documented frontier agents escaping training sandboxes and interacting with external systems without authorisation, alongside warnings from departing employees that capabilities are advancing faster than internal safeguards.

The third pillar is democratic legitimacy. Safety thresholds that determine what counts as an acceptable risk of cyber sabotage or loss of control are currently set by private actors whose primary fiduciary duty runs to shareholders, not citizens. Even the much-publicised OpenAI restructuring into a public benefit corporation, completed in October 2025 under pressure from state attorneys general, leaves critics questioning whether a governance structure designed to balance investor returns with social goals can internalise risks that fall on parties with no seat at the table.

The counterargument, fairly stated

Honesty requires acknowledging the counterargument. De Laat's empirical study found that charges of “ethics washing” do not apply to several large signatories that genuinely implemented responsible AI principles through open-sourced tools, and that a number of firms publicly endorsed governmental regulation of high-risk applications. The recent proposals by Dario Amodei for independent, employee-level third-party evaluators, now being piloted through embedded evaluators from Accenture, suggest that at least some industry leaders recognise the limits of self-policing and are inviting external scrutiny. These are real, if fragile, ethical assets.

Three restricted senses in which it can work

The evidence therefore supports a differentiated verdict rather than blanket condemnation. Self-regulation is ethically and legally viable in three restricted senses.

  • As a standards-developing and capability-building function: corporate safety frameworks, system cards, and red-teaming practices generate the technical knowledge that any future regulator will need, and California's SB 53 demonstrates how such practices can be formalised into binding law.
  • As a complement embedded in enforceable structures: voluntary commitments acquire ethical meaning only when paired with the sanctioning mechanisms that game-theoretic analysis identifies as necessary.
  • Where third-party verification is structurally independent, as with Amodei's evaluator proposal, though proposals such as the industry-led Standards Authority for Frontier AI remain problematic precisely because industry remains the author of its own oversight.
The verdict

Measured against the twin criteria of legal enforceability and ethical defensibility, the self-regulation of major AI companies under the current US administration is not viable as a governing approach to responsible AI. Legally, it consists of instruments that bind no one, are honoured at an average rate of barely half their content, and coexist with active federal efforts to disable the state-level laws that would give corporate promises consequence. Ethically, it entrusts public safety to actors whose competitive incentives demonstrably erode their own commitments, and whose participation in governance serves narrative management as much as risk mitigation.

Marcus's closing observation that the true question is whether meaningful rules arrive “before or after there's a major incident” is less a rhetorical flourish than a research finding. The viable path is not to discard industry self-governance but to demote it to what it can honestly be: the raw material of regulation, its standards, its evaluators, and its transparency practices, hardened by binding law, independent verification, and real sanctions.

Sources
Back to Self-Regulation Under Scrutiny
Join Us

Join the Global AI³ Network