The governance of AI is arguably the most consequential set of decisions being made right now, and it is being made largely outside of public view, in trilogues and agency guidance documents, shaped disproportionately by the industries being governed. These seven questions lay the governance landscape bare.
The evidence of industry influence on AI governance is documented, specific, and current. Whether this rises to classical "regulatory capture", where a regulatory agency is so dominated by the industry it regulates that it primarily serves industry interests, is debated, but the influence is not.
The US picture: The US federal government has no overarching AI law as of April 2026. The Trump administration revoked President Biden's AI executive order and replaced it with one directing agencies to "remove barriers to American AI leadership", a policy explicitly framed around competitiveness over consumer protection. The vacuum has been actively shaped: Meta launched a new Super PAC ("American Technology Excellence Project") in September 2025 with tens of millions of dollars specifically to support tech-friendly candidates and oppose state AI regulation. a16z and OpenAI president Greg Brockman announced a $100 million PAC ("Leading the Future") in August 2025 for similar purposes. NVIDIA, Google, Microsoft, Amazon, and OpenAI together spent over $100 million in lobbying in 2025, more than any other industry sector except financial services.
The EU picture, more complex but not exempt: The EU AI Act was celebrated as the world's first comprehensive AI law. Corporate Europe Observatory and LobbyControl documented that 69% of European Commission meetings on AI policy in 2025 were with business groups and only 16% with NGOs. Amazon alone spent €7 million lobbying EU institutions in one year. The Digital Omnibus, proposed November 2025, would weaken key provisions of the AI Act and GDPR simultaneously, specifically expanding "legitimate interest" grounds for using personal data to train AI. The April 29, 2026 trilogue on AI Act amendments failed to reach agreement, with a Dutch MEP stating: "Big Tech is probably popping champagne." The standards that companies need to demonstrate compliance are delayed until December 2026 at the earliest.
The regulatory capture mechanism specific to AI: AI regulation requires technical expertise that is concentrated in the companies being regulated. Regulatory agencies that lack in-house AI expertise depend on industry briefings, industry-funded research, and often hire from industry. This creates structural dependency that shapes outcomes even without explicit lobbying pressure. "Regulatory capture through complexity", where the regulated industry is the only party capable of explaining the technology, is a documented dynamic in financial regulation that is now replicating in AI.
The governance process is heavily influenced by the entities being governed, this is documented, not alleged. Whether this produces captured outcomes depends on the specific provisions being contested. The most consequential battleground is not whether AI should be regulated (that question has been settled) but who participates in defining what "high-risk" means, what compliance requires, and how enforcement is resourced. Public interest organizations, civil society, and informed citizens have standing to participate in these processes, but currently participate far less than industry. Publicizing this gap is itself a meaningful act of governance.
Both questions are live legal debates with consequential real-world answers in 2026. Neither has been resolved, but courts and legislatures are being forced to stake positions.
AI legal personhood, the current legal status: No jurisdiction has granted AI legal personhood as of April 2026. AI systems are legal property, they can be owned, sold, licensed, and depreciated, but they cannot enter contracts, hold property, or be sued. The debate about whether AI should receive some form of legal status analogous to corporate personhood is mostly theoretical, driven by questions of accountability (if an AI causes harm, can it be "liable"?) rather than advocacy for AI rights. The more practical question is not whether AI has rights but who bears legal responsibility for AI conduct, and that question is unresolved in most contexts.
AI-generated IP ownership, where courts have spoken: The US Copyright Office has issued formal guidance: AI-generated works without "sufficient human authorship" cannot be copyrighted. The USCO has registered some AI-assisted works where the human contribution to selection, arrangement, and creative expression is substantial, but purely AI-generated outputs are not copyrightable in the US. The UK Intellectual Property Office position is similar. The EU AI Act does not address IP ownership directly. This creates an economic anomaly: AI can generate commercially valuable creative output at scale, but that output is immediately in the public domain, no one owns it. Companies can protect AI outputs through trade secret law (protecting the prompt and the model), but not through copyright on the output itself.
The patent question, also live: DABUS (Device for the Autonomous Bootstrapping of Unified Sentience), an AI system, was listed as an inventor on patent applications in multiple jurisdictions. Every jurisdiction rejected this: patents require human inventors. The UK Supreme Court, US Federal Circuit, European Patent Office, and Australian Federal Court all ruled that AI cannot be a patent inventor. The human who directed the AI is the inventor. This is a settled position across major jurisdictions.
What this means practically: Businesses that rely on AI to generate creative or technical content need to understand: (1) that content is not automatically protected by copyright; (2) protecting it requires demonstrating human creative contribution or relying on trade secret / contractual protections; (3) using a competitor's AI-generated content freely may be legal if the content lacks human authorship. The strategic implications of this IP gap are significant and underappreciated in current AI deployment planning.
AI legal personhood is not coming in any meaningful near-term timeframe, the legal, philosophical, and political barriers are prohibitive. AI-generated IP ownership is an active and consequential issue that is currently resolved against broad AI copyright protection. Organizations building business models on AI-generated content need a clear-eyed understanding of what legal protection that content actually has, and most do not.
This is the most actively litigated question in AI law right now. Over 70 copyright infringement lawsuits have been filed against AI developers. The largest has already settled. The fair use question will not be definitively resolved until at least summer 2026, when the first appellate-level rulings are expected.
The current state of litigation (verified, April 2026): The Bartz v. Anthropic class action, alleging Anthropic trained Claude on millions of pirated books, settled for $1.5 billion, the largest copyright settlement in US history. Final fairness hearing was set for April 2026. The New York Times v. OpenAI and Microsoft remains active in the Southern District of New York, consolidated with 12 other cases in the In re OpenAI MDL. The Authors Guild v. OpenAI class action (17 prominent authors including George R.R. Martin and David Baldacci) is active. Music publishers filed a $3.1 billion lawsuit against Anthropic in January 2026 alleging lyric training. BMG filed against Anthropic in March 2026. The Munich Regional Court ruled in November 2025 that OpenAI's use of German song lyrics to train GPT-4 violates German copyright law, among the first major European AI training rulings. Universal Music vs. Suno settled in a licensing deal; Warner settled with Udio for a strategic partnership.
The fair use question, split among three judges so far: Three US judges have ruled on fair use in AI training contexts: two found in favor of AI developers on some claims; one found against. All three rulings are nuanced and circuit-specific. No appellate court has spoken definitively. The core fair use analysis in AI training involves: (1) whether the purpose is transformative (AI defendants argue yes; plaintiffs argue training to compete is not transformative); (2) the commercial nature of the use; (3) the amount of copyrighted material copied; (4) the market harm (the strongest argument for plaintiffs, AI models that generate content competitive with the originals reduce the market for originals). Fair use remains unsettled; a clear ruling is expected no earlier than summer 2026.
The emerging market solution, licensing: Parallel to litigation, licensing markets are developing. OpenAI has licensing agreements with News Corp, Reuters, Le Monde, and Disney. Axel Springer licensed to OpenAI. These deals are confidential but represent a market acknowledgment that training data licensing is commercially rational. If courts rule against fair use for AI training, mandatory licensing frameworks (similar to music mechanical licensing) may emerge as the industry solution.
The legal question, fair use or infringement?, will be answered by courts in 2026–2028. The moral question, should creators be compensated?, is answered clearly by we: yes. The scale of economic value AI developers have extracted from creative works, without consent or payment, has produced a legitimate and serious injury to the creative community. Whether legal frameworks will require compensation is uncertain; that compensation is appropriate is not. The emerging licensing market acknowledges this, even as litigation continues.
The financial regulation analogy is one of the most productive frameworks available for AI governance, and deserves serious examination rather than reflexive dismissal from either direction.
What financial auditing actually does and why it works: Independent financial audits exist because: (1) financial institutions make decisions with consequences for people who don't have access to the institution's internal information; (2) the potential for harm is systematic (financial failure can cascade) and the harm falls on parties who did not choose to take on the risk; (3) management has incentives to present favorable information that may not reflect actual risk; (4) auditors with specialized expertise and independence can verify claims that regulators alone cannot. All four of these conditions apply to consequential AI systems, especially in healthcare, credit, criminal justice, and hiring.
What AI auditing would look like, the emerging framework: The EU AI Act requires conformity assessments for high-risk AI systems, mandatory documentation of training data, performance testing, human oversight mechanisms, and risk management. NYC Local Law 144 (2023) requires bias audits for AI hiring tools. The NIST AI Risk Management Framework provides a voluntary audit structure. The UK's AI Safety Institute conducts evaluations of frontier models. These are the building blocks of what a mandatory AI audit regime could look like, but they remain fragmented, voluntary in key respects, and without the enforcement infrastructure that makes financial auditing consequential.
The specific challenges AI auditing faces that financial auditing does not: (1) Opacity: Financial statements are standardized and interpretable. AI model internals are not, interpretability research is nascent. Auditing a neural network's decision process is not analogous to auditing a balance sheet. (2) Dynamic systems: Financial statements are snapshots. AI models can be updated continuously, changing their behavior between audit and deployment. (3) Task specificity: A single AI system may perform differently across hundreds of use cases; auditing requires specifying which tasks are in scope. (4) Contested benchmarks: The benchmarks for measuring AI performance and fairness are themselves contested, unlike GAAP accounting standards, no equivalent AI performance standard has been adopted universally.
The principle that consequential AI systems should face mandatory independent auditing with public disclosure is correct and defensible. The financial regulation analogy is apt: when private entities make decisions that affect people who cannot access the decision-maker's internal information, and when the potential for systematic harm exists, mandatory independent verification with public accountability is the appropriate governance response. Building the technical standards, independent auditor infrastructure, and enforcement mechanisms required to make this real will take years of sustained effort, and should be started now.
Yes. by design and by evidence. The US adversarial legal system was not built for AI-speed problems, and the evidence from active litigation confirms this rather than refuting it.
The timeline evidence: The New York Times filed its copyright lawsuit against OpenAI in December 2023. As of April 2026, 28 months later, the case is still in discovery. No trial date has been set. Expert reports on fair use are not expected until late 2026. An appellate ruling, the first that would create binding precedent, is unlikely before 2027 or 2028. In those 28 months, GPT-4 has become GPT-5.4; Claude 2 has become Claude Opus 4.6; Gemini 1.0 has become Gemini 3; and the models that will be trained on the legal principles established by this litigation have already been deployed and updated multiple times. Legal resolution lags the technology by a full generation.
Why the structure produces this outcome: Adversarial litigation requires: discovery (often 12–24 months for complex technology cases), expert designation and reports (6–12 months), briefing on dispositive motions (6–12 months), trial (rare in civil cases, most settle), and appeal (18–36 months). The total timeline for a complex AI case to produce final, precedent-setting appellate law is 5–10 years from filing. By that time, the technology in dispute has typically been superseded two or three times.
What would work better: Administrative rulemaking is faster than litigation and can address AI-specific issues prospectively rather than reactively, but requires legislative authorization the US lacks at the federal level. Specialized AI courts or tribunals (analogous to specialized patent courts) could develop concentrated expertise faster than general courts. Pre-market testing requirements (analogous to FDA drug approval) could address some harms before deployment rather than after. None of these exists at the scale required.
The legal system is structurally unable to provide timely accountability for AI harms in the current environment. This is not a failure of lawyers or judges, it is a structural property of a system designed for disputes between identifiable human actors with discoverable intent, applied to probabilistic AI systems operating at machine speed. The appropriate response is not to abandon legal accountability but to build faster-acting administrative and regulatory mechanisms that can operate in parallel, while litigation provides the slower-moving precedent that structures long-term accountability.
Yes, in several specific and documented ways. The existing legal framework governing political advertising, disclosure, and campaign finance was designed for mass media and does not address the capabilities that AI has introduced to political campaigning.
What AI has added to political campaigning (documented, 2024–2026): The 2024 US primary cycle produced the first documented cases of AI-generated political deepfakes used in actual campaigns: a Georgia House candidate released a synthetic audio advert mimicking Senator Jon Ossoff; robocalls in New Hampshire used a synthetic voice mimicking President Biden urging voters not to vote. The FEC has struggled to apply existing disclosure rules to AI-generated political content, existing rules require disclosure of "express advocacy" but do not clearly apply to AI-generated content that influences opinion without advocating directly. Campaign finance law does not address the economics of AI-generated content, which collapses the cost of producing political communication to near zero, eliminating one of the few barriers that spending limits were designed to address.
The psychographic targeting question: Cambridge Analytica's use of Facebook data for psychographic micro-targeting in 2016 produced years of public concern and legislative debate, without producing federal law. AI dramatically extends this capability: AI systems can infer psychological profiles from far more diverse data inputs, generate personalized messaging at the individual level without the manual creative bottleneck that previously limited personalization, and optimize in real time based on engagement signals. The economic and legal barriers that constrained 2016-era micro-targeting do not apply to AI-enabled targeting in 2026.
What existing law covers and what it misses: FEC disclosure requirements apply to paid political advertising, they do not clearly apply to AI-generated "organic" political content or to AI systems that generate and distribute personalized messages at scale below any individual spending threshold. The Federal Election Campaign Act's spending limits were designed to constrain financial resources, not AI-enabled content production that has effectively zero marginal cost. State deepfake laws (enacted in ~20 states) prohibit some uses of synthetic media in elections but are inconsistently drawn and difficult to enforce before election day, when rapid viral spread has already occurred.
US campaign finance law has not been updated for AI. The capabilities that AI introduces to political campaigning, zero-marginal-cost content production, individual-level psychographic targeting, synthetic candidate media, operate outside the categories that existing law was designed to address. The appropriate federal response, mandatory AI disclosure in political advertising, prohibition on synthetic candidate deepfakes, AI-specific campaign finance disclosure thresholds, has not been enacted at the federal level. The 2026 election cycle will be the first to operate fully under AI-capable conditions without any federal AI-specific electoral law.
This is the most pressing near-term AI legal gap, not because it hasn't been identified, but because no jurisdiction has enacted the legal framework to address it, even as autonomous AI agents are being deployed at scale in business contexts right now.
The problem, precisely stated: When an autonomous AI agent takes a consequential action, executing a financial transaction, sending a communication, modifying a system, making a medical recommendation that is acted upon, the legal chain of causation runs through: (1) the training decisions of the AI developer; (2) the configuration decisions of the deploying organization; (3) the system access granted by the operator; and (4) the specific action of the AI agent in the moment. None of these maps cleanly to the legal concepts of negligence, breach of contract, or tortious interference, which require identifiable human actors with duties, intentions, and causal responsibility. Current law has not been updated to address this multi-party, distributed-responsibility scenario.
The closest existing analogies and why they fall short: Employer liability for employees: Employees are humans with legal standing who can be disciplined, sued, and whose actions can be attributed to their employer through respondeat superior doctrine. AI agents are not employees, they have no legal standing, cannot be "controlled" in the employment law sense, and the respondeat superior analogy breaks down for autonomous systems that can take actions outside their specified scope. Product liability: A manufacturer can be liable for a defective product's harm. But product liability is designed for physical products with identifiable defects, it does not map well to probabilistic AI systems where any individual harmful output is a statistical occurrence rather than a defect.
What a functional liability framework would need: (1) Clear specification of which principal (developer, deployer, operator) is responsible for which categories of AI agent action; (2) Mandatory logging and audit trails so that post-harm analysis can reconstruct what the agent did and why; (3) Pre-deployment scope limitation requirements specifying the categories of action an agent is authorized to take autonomously vs. those requiring human approval; (4) Insurance or bonding requirements for operators deploying autonomous agents in high-stakes contexts; (5) Presumptive liability rules that make one party (the deployer) responsible as a default, with ability to shift liability to developer through indemnification agreements.
The AI agent liability gap will be resolved, the question is whether it will be resolved proactively through thoughtful legislation, or reactively through a crisis event (a harmful AI agent action of sufficient scale and visibility to force legislative response). Reactive governance in technology has a poor track record, it tends to produce rushed, poorly designed frameworks that overcorrect in ways that harm legitimate uses while not addressing the actual risk. The organizations that would benefit from advocating for proactive framework design include both the companies deploying AI agents (who need legal certainty) and the public (who needs protection from autonomous AI harm). Building that coalition is the appropriate civic role for a thought leadership organization.