AI ethics principles are easy to write and difficult to enforce.

The gap between stating a principle and enforcing it matters more than the wording of the principle. A company can say it values fairness, transparency, accountability, privacy, and human oversight, and it may mean it. But without clearly assigned responsibilities, meaningful accountability, mechanisms to test behavior, and consequences for failure, those statements do not constrain what the company does.

AI makes this problem harder for software. Traditional models of professional responsibility do not fit the way software is built. A doctor can be held responsible for a diagnosis because the decision is usually attributable to the doctor. Software rarely works that way. A product decision, data choice, architecture tradeoff, model behavior, design constraint, release deadline, and legal interpretation all combine before the system reaches a user.

So when an AI system harms someone, the question is not only who wrote the code. It is also:

• Who specified the behavior?
• Who selected the training and evaluation data?
• Who accepted the product risk?
• Who decided the human review was sufficient?
• Who monitored failures after release?
• Who had the power to stop deployment?

Professionalism is not enough

One proposed answer is to treat software engineers more like licensed professionals. The idea has some merit. Software systems now shape medicine, finance, transport, hiring, speech, policing, and public administration. The people who build them often have less formal accountability than practitioners in older professions whose mistakes affect fewer people.

However, software is rarely produced by a single professional exercising independent judgment. The engineer may understand the technical risk but lack authority over the business requirement. The product leader may own the user experience but not understand what causes the model to fail. The data team may know the bias in the dataset but not own the release decision. The legal team may approve a disclaimer that is formally defensible but of little practical use to users.

Licensing individual engineers would not solve that allocation problem on its own. It may raise the baseline of competence, and it may give engineers a stronger basis for refusing reckless work, but AI responsibility has to be assigned at the system level. Accountability has to include the organization, not just the coder.

Soft law needs enforcement

That is why proposals for AI governance bodies are worth taking seriously. A global or international coordinating body for AI and robotics would not solve enforcement on its own. It could help coordinate existing forms of soft law: professional guidelines, research norms, insurance requirements, audit expectations, procurement rules, and sector specific regulation.

This matters because AI systems cross borders more easily than laws do. The GDPR gives people enforceable rights within the European Union, but many AI harms do not stay in one jurisdiction. A model may be trained in one country, deployed by a company in another, served through infrastructure in a third, and used on people who live everywhere.

Without institutions that connect principles to incentives, companies comply where enforcement exists and treat the rest as optional.

The useful governance question is therefore not what AI should value. It is which institutions can attach real costs to ignoring those values.

Collective intelligence has limits

Governance is not only about assigning responsibility after a failure. It is also about ensuring that the decision-making processes themselves remain reliable.

Collective intelligence adds another complication. Crowds can outperform individuals. Aggregated judgment can be more accurate and more stable than the judgment of any one participant. This holds in markets, elections, forecasts, open-source communities, and scientific review.

But crowds also herd. Social influence can make a group less accurate when people stop contributing independent judgment and start copying visible signals. Once that happens, the group amplifies a shared signal instead of aggregating independent ones.

This matters because many AI systems operate through feedback loops. Users rate content, models learn from users, recommender systems shape what users see, users respond to what was recommended, and the next version of the system absorbs the pattern. The crowd is part of the system rather than an external check on it.

So the question is not whether collective intelligence is good or bad. It is whether the system preserves enough independent signal for aggregation to work, and whether it can detect when influence has collapsed into herding.

Technology reveals rights

Technology also changes which rights become practically important.

The right to be forgotten, the right to public anonymity, and the right to disconnect are useful examples. These rights did not become meaningful because human interests changed. People always had interests in privacy, dignity, rest, and control over reputation. What changed was the power technology put in others’ hands.

Search engines, social media, facial recognition, cheap storage, workplace messaging, and always-on devices shifted that power. One person, company, or state can now remember, locate, classify, and interrupt another person at a scale that older social norms were not built to handle. The underlying interest existed earlier, but the corresponding duty became visible only when technology made the imbalance large enough to matter.

That is the argument for treating some rights as “revealed” by technology. These interests are not new; however, the imbalance of power that makes them urgent certainly is.

The actual work

AI governance will not be solved by choosing between ethics, law, or engineering. It needs all three.

Engineering provides evaluation, testing, audits, monitoring, incident response, system design, and evidence.. Law provides duties, remedies, procedures, and consequences. Ethics provides a way to describe what is at stake before the law addresses it.

The practical work is to connect them:

• Turn principles into concrete release criteria by requiring model cards, evaluation reports, deployment gates, rollback procedures, and incident reviews before and after release.
• Treat datasets, prompts, models, and evaluations as governed artifacts.
• Make responsibility traceable across product, engineering, data, legal, and leadership.
• Preserve independent human judgment where collective intelligence is being used.
• Recognize new technological rights before harm becomes normalized.
• Build institutions that make serious AI failures visible, attributable, and costly.

The test of AI governance is not whether an organization can write a responsible AI policy. It is whether, when the system fails, the organization can identify who was responsible for assessing the risk and whether that person had the authority to act on it. An organization that cannot answer has a policy, not governance.

References

Danny Tobey, “Software Malpractice in the Age of AI: A Guide for the Wary Tech Company”, AIES 2018.

Wendell Wallach and Gary E. Marchant, “An Agile Ethical/Legal Model for the International and National Governance of AI and Robotics”, AIES 2018.

Camelia Simoiu, Chiraag Sumanth, Alok Mysore, and Sharad Goel, “Studying the Wisdom of Crowds at Scale”, HCOMP 2019.

Jack Parker and David Danks, “How Technological Advances Can Reveal Rights”, AIES 2019.