The complexity of AI policy appears not only in the content of policy, but also in the question of who makes and implements policy. In traditional policy models, the government generally defines the problem, creates laws and institutions, and then companies and citizens comply with them. In the case of AI, however, this government-centered policy model alone is insufficient to manage rapidly changing technologies and their diverse social impacts effectively.

AI technologies are developed largely by private companies and research institutions. Data and computing infrastructure are also concentrated significantly in the private sector. In many cases, companies and researchers possess more specialized knowledge about how AI systems actually work than governments do. At the same time, the impacts of AI extend beyond industry and markets into labor, education, culture, media, human rights, security, and democracy.

Therefore, AI policy needs to move beyond the traditional regulatory model in which the government unilaterally creates rules and companies comply with them. What is required is multi-level governance, in which multiple actors—including governments, firms, research institutions, civil society, users, and international organizations—participate with different roles and responsibilities, and in which multiple policy levels—central and local, national and international—interact with one another.

From Government-Centered Policy to Multi-Level Governance

Governance is a concept distinct from government. Government refers to a mode of addressing social problems centered on institutional actors that possess formal authority and legal coercive power. Governance, by contrast, refers to a broader system of solving policy problems through relationships and coordination among various actors, including not only governments but also firms, civil society, expert groups, and international organizations.

An important background to this shift is the reality that, in modern society, governments can no longer monopolize the knowledge, resources, and implementation capacity needed to solve complex problems. Addressing complex policy issues inevitably requires interdependence among organizations with different resources and expertise. As a result, coordination through networks that include both governmental and non-governmental actors has become more important than unilateral command and control by the state.

The core of governance is not merely that more actors participate in policy. Rather, it lies in how to coordinate interdependent actors in a situation where no single actor can monopolize the resources and capabilities needed to solve the problem (Rhodes, 1996).

This issue appears even more clearly in AI policy.

Because AI technology develops extremely quickly, and because much of the relevant technical expertise, computing infrastructure, and data is held by private firms, it is unrealistic for governments to identify every technological change in advance and create rules for each one. Moreover, the risks of AI are not determined by the technology alone, but vary depending on the domain and manner in which it is used. The same AI model may require different levels of safety and accountability when used in healthcare than when used in entertainment.

Ultimately, the traditional one-directional policy model, in which governments make rules and companies follow them, is insufficient to respond to the opportunities and risks of AI, which changes rapidly and is applied across diverse domains.

Therefore, in AI policy, collaborative governance becomes important. Rather than deciding everything in advance, governments should set basic principles and boundaries of responsibility. Firms and experts should develop technical standards and implementation methods. Civil society and users should participate in and monitor the process.

This does not mean that the role of government is reduced. Rather, it means that the role of government expands and changes: from direct control toward connecting and coordinating the capacities and responsibilities of multiple actors.

The discussion of responsible innovation offers important implications for how such governance should work in practice. In order to responsibly manage the social impacts of new technologies, four elements are necessary: anticipation, which means examining possible future impacts and risks in advance; reflexivity, through which actors developing and using technology continuously reflect on their purposes, values, and responsibilities; inclusion, which incorporates diverse stakeholders and social perspectives into decision-making; and responsiveness, which enables the direction of technology and policy to be adjusted when new knowledge, risks, and social demands emerge (Stilgoe et al., 2013).

These four elements show that AI governance is not sufficient simply because multiple actors participate in decision-making. What matters is building a structure of learning and coordination that continuously observes changing technologies and risks, reflects diverse social values and interests, and revises the direction of policy and technology in response.

In this respect, AI governance should be understood not as a one-time institutional design that creates fixed rules, but as a continuous process of learning and adjustment in response to technological and social change.

The multilayered character of AI governance begins within government itself.

AI cuts across multiple policy domains at the same time, including science and technology, industry, personal information, competition, labor, education, culture, and national defense. The expertise of individual ministries alone is therefore insufficient. Inter-ministerial coordination and policy consistency are essential in order to connect different policy goals and instruments.

At the same time, AI policy is not only a matter for central government. Many areas in which AI is applied to citizens’ everyday lives—transportation, welfare, healthcare, education, disaster management, and urban administration—are closely connected to local governments. If the central government establishes basic norms, infrastructure, and safety standards, local governments can develop AI services suited to regional characteristics and conduct policy experiments.

AI policy therefore requires both horizontal coordination within government and vertical coordination between central and local governments.

New Governance Created by Firms and Technology

One of the important features that makes AI governance difficult is information asymmetry between governments and firms. In frontier AI, the firms that develop the technology may possess far more information than governments about the capabilities and limitations of models, training processes, and safety issues. In the case of foundation models and advanced AI systems in particular, technical information and expertise may be concentrated in a small number of firms.

If governments fail to secure sufficient technical expertise, the effectiveness of regulation may weaken, and the risk of regulatory capture may increase. Regulatory capture refers to the problem in which regulations created for the public interest come to operate in ways favorable to the regulated industry because of that industry’s interests and influence (Stigler, 1971). In a field such as AI, where the gap in technical information and expertise between governments and firms is large, regulatory agencies may become overly dependent on the information and judgments provided by firms.

Therefore, one of the important capacities of government in AI governance is to secure the technical expertise and assessment capacity needed to verify information provided by firms and independently judge risks.

At the same time, AI companies are not only objects of government regulation. They are also important actors that make AI governance function in practice. Decisions about what data to use in developing models, what safety mechanisms to apply, what kinds of content generation to restrict, and how to protect users’ personal information are made largely within companies.

In the case of generative AI and foundation models in particular, model design and usage policies themselves have broad effects on user behavior and the information environment. In this sense, AI companies become quasi-governance actors that do more than simply receive regulation: they create and enforce rules in practice.

However, governance cannot rely solely on corporate self-governance. The economic interests of firms and the public interest do not always coincide. At the same time, it is also unrealistic for governments to directly determine every detailed rule and technical standard in a rapidly changing technological field.

To overcome these limitations, approaches have developed that do not treat government regulation and corporate self-regulation as mutually exclusive choices, but instead combine multiple regulatory instruments according to context (Ayres & Braithwaite, 1992). This is why co-regulation becomes important in AI governance. Governments can set basic principles and boundaries of responsibility, while combining corporate self-regulation, industry standards, certification, and independent audits and assessments.

Furthermore, in the AI era, law is not the only force that creates social rules. It has long been emphasized that human behavior in cyberspace is regulated not only by law, but also by social norms, markets, and code and architecture. In particular, the technical design of a system itself determines what is possible and impossible. This insight is captured in the phrase “code is law” (Lessig, 1999).

This insight becomes even more important in the AI era.

Questions such as what data can be accessed, what content can be generated, how personal information is processed, and whether humans can modify or refuse AI judgments are not determined solely by legal provisions. In practice, they are implemented to a significant extent through how models and systems are designed and what technical restrictions and safety mechanisms are applied.

Even if the law prohibits a particular use of AI, regulatory effectiveness is difficult to secure unless there is a technical means of identifying and blocking that use. Conversely, if certain actions are restricted at the system-design stage, or if possibilities for human intervention and control are guaranteed by design, legal principles can be technically implemented.

Therefore, in AI governance, law, technical standards, code and system architecture, and corporate internal rules should not operate separately. They need to be connected in a complementary way.

If law defines the basic principles and responsibilities that society demands—that is, what must be protected—then technical standards and system design translate those principles into the question of how they should be implemented. In AI, where technological change is rapid and system complexity is high, legal principles, technical standards, and system design must be connected within a single governance framework.

From Citizen Trust to Global Cooperation

The scope of AI governance cannot remain limited to the relationship between governments and firms.

For AI to be socially accepted and sustainably used, citizen trust is as important as technological performance or legal regulation. Questions such as what kinds of AI use should be socially permitted, to what extent personal information may be used, and what degree of explainability and human intervention should be required in algorithmic decisions involve choices about social values that cannot be resolved by technical judgment alone.

If such issues are decided only by governments, firms, and technical experts, policy may secure a certain level of technical validity, but it will be difficult to obtain sufficient social legitimacy and trust.

Therefore, civil society and users should not remain merely as actors who monitor AI risks or provide opinions after policy decisions have already been made. They should become important actors in governance who help form socially acceptable standards for AI, identify new risks and side effects, and ensure that social values are reflected in the direction of technological development.

Trust in AI is not created by the belief that technology is perfectly safe. Rather, it is formed through institutional confidence that when problems occur, people can identify them, raise objections, hold actors accountable, and, where necessary, revise policies and systems.

In this sense, citizen participation and trust are not constraints on AI innovation. They are the social foundation for sustainable AI.

AI governance also inevitably extends beyond national borders.

AI models and services can be developed in one country and provided almost simultaneously to users in another. Data and content also move across borders. In this sense, AI services are global from the beginning.

The risks of AI do not remain within national borders either. Bias or safety problems in an AI system developed in one country, privacy violations and copyright problems, misinformation, and cyber risks can quickly spread to other countries and societies. This is the fundamental reason why national regulation alone is insufficient to address the problems of global AI.

This issue was raised even before AI acquired its current level of social influence. The Wave of Superintelligence (2019) argued that the development and control of artificial intelligence could not remain a problem for particular firms or countries alone, and that as the risks became more real, a collective response by the international community would be necessary. In particular, considering the possibility that the ownership and control of AI could develop beyond economic interests into questions of national security and international order, it raised the need to explore an open governance system involving multiple countries and stakeholders, similar to internet governance (Hyun, 2019).

Now that generative AI and global AI platforms have become a reality, this issue is no longer limited to discussions that assume a future superintelligence.

Of course, global AI governance does not mean a single world government or a single international regulation. Each country has different legal systems, social values, industrial structures, and security interests. It is therefore neither realistic nor desirable to apply the same rules to every AI issue.

What matters is to maintain national regulation while developing common principles and technical standards for risks that arise across borders, sharing safety assessment results and risk information, and building international cooperation mechanisms for problems that cannot be solved by one country alone.

Ultimately, the task of AI governance is not simply to distribute governmental authority to other actors. What matters is to build a structure in which actors with different capacities and interests participate, while their respective roles and responsibilities operate clearly.