Article
Artificial intelligence (AI) governance has grown rapidly, producing regulation and standards specifying, in increasing detail, what organizations must document, test, log and review before deploying an AI system. Yet engineers, auditors and compliance staff report that these instruments describe obligations current practice cannot straightforwardly produce, or that can be satisfied on paper without changing what a system does. This article examines that governance gap — the difference, at a specific lifecycle point, between the artifact, capability or decision right a policy instrument requires as evidence and what the parties building and operating the system can actually produce, exercise or hold — a narrower, more falsifiable construct than compliance, accountability or legitimacy. Drawing on regulation, software-engineering, sociotechnical accountability and algorithmic-auditing scholarship, the article identifies six recurring translation points along the AI lifecycle — data provenance, risk classification, evaluation, logging, human oversight and incident reporting — and six observable dimensions (availability, completeness, accuracy, currency, access, authority to act) for assessing closure. It develops a layered policy–organizational–technical model, positions it against prior auditing frameworks, proposes five testable propositions, and illustrates the model using the EU AI Act's obligations on a high-risk employment-screening system. The article concludes that closing the gap requires policy instruments to specify verifiable artifacts and decision rights rather than outcomes alone, treating compliance evidence as a first-class engineering deliverable.
Scroll to read the preview. Download for the complete document.
References
Ananny, M., & Crawford, K. (2018). Seeing without knowing: Limitations of the transparency ideal and its application to algorithmic accountability. New Media & Society, 20(3), 973–989. https://doi.org/10.1177/1461444816676645
Birhane, A. (2020). Algorithmic colonization of Africa. SCRIPTed, 17(2), 389–409. https://doi.org/10.2966/scrip.170220.389
Cihon, P., Maas, M. M., & Kemp, L. (2020). Fragmentation and the future: Investigating architectures for international AI governance. Global Policy, 11(5), 545–556. https://doi.org/10.1111/1758-5899.12890
Cors, M. S., & Thiébaut, R. (2025). Artificial intelligence and the impact of the EU AI Act in business organizations. AI Magazine, 46, e70039. https://doi.org/10.1002/aaai.70039
Costanza-Chock, S., Raji, I. D., & Buolamwini, J. (2022). Who audits the auditors? Recommendations from a field scan of the algorithmic auditing ecosystem. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency (pp. 1571–1583). Association for Computing Machinery. https://doi.org/10.1145/3531146.3533213
Council of Europe. (2024). Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225). https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=225
European Commission. (2026). Regulatory framework proposal on artificial intelligence: Implementation overview. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Official Journal of the European Union, L, 2024/1689. https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Gebru, T., Morgenstern, J., Vecchione, B., Vaughan, J. W., Wallach, H., Daumé III, H., & Crawford, K. (2021). Datasheets for datasets. Communications of the ACM, 64(12), 86–92. https://doi.org/10.1145/3458723
International Organization for Standardization. (2023). Information technology — Artificial intelligence — Management system (ISO/IEC 42001:2023).
Jaakkola, E. (2020). Designing conceptual articles: Four approaches. AMS Review, 10, 18–26. https://doi.org/10.1007/s13162-020-00161-0
Jobin, A., Ienca, M., & Vayena, E. (2019). The global landscape of AI ethics guidelines. Nature Machine Intelligence, 1, 389–399. https://doi.org/10.1038/s42256-019-0088-2
Krafft, P. M., Young, M., Katell, M., Huang, K., & Bugingo, G. (2020). Defining AI in policy versus practice. In Proceedings of the 2020 AAAI/ACM Conference on AI, Ethics, and Society (pp. 72–78). Association for Computing Machinery. https://doi.org/10.1145/3375627.3375835
Metcalf, J., Moss, E., Watkins, E. A., Singh, R., & Elish, M. C. (2021). Algorithmic impact assessments and accountability: The co-construction of impacts. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (pp. 735–746). Association for Computing Machinery. https://doi.org/10.1145/3442188.3445935
Mitchell, M., Wu, S., Zaldivar, A., Barnes, P., Vasserman, L., Hutchinson, B., Spitzer, E., Raji, I. D., & Gebru, T. (2019). Model cards for model reporting. In Proceedings of the Conference on Fairness, Accountability, and Transparency (pp. 220–229). Association for Computing Machinery. https://doi.org/10.1145/3287560.3287596
Mittelstadt, B. (2019). Principles alone cannot guarantee ethical AI. Nature Machine Intelligence, 1, 501–507. https://doi.org/10.1038/s42256-019-0114-4
Mohamed, S., Png, M.-T., & Isaac, W. (2020). Decolonial AI: Decolonial theory as sociotechnical foresight in artificial intelligence. Philosophy & Technology, 33(4), 659–684. https://doi.org/10.1007/s13347-020-00405-8
Mökander, J., Axente, M., Casolari, F., & Floridi, L. (2021). Ethics-based auditing of automated decision-making systems: Nature, scope, and limitations. Science and Engineering Ethics, 27, Article 44. https://doi.org/10.1007/s11948-021-00319-4
Mökander, J., Schuett, J., Kirk, H. R., & Floridi, L. (2024). Auditing large language models: A three-layered approach. AI and Ethics, 4, 1085–1115. https://doi.org/10.1007/s43681-023-00289-2
Morley, J., Floridi, L., Kinsey, L., & Elhalal, A. (2020). From what to how: An initial review of publicly available AI ethics tools, methods and research to translate principles into practices. Science and Engineering Ethics, 26, 2141–2168. https://doi.org/10.1007/s11948-019-00165-5
National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1). U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1
National Institute of Standards and Technology. (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1). U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.600-1
Raji, I. D., Smart, A., White, R. N., Mitchell, M., Gebru, T., Hutchinson, B., Smith-Loud, J., Theron, D., & Barnes, P. (2020). Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (pp. 33–44). Association for Computing Machinery. https://doi.org/10.1145/3351095.3372873
Rakova, B., Yang, J., Cramer, H., & Chowdhury, R. (2021). Where responsible AI meets reality: Practitioner perspectives on enablers for shifting organizational practices. Proceedings of the ACM on Human-Computer Interaction, 5(CSCW1), Article 7, 1–23. https://doi.org/10.1145/3449081
Sambasivan, N., Arnesen, E., Hutchinson, B., Doshi, T., & Prabhakaran, V. (2021). Re-imagining algorithmic fairness in India and beyond. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (pp. 315–328). Association for Computing Machinery. https://doi.org/10.1145/3442188.3445896
Selbst, A. D., Boyd, D., Friedler, S. A., Venkatasubramanian, S., & Vertesi, J. (2019). Fairness and abstraction in sociotechnical systems. In Proceedings of the Conference on Fairness, Accountability, and Transparency (pp. 59–68). Association for Computing Machinery. https://doi.org/10.1145/3287560.3287598
Snyder, H. (2019). Literature review as a research methodology: An overview and guidelines. Journal of Business Research, 104, 333–339. https://doi.org/10.1016/j.jbusres.2019.07.039
Sovrano, F., Hine, E., Anzolut, S., & Bacchelli, A. (2025). Simplifying software compliance: AI technologies in drafting technical documentation for the AI Act. Empirical Software Engineering, 30, Article 91. https://doi.org/10.1007/s10664-025-10645-x
Stampernas, S., & Lambrinoudakis, C. (2025). A framework for compliance with Regulation (EU) 2024/1689 for small and medium-sized enterprises. Journal of Cybersecurity and Privacy, 5(3), Article 40. https://doi.org/10.3390/jcp5030040
UNESCO. (2021). Recommendation on the ethics of artificial intelligence. https://unesdoc.unesco.org/ark:/48223/pf0000381137
Veale, M., & Zuiderveen Borgesius, F. (2021). Demystifying the draft EU Artificial Intelligence Act. Computer Law Review International, 22(4), 97–112. https://doi.org/10.9785/cri-2021-220402
Whetten, D. A. (1989). What constitutes a theoretical contribution? Academy of Management Review, 14(4), 490–495. https://doi.org/10.5465/amr.1989.4308371
Widder, D. G., & Nafus, D. (2023). Dislocated accountabilities in the "AI supply chain": Modularity and developers' notions of responsibility. Big Data & Society, 10(1). https://doi.org/10.1177/20539517231177620
Metrics are updated in real time as the article is accessed and downloaded.
Comments
Leave a Comment