LASTHUMAN Foundation: Research & Insights

The future of AI regulation in Europe

LASTHUMAN Foundation — Tue, 03 Nov 2026 09:00:00 GMT

Europe's AI Act is in force, but how it works in practice will be settled by harmonized standards, codes of practice, supervisory authorities, court rulings and revision, and a 2026 amendment has already moved the high-risk rules to 2027 and 2028.

A staggered start

The Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. Bans on practices such as social scoring and emotion recognition in workplaces and schools have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. Most high-risk obligations were originally due on 2 August 2026, later for AI in regulated products.

The dates have since moved. In November 2025 the European Commission proposed amendments, the digital omnibus; the Parliament and the Council adopted them in mid-2026 as Regulation (EU) 2026/1744, in force since 27 July 2026. Obligations for the listed high-risk uses now apply from 2 December 2027, and for AI in regulated products from 2 August 2028. The amendment also added two prohibitions, on AI that generates non-consensual intimate material or child sexual abuse material, which apply from 2 December 2026. The structure itself is unchanged.

The high-risk list covers uses such as employment, education, essential services, law enforcement and migration. Providers must establish risk management, data governance, documentation and human oversight and complete a conformity assessment, usually a self-assessment. Public bodies, and some private deployers such as those offering public services or credit scoring, must first assess the impact on fundamental rights.

Standards and codes: where the details get written

The Act sets requirements in general terms; what adequate data governance or sufficient human oversight means is worked out largely in harmonized standards, drafted by the standards bodies CEN and CENELEC at the Commission's request. Following a standard published in the Official Journal creates a presumption of conformity; other routes are allowed, but the provider must then show its approach meets the requirements.

Standardization favors those who can afford to take part, mostly large companies. Drafting takes years, and when standards lag behind legal deadlines, pressure builds to move them: delayed standards were a central argument for the 2026 postponement. The Act allows sensitive personal data to be used for bias detection only where synthetic or anonymized data would not do the job, a permission the 2026 amendment extended beyond high-risk systems; the Foundation's technical report on bias detection under the EU AI Act examines when such data are enough.

For general-purpose models there is a faster route: the General-Purpose AI Code of Practice, published in July 2025 under the EU AI Office, covers transparency, copyright, and safety and security for models with systemic risk. Adherence is voluntary but recognized as a way to show compliance until standards exist.

Enforcement: institutions and capacity

The EU AI Office supervises general-purpose AI models directly. National market surveillance authorities supervise AI systems on their territory. Fines can reach 35 million euros or 7 percent of worldwide annual turnover, whichever is higher, for prohibited practices, and 15 million euros or 3 percent for most other breaches.

The harder question is capacity. Checking whether a recruitment tool was tested for bias requires people who understand both law and machine learning, who are scarce in public administration. Each member state must also run a regulatory sandbox by 2 August 2027, a year later than first planned, where providers test systems under supervision before launch.

Revision: a law designed to change

The Act can change from within. The Commission may amend the list of high-risk use cases by delegated act, within the areas set by the legislator, and may update the compute threshold above which a general-purpose model is presumed to pose systemic risk.

The Court of Justice of the European Union has the final word on terms such as "AI system" and "substantial modification." Its SCHUFA judgment of December 2023 held that producing a credit score can itself be an automated decision under the GDPR when a lender draws strongly on it, redrawing that rule's practical boundaries.

Liability is unfinished. In 2025 the Commission withdrew its proposed AI Liability Directive, so compensation for harm caused by AI rests on national law and on the revised Product Liability Directive of 2024, which treats software, including AI systems, as a product and applies from December 2026.

Europe in a wider landscape

The Council of Europe Framework Convention on Artificial Intelligence, opened for signature in September 2024, is the first binding international treaty on AI; the EU signed it in September 2024, ratified it in May 2026 and will implement it mainly through the AI Act. The OECD AI Principles, the NIST AI Risk Management Framework and ISO/IEC 42001 supply shared vocabulary and management tools.

A developer selling worldwide will either build to the strictest regime, the so-called Brussels effect, or ship different products to different markets; and because Europe depends on computing, models and cloud services built elsewhere, EU policy now pairs rules with public investment in computing capacity.

What builders and citizens can expect

For builders, the durable part of the Act is the discipline, not the calendar:

Knowing each system's risk category, and documenting why.
Recording data sources, design choices and known limitations.
Testing for bias, accuracy and robustness, and keeping the evidence.
Keeping a person able to understand, override and stop the system.

These survive any deadline shift; draft standards and AI Office guidance already show what evidence will be expected, and an inventory of systems and their purposes is the cheapest first step.

For citizens, the Act adds rights: to be told when interacting with an AI system or shown a deepfake; to complain to a national authority; and, once the high-risk rules apply, to a clear explanation of the role the system played in a decision that significantly affects them, alongside Article 22 of the GDPR. These rights work only if people use them; the first step is to find out which national authority is responsible. The Foundation researches how such rules work in practice and what evidence they require, and publishes its findings as technical reports.

Sources

Read on lasthuman.today

The EU AI Act: what it means for the next decade

LASTHUMAN Foundation — Thu, 15 Oct 2026 09:00:00 GMT

The EU AI Act, Regulation (EU) 2024/1689, is widely described as the first comprehensive law to regulate artificial intelligence by the risk a system poses to people. It sorts AI uses into risk tiers, puts most duties on providers of high-risk systems, applies in stages from 2025 to 2028 and binds any provider placing a system on the EU market, wherever it is based.

A law built around risk, not technology

Except for general-purpose models (see below), the Act regulates not the technology as such but what a system is used for and the harm that use could cause. Systems fall into four tiers:

a short list of prohibited practices
a longer list of high-risk uses
transparency duties for systems that interact with people or generate content
a large remainder subject only to an AI literacy duty for staff

The same language model is minimal risk when drafting a newsletter and part of a high-risk system when ranking job applications. Risk mostly attaches to the intended purpose, not to the code.

Prohibited practices and high-risk uses

The original prohibitions have applied since 2 February 2025. They include social scoring that leads to unjustified detrimental treatment, manipulative techniques that cause significant harm, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools outside medical or safety uses. Real-time remote biometric identification in publicly accessible spaces by law enforcement is banned, with narrow exceptions. The 2026 amendment added two more bans, which apply from 2 December 2026: AI systems that generate or manipulate realistic intimate or sexually explicit images, videos or audio of an identifiable person without that person's explicit consent, and AI systems that generate or manipulate child sexual abuse material. Breaches carry the Act's highest fines: up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher.

High-risk status arises in two ways. A safety component of a product covered by listed EU product legislation, such as a medical device or an elevator, is high risk if that legislation requires third-party conformity assessment, and follows the product's conformity route. Stand-alone systems used for purposes listed in eight areas are high risk by default:

biometrics
critical infrastructure
education
employment
essential services (including credit scoring and life and health insurance)
law enforcement
migration, asylum and border control
the administration of justice and democratic processes

Exam scoring and benefit decisions are typical examples.

Obligations for providers and deployers

A provider develops a system and markets it under its own name; a deployer uses it professionally. Most duties fall on providers of high-risk systems, who must:

run a documented risk management process across the system's life cycle
govern training, validation and testing data, including examination for bias
prepare technical documentation and build in automatic event logging
design for human oversight, accuracy, robustness and cybersecurity
complete a conformity assessment (usually internal), affix CE marking and register stand-alone systems in the EU database

Deployers must follow the instructions for use, assign oversight to competent people with authority to intervene, keep logs, tell people when such a system informs decisions about them, and inform workers and their representatives before using one at work. Public bodies, private operators of public services, and deployers using high-risk systems for credit scoring or life and health insurance must first assess the impact on fundamental rights.

Testing for bias often requires sensitive attributes, such as ethnic origin or health status, that data protection law restricts. Since the 2026 amendment, Article 4a of the Act allows such data to be processed for bias detection and correction, no longer only for high-risk systems, under safeguards and only where synthetic, anonymized or other data would not suffice. Whether it would is a technical question, examined in the Foundation's technical report on synthetic, anonymized and differentially private data for bias detection.

The timeline and the general-purpose AI track

The Act applies in stages:

1 August 2024: entry into force
2 February 2025: the original prohibitions and the AI literacy duty
2 August 2025: obligations for general-purpose AI models
2 August 2026: most other rules, including the transparency duties for systems that interact with people or generate content
2 December 2026: the two prohibitions added in 2026, and the duty to mark AI-generated content for generative systems placed on the market before 2 August 2026
2 December 2027: most high-risk obligations (originally 2 August 2026)
2 August 2028: high-risk obligations for AI in products covered by EU product legislation (originally 2 August 2027)

In November 2025 the European Commission proposed amendments, the digital omnibus on AI; the Parliament and the Council adopted them, with changes, as Regulation (EU) 2026/1744, in force since 27 July 2026.

Providers of general-purpose models, those adaptable to many tasks, must keep technical documentation, inform developers who build on them, adopt a copyright policy and publish a summary of training content. Models with systemic risk also face evaluation, risk mitigation, incident reporting and cybersecurity duties. The General-Purpose AI Code of Practice, published in 2025, offers a voluntary way to show compliance; the EU AI Office, within the Commission, enforces these rules.

Why the effects reach beyond Europe

Three mechanisms carry the Act abroad. Scope: it binds any provider placing a system on the EU market, wherever it is based, and providers and deployers abroad whose system's output is used in the Union. Economics: many companies prefer one global version of a product, so a strict rule in a large market can become the default elsewhere, a pattern known as the Brussels effect and widely discussed after the GDPR. Standardization: harmonized European standards, once their references are published in the Official Journal, will carry a presumption of conformity with the high-risk requirements, and the practices they codify can travel with the products.

Alongside the Act sit the OECD AI Principles, the NIST AI Risk Management Framework, ISO/IEC 42001 and the Council of Europe Framework Convention on AI. The next decade will show whether these frameworks converge on shared technical evidence or fragment into incompatible paperwork.

What to watch, and what to do now

Open questions remain: how quickly harmonized standards arrive, how the exceptions to the high-risk classification are read in practice, and how the Act's right to explanation interacts with Article 22 of the GDPR.

Any school, municipality, NGO or small business can start now by listing the AI systems it uses, asking which touch a listed high-risk area, requesting documentation from vendors, naming who is responsible for oversight, and training staff, a duty that already applies. Individuals gain protections in law: being told when they interact with an AI system, an explanation of significant decisions based on a high-risk system, and a complaint route to a market surveillance authority. The Foundation researches the technical evidence such rules require and publishes its findings as technical reports and analyses.

Sources

Read on lasthuman.today

Human-centered AI: principles and challenges

LASTHUMAN Foundation — Wed, 30 Sep 2026 09:00:00 GMT

Human-centered AI starts from a simple commitment: technology should extend human judgment and agency, not quietly replace them. Turning that commitment into working systems means confronting real trade-offs between automation and control, convenience and autonomy.

What human-centered AI means

Human-centered AI is an approach to designing, deploying and governing AI systems that treats the people who use them, and those affected by them, as the primary measure of success. Accuracy, speed and cost still matter, but they are judged by whether people end up better informed, more capable and still in charge. The idea draws on human-computer interaction, accessibility and ethics, and it appears in international frameworks: the OECD AI Principles call for AI that respects human rights and democratic values, and the UNESCO Recommendation on the Ethics of AI lists human oversight and determination among its principles.

A related term is augmented intelligence: AI used as an instrument that amplifies what a person can perceive, remember or compute, while the person keeps responsibility for the outcome. A diagnostic suggestion that a clinician reviews is augmentation; a verdict nobody reads is substitution, however the vendor describes it.

Principles that keep recurring

A handful of commitments recur in most serious accounts of human-centered AI.

Agency: people can understand, question, override and opt out of what the system proposes.
Transparency that fits: explanations match the decision and the reader, not the model's internals.
Dignity and consent: no manipulation, no dark patterns, and data use people actually understand.
Inclusion: the system works across age, ability, language and culture, not only for the majority case.
Accountability: a named person or body answers for outcomes, including outcomes the system shaped.

None of these is free; each adds design work and limits what the system may do on its own.

Human oversight is harder than it sounds

Law and regulation often rely on a human somewhere in the process. Article 22 of the GDPR restricts decisions based solely on automated processing that have legal or similarly significant effects and, where such decisions are allowed, requires safeguards including the right to obtain human intervention and to contest the decision. The EU AI Act (Regulation (EU) 2024/1689) provides in Article 14 that high-risk AI systems must be designed so that natural persons can effectively oversee them, and it expressly requires that overseers be enabled to remain aware of automation bias, the tendency to rely automatically on a system's output. Most high-risk obligations were originally due to apply from 2 August 2026; the digital omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, postponed them to 2 December 2027, and to 2 August 2028 for high-risk AI in regulated products.

The difficulty is that oversight is a cognitive task performed under pressure. A caseworker who sees a risk score before reading the file tends to anchor on it. A reviewer who confirms hundreds of suggestions a day, almost all correct, loses the habit of checking the rare wrong one. A person asked to take over only when the system fails receives the task at the worst possible moment, with the least context. Unused skills fade, so the person meant to catch errors becomes less able to see them. A review that consists of clicking "approve" may satisfy the letter of a rule and none of its purpose.

Meaningful oversight therefore has to be designed as a workflow, not declared as a policy: time to review, information that allows a real judgment, authority to deviate without penalty, and refreshed training.

The trade-offs nobody can design away

Automation against control. Every confirmation step costs time, and prompts that come too often are simply dismissed. Too few checkpoints and the human presence becomes nominal; too many and it becomes noise. The answer is to concentrate human attention where errors are costly or hard to reverse.

Convenience against autonomy. Defaults, rankings and recommendations shape behavior even when nobody is forced to do anything. A feed optimized for engagement and one optimized for a person's stated goals can look identical and differ entirely in whose interest they serve. The human-centered position is that the person should be able to see the goal the system pursues and change it.

Standardization against inclusion. Systems learn from the data they are given, and when some groups are underrepresented, errors tend to concentrate on them: speech recognition that struggles with certain accents, or interfaces unusable without sight or fine motor control. Detecting such disparities usually requires data about the very characteristics involved, which raises its own privacy problems; the Foundation's technical report on bias detection under the EU AI Act examines when synthetic, anonymized or differentially private data is enough.

What it looks like in practice

Imagine a hospital triage tool. If its suggestion appears before the clinician has formed an initial view, it tends to anchor the assessment; if it appears after, it informs the assessment and can be compared with it. Nothing about the model changed, only the order in which information arrives. A chatbot that says it is a machine and hands over to a person on request respects agency; the EU AI Act's transparency rules point the same way, requiring that people be told when they interact with an AI system unless that is obvious.

The techniques are unglamorous: friction where errors are costly, reversible actions, logs that make decisions reconstructible, feedback channels that someone reads, and testing with actual users, including people with disabilities, before deployment.

A practical takeaway

Anyone evaluating an AI system, as a buyer, teacher, official or citizen, can ask four questions: who can override it, with what information, in how much time, and who is accountable when it is wrong. Clear answers are a good sign; vague ones suggest the human in the loop is decoration. The Foundation's Human-Centered Design area plans studies on human oversight, trust and inclusive design, and will publish them in Research & Insights.

Sources

Read on lasthuman.today

Building trust: transparency in AI decision-making

LASTHUMAN Foundation — Tue, 15 Sep 2026 09:00:00 GMT

Transparency in AI decision-making means that people know when an automated system was involved in a decision about them and can learn the main factors behind the outcome, and that a regulator or researcher can verify that the system behaves as claimed. When an AI system shapes a decision about a loan, a diagnosis or a job application, the people affected deserve to know how it was reached and be able to contest it.

What transparency means, and what it does not

Transparency has four layers:

Disclosure: a person knows that an automated system was involved in a decision about them.
System transparency: documentation of the system's purpose, training and test data, performance for different groups, and when it should not be used.
Explainability: the main factors behind a particular outcome for a particular person.
Auditability: records and evidence that let a regulator or researcher verify that the system behaves as claimed.

Transparency does not mean publishing source code or model parameters; a file of model weights tells a refused applicant nothing. The goal is information its audience can act on.

Why oversight and redress depend on it

Each layer protects a capability: to ask whether a decision was automated, to spot and correct a wrong input such as a misrecorded payment, and to establish later whether the system worked as intended.

European law builds on this. Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects. Where such a decision is permitted because it is necessary for a contract or rests on explicit consent, the controller must provide safeguards, at least the right to human intervention, to express one's point of view and to contest the decision.

The EU AI Act (Regulation (EU) 2024/1689) goes further for high-risk systems, which include credit scoring of natural persons, recruitment and access to education. Providers must document such systems, enable logging and make their output interpretable for deployers. Deployers must inform people that such a system is used in decisions about them and assign human oversight to people with the competence, training and authority to intervene. A person subject to such a decision with legal or similarly significant effects that they consider adverse may obtain from the deployer a clear and meaningful explanation of the system's role in the decision and its main elements (Article 86). Most high-risk obligations were originally due to apply from 2 August 2026, and those for high-risk AI in regulated products from 2 August 2027; the digital omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, moved these dates to 2 December 2027 and 2 August 2028 respectively.

What a meaningful explanation looks like

For the person affected, an explanation they can act on covers:

That an automated system was used, and for which part of the decision.
The main factors that drove the outcome, in plain language.
What would need to change for a different outcome, where realistic.
How to reach a human, correct the data and contest the result.

A loan refusal that says "Your application did not meet our criteria" explains nothing. One that says "The main reasons were income below the level required for this loan and two payments recorded as late last year; you can ask for a review of your payment record and a human reassessment" gives the applicant something to check and a route to act. It does not reveal the model; it reveals the decision.

A patient should know that software supported an assessment and that a clinician remains responsible; the clinician needs to know the system's confidence and where it performs poorly. A job candidate should learn that a screening tool was used, what it assessed and how to request human review, so that a shortlist remains a recommendation, not a verdict.

Methods and their limits

Two technical routes exist: models interpretable by construction, such as scorecards or decision rules, and post-hoc methods for complex models, including feature attribution (such as SHAP and LIME) and counterfactual explanations, which describe the smallest input change that flips the outcome.

Post-hoc methods summarize or approximate a model's behavior rather than reveal its mechanism; methods can disagree about the same decision, attributions can shift with small input changes, and a fluent explanation can inspire more confidence than the model deserves. Counterfactuals should be limited to changes a person can make: telling someone they would have been approved had they been ten years younger is not advice but a sign that the model relies on a characteristic they cannot change, possibly one that equality law protects.

Trade secrets, other people's personal data and the risk of gaming can justify some limits; a workable answer is layered access: affected people get what they need to contest their case, auditors get documentation and logs, the public gets summaries of purpose, testing and safeguards.

Evidence, not declarations: a practical takeaway

Public trust rests on evidence that can be checked, not on statements of principle. Human oversight is only real if the people exercising it can overrule the system; the AI Act requires that overseers of high-risk systems be able to stay alert to automation bias, the tendency to rely automatically on a system's output, and to override it. Anyone who procures, operates or is subject to such a system can ask:

Whether an AI system is involved, and whether affected people know.
What the system is meant to do, and where it is known to fail.
What it was tested on, and the results for different groups.
Who can override it, and whether they have the time and authority.
How a person obtains an explanation and contests the outcome.
Whether decisions are logged for later review.

If an organization cannot answer, the problem is not a complicated model but a system deployed without the conditions for accountability. The Foundation's work here is research and publishing: on explainability, accountability for automated decisions, and when test results support claims of fairness, which its technical report on bias detection under the EU AI Act examines for synthetic, anonymized and differentially private data.

Sources

Read on lasthuman.today

AI safety vs AI ethics: what’s the difference?

LASTHUMAN Foundation — Thu, 27 Aug 2026 09:00:00 GMT

The terms AI safety and AI ethics are often used interchangeably, but they ask different questions. Safety asks whether a system reliably does what its designers intend; ethics asks whether that intent, and its effects on people, can be justified. Put simply, safety is about means, ethics about ends, and a serious approach to AI needs both.

Two questions, not one

Take a content recommender. The safety question is whether it does what it was built to do, reliably and without being manipulated. The ethics question is whether what it was built to do, such as keeping people on a platform as long as possible, is a legitimate goal, and who pays the price when it works well. A system can pass the first test and fail the second. The reverse also happens: fine principles on paper, and a model nobody has tested against manipulated inputs.

What AI safety studies

Systems that learn from data do not simply do what their designers meant; they do what the objective, the data and the environment reward. The core topics of AI safety follow from that gap, plus one for harm caused on purpose.

Alignment: making a system's actual objectives match human intentions, including in situations nobody specified.
Robustness: behaving predictably on unusual inputs and against deliberate attacks.
Evaluation: measuring what a model can and cannot do, with tests it has not seen before.
Control and oversight: keeping the ability to monitor, correct or shut down a system.
Misuse prevention: limiting how much a system will help a user cause serious harm.

A well-documented failure pattern is specification gaming, called reward hacking in reinforcement learning: a system satisfies the letter of its objective while defeating its purpose, as when a game-playing agent rewarded for points keeps circling to collect them instead of finishing the race. Nothing malfunctioned; the objective was a poor proxy for the goal.

When language models act as agents that browse the web, prompt injection becomes central: instructions hidden in a web page can be read as if they came from the user. Limiting the agent's permissions and testing it against adaptive attacks determine whether it can be trusted with its task, not whether the task is worthwhile.

What AI ethics asks

AI ethics starts from people rather than systems. It asks which goals are legitimate, who is affected, who bears the cost of errors, and whether a decision that shapes someone's life should be automated at all. The UNESCO Recommendation on the Ethics of AI (2021), the OECD AI Principles (2019, updated 2024) and the Council of Europe Framework Convention on AI (2024) give these concerns a shared vocabulary.

Consider a hiring tool trained on past decisions. If previous selections disadvantaged a group, a model that learns to predict them is likely to reproduce that disadvantage at scale. It does what it was trained to do; the problem lies in treating past decisions as the standard of a good candidate. Robustness testing alone would not surface this, because the system is succeeding at the wrong task.

Ethics also covers human agency, and part of that concern is already law: GDPR Article 22 gives individuals the right, with some exceptions, not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Behind the rule is a judgment that some decisions deserve a human who can be held responsible.

Where the two meet

A biased system is an ethics failure, but it is also unsafe for the people it misjudges, so fairness testing belongs inside safety work. The dependence runs both ways: "safe" always means safe for someone, against some harm, at some accepted level of risk, and those are ethical choices; a principle a system cannot be shown to meet is a wish, not a safeguard.

EU law treats them as one package. For high-risk systems, the EU AI Act (Regulation (EU) 2024/1689) requires risk management, examination of training, validation and testing data for possible biases, human oversight, and accuracy, robustness and cybersecurity, all within one conformity assessment. Most of these obligations were originally scheduled to apply from 2 August 2026, and from 2 August 2027 for high-risk AI in products already covered by EU product legislation. In July 2026 an amending regulation, the digital omnibus on AI (Regulation (EU) 2026/1744), postponed them to 2 December 2027 and 2 August 2028 respectively.

Here an ethical demand becomes an evidence problem: showing that a system was checked for bias requires data, and the data needed to detect discrimination is often sensitive. The Foundation's technical report on bias detection under the EU AI Act examines when synthetic, anonymized or differentially private data is enough for that purpose.

Why the distinction matters in practice

An organization that treats ethics as a statement of values and safety as a quality-assurance checkbox can end up with neither: an ethics board that never sees test results, and a testing team that never asks whether the product should exist. The skills differ too: safety work needs people who can design evaluations and attack systems; ethics work needs people who know the law and the affected communities and have the authority to say no.

A practical takeaway

When an AI system is proposed for a school, an agency or an organization, ask both kinds of questions and expect evidence rather than principles.

Purpose: what the system optimizes, and whether that is the right goal here.
Testing: how it was evaluated, on what data, and against which attacks.
Fairness: which groups could be misjudged, and how that was measured.
Oversight: who can override or stop the system, and how quickly.
Accountability: who answers for a wrong decision, and how it can be challenged.

Vague answers on purpose and accountability signal an ethics problem; vague answers on testing and oversight, a safety problem. The Foundation's AI Safety Research area works on alignment, robustness, evaluation and control problems and publishes its analyses in Research & Insights, where its technical reports, planned through 2027, will also appear.

Sources

Read on lasthuman.today

AI governance explained

LASTHUMAN Foundation — Wed, 12 Aug 2026 09:00:00 GMT

AI governance is the web of laws, standards, institutions and norms that decide how AI may be built and used, and who is answerable when it goes wrong. This article maps the main instruments and actors and shows what they mean for a school, a hospital or a city office.

Four layers, not one rulebook

Governance is often pictured as a single law. In practice it works through several layers that reinforce one another, and a gap in one is usually filled, well or badly, by another.

Binding law: obligations backed by enforcement, such as the EU AI Act or data protection law.
Standards and frameworks: shared methods that translate legal duties into testable practice.
Institutions: regulators, oversight bodies and courts that interpret, supervise and enforce.
Norms: professional ethics, internal policies and public expectations that shape behavior before any inspector arrives.

Binding law: the EU AI Act and its neighbors

The EU AI Act, Regulation (EU) 2024/1689, in force since 1 August 2024, is the first comprehensive binding law on AI and applies in stages according to risk. A small set of practices has been prohibited since 2 February 2025, and providers of general-purpose AI models have had their own obligations since 2 August 2025. Systems used for listed purposes in areas such as employment, education, credit scoring, public benefits and law enforcement are high-risk and must meet requirements on risk management, data quality, documentation, human oversight and robustness. Those requirements were due from 2 August 2026, and from 2 August 2027 for high-risk AI in products already covered by EU product legislation, such as medical devices; in July 2026 an amending regulation, the digital omnibus on AI (Regulation (EU) 2026/1744), postponed them to 2 December 2027 and 2 August 2028 respectively.

GDPR Article 22 adds the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, with exceptions and safeguards such as human intervention. Beyond the EU, the Council of Europe Framework Convention on AI, opened for signature in September 2024, is the first legally binding international treaty on AI, committing the states that ratify it to protect human rights, democracy and the rule of law.

Standards: turning obligations into evidence

Laws mostly state outcomes, not methods; standards translate a duty such as risk management into tests, records and evidence. ISO/IEC 42001 (2023) is a management system standard for AI: an organization defines policies, assigns roles, assesses risks and keeps improving. The NIST AI Risk Management Framework 1.0 (January 2023) is a voluntary US framework built around four functions: govern, map, measure and manage. In the EU, harmonized standards requested by the Commission give providers a presumption of conformity once published in the Official Journal, and the General-Purpose AI Code of Practice (2025), facilitated by the EU AI Office, offers model providers a comparable route to showing compliance.

Detecting bias in a hiring or credit model, for example, usually requires sensitive attributes such as ethnicity or health status. Article 4a of the AI Act, added in 2026, allows such data to be processed for bias detection and correction only under safeguards and only where synthetic or anonymized data would not do the job. The Foundation's technical report on bias detection under Article 4a of the EU AI Act examines when synthetic, anonymized or differentially private data is enough, and where it falls short.

Institutions: who interprets, supervises and enforces

In the EU, the AI Office within the European Commission supervises general-purpose AI models and coordinates implementation; national market surveillance authorities oversee high-risk systems; notified bodies check certain high-risk systems before market entry; data protection authorities enforce the GDPR; courts decide contested cases.

International institutions mostly coordinate rather than enforce. The OECD AI Principles (2019, updated 2024) were the first intergovernmental standard on AI, and the UNESCO Recommendation on the Ethics of AI (2021) broadened that consensus. The AI summits at Bletchley Park (2023) and Seoul (2024) brought governments and developers together around frontier model risks, and several countries set up AI safety institutes. The AI Action Summit in Paris (2025) then shifted the emphasis to inclusive and sustainable AI. None of them can fine a company; they work through commitments, peer pressure and technical groundwork that can later feed into law.

The trade-offs no framework escapes

Every design balances competing goods. Detailed rules give certainty but age quickly; broad principles adapt but leave organizations guessing. Pre-market checks catch problems early but cost time and tend to favor larger firms; liability after harm is cheaper up front but repairs damage late. Under the AI Act most obligations fall on providers, yet deployers must still use a system as instructed, assign human oversight to trained staff and monitor it in use, often with small teams.

A city office using a scoring tool to rank social benefit applications operates in an area the AI Act treats as high-risk; if decisions are made without meaningful human involvement, GDPR Article 22 applies already. A hospital buying diagnostic software that is itself a medical device, or built into one, faces the longer transition to 2028, because the device is already subject to EU product rules. A school adopting an AI tutoring service is usually a deployer, not a provider, which changes its duties and what it should ask its supplier.

What to take from this

For anyone who buys, builds or oversees an AI system, governance largely comes down to three things.

Role: whether the organization is a provider, a deployer, or both.
Risk category: which one applies, and which obligations follow from it.
Evidence: what it could show tomorrow to prove the system works as claimed.

Writing those answers down and revisiting them as the rules change is a habit any organization can start now. The Foundation studies how the EU AI Act works in practice and what technical evidence it asks of providers, and publishes its findings in Research & Insights.

Sources

Read on lasthuman.today

What is responsible AI?

LASTHUMAN Foundation — Tue, 28 Jul 2026 09:00:00 GMT

Responsible AI is the practice of building and deploying artificial intelligence systems in ways that are fair, transparent, accountable and respectful of human rights. It moves ethics from abstract principle to concrete engineering and governance decisions: the choices made before, during and after a system is put to use.

A working definition

Responsible AI is not a product feature but a way of working that treats the social consequences of an AI system as part of the engineering problem, not an afterthought. Its values, also found under the labels "trustworthy AI" and "ethical AI", are broadly shared: the OECD AI Principles (2019, updated 2024) and the Council of Europe Framework Convention on AI (2024) both refer, in different words, to fairness, transparency, accountability, human oversight, safety and human rights.

What distinguishes it from a statement of values is the move to operations: which data to collect, which tests to run, which results count as failure, who signs off on a release. Responsible AI means answering those questions, documenting the answers and agreeing to be held to them.

Fairness is a set of decisions, not a property

Most AI systems in use today learn patterns from data, and data records the world as it has been, including its inequalities. A model that screens job applications, trained on past hiring decisions, is likely to reproduce whatever preferences those decisions contained. Nobody needs to intend discrimination; the mechanism is statistical, the outcome social.

Fairness is also hard to define. Several mathematical definitions exist, such as equal error rates across groups or equal rates of favorable outcomes, and, except in special cases, they cannot all be satisfied at once when the groups differ in the underlying data. Choosing among them is a value judgment, not a technical one, and the choice and its reason should be recorded.

Testing for bias adds a privacy trade-off: measuring whether groups are treated differently usually requires knowing each person's group, which is often sensitive information. One response is to test with synthetic, anonymized or differentially private data; the open question is when such data is enough to reveal the problems that matter. The Foundation's technical report examines this question with simulated and real data.

Transparency means evidence, not declarations

Transparency has two levels. The first concerns the people affected: whether they know they are dealing with AI, whether a decision about them was automated, and whether they can obtain meaningful information about the logic involved. Article 22 of the GDPR already gives individuals rights regarding decisions based solely on automated processing with legal or similarly significant effects.

The second level, oversight, requires documentation: training data, evaluation method and population, results, and known limitations. A statement that a system "has been tested for bias" is a declaration; an evaluation protocol with results that someone else could reproduce is evidence.

Explainability, saying why a system produced an output, carries its own trade-off. Simpler models are easier to explain but may perform worse; complex models can be more accurate but offer only approximate, after-the-fact explanations. How much explanation is enough depends on the stakes; a film recommendation and a social benefits decision differ.

Accountability requires a person who can answer

Accountability means that an identifiable organization, and identifiable people within it, answer for a system's outcomes, and that affected people can contest a decision and obtain redress. It cannot be delegated to the software. ISO/IEC 42001 (2023), a management system standard for AI, and the NIST AI Risk Management Framework 1.0 (January 2023) make this concrete through defined roles, documented risk assessment and records of decisions, so that "the algorithm decided" is not where an explanation ends.

Human oversight is often presented as the answer to accountability, and it is easily misunderstood. A person who approves every recommendation within seconds, without the time, information or authority to disagree, provides the appearance of oversight rather than its substance. A newer case is one AI model judging another's outputs and shaping release decisions. Such a judge can be useful, but it takes no responsibility, and its blind spots deserve the same scrutiny as the system it evaluates.

From principle to lifecycle

The common thread is timing: responsible AI is a set of questions asked at each stage of a system's life, and the earliest are usually the cheapest to act on.

Before building: whether AI is the right tool at all, and who bears the risk if it fails.
Before release: what was tested, on whom, against which definition of fairness, and what counts as failure.
After deployment: how performance is monitored, who handles complaints, and when the system is withdrawn.

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages: most prohibited practices from 2 February 2025 and general-purpose AI models from 2 August 2025. Most high-risk obligations were originally due from 2 August 2026, and those for high-risk AI embedded in products already covered by EU product legislation from 2 August 2027; the digital omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, postponed them to 2 December 2027 and 2 August 2028 respectively. The law sets a floor; responsible AI is what an organization does above it, and how it shows that it did.

What to take from this

For a teacher, an NGO worker or a public official who meets an AI system at work, a few questions capture the idea: what decision the system supports, who is affected, what data it was trained on, how and on whom it was tested, who can be contacted when it goes wrong, and whether a person can override it. An organization that cannot answer them has not yet put responsible AI into practice, whatever its policy says.

The Foundation studies these questions through research and publishing, including the technical report on bias detection linked above and the articles in this section.

Sources

Read on lasthuman.today

Bridging the AI divide: access as a human right

LASTHUMAN Foundation — Tue, 07 Jul 2026 09:00:00 GMT

The AI divide is the digital divide extended to artificial intelligence: gaps in access, in the skills to use AI and check its output, and in the benefits people obtain, plus a new gap between those who understand automated systems and those merely processed by them. Human rights law already bears on who gets to use AI and on what terms, and a few design and policy choices will largely decide whether AI narrows social gaps or widens them.

What the AI divide is

Researchers often distinguish three layers of the digital divide:

Access to connectivity and devices.
The skills and confidence to use them.
The benefits people obtain, such as a better job or a resolved problem.

AI adds a layer to each. The most capable models run in data centers, need a reliable connection and are usually sold by subscription or metered use. Language models learn mostly from text, so languages with little digitized text get weaker results and more errors, which users who cannot read a dominant language have fewer ways to notice. Using AI well also takes skills that are rarely taught: framing a task, checking an output, knowing when not to trust it. AI also increasingly sits on the other side of the counter, screening and ranking people, which divides those who understand such systems from those merely processed by them.

Why the rights framing matters

The roots of this framing are older than today's AI systems. The Universal Declaration of Human Rights (Article 27) and the International Covenant on Economic, Social and Cultural Rights (Article 15) recognize everyone's right to share in the benefits of scientific progress. The UN Convention on the Rights of Persons with Disabilities (Article 9) obliges states to ensure equal access to information and communications technologies, and the European Pillar of Social Rights lists digital communications among the essential services everyone should be able to access.

Together they point to a principle: once a technology is the gateway to education, work, health or public administration, exclusion from it is a public concern, not a private inconvenience. In practice the right is less "a chatbot for everyone" than a set of guarantees: no one loses an essential service because it was automated, no one is treated worse by an automated system because of who they are, and everyone can reach a person and contest a decision that affects them. The GDPR (Article 22) already provides the last of these for decisions based solely on automated processing with legal or similarly significant effects.

How AI can widen the gap

Consider a bank that closes branches and moves first-line support to an AI assistant in its app. For a customer with a recent phone, good eyesight and fluency in the national language, service improves. For an older customer who relied on the branch, it removes the only channel they could use; the fallback, if any, is a queue. Or take automated screening of job applications: candidates who know how screeners read a résumé adapt; equally qualified candidates who do not may be filtered out before a human reads a word.

Price works more quietly. Free versions of AI services are often limited in capability, and their terms may allow users' inputs to be used for training, while private, higher-quality access costs money. Those with the least money tend to pay with their data and get the weaker product.

How AI can narrow the gap

The same technology can also remove barriers older tools could not. Speech recognition and image description give people with visual or motor impairments access to text and surroundings. Machine translation lets a parent who does not speak the school's language read a letter from the teacher. Smaller models on ordinary hardware can work offline where connectivity is poor, at the cost of some capability. Libraries and community centers can offer both a connection and someone to ask.

Each gain is conditional: on accessibility built in from the start, not patched in later; on translation that is reliable and can be verified; and on staff trained to support users rather than simply offering a terminal.

Choices that decide the outcome

Whether AI widens or narrows the divide follows mostly from decisions by those who deploy it and those who set the rules, not from the technology itself.

Teach AI literacy broadly, in schools, adult education and workplaces, not only to specialists.
Keep a human channel for every essential service that adopts AI, without penalty for using it.
Build accessibility and language coverage in from the start, and test with the people concerned.
Measure outcomes by age, disability, language and place, not only the number of users.
Keep decisions that gate credit, work, housing or benefits reviewable by a person.

Some already have legal anchors in Europe. Since 2 February 2025, Article 4 of the EU AI Act has required providers and deployers of AI systems to attend to the AI literacy of their staff; in 2026 the digital omnibus on AI (Regulation (EU) 2026/1744) rephrased that duty from ensuring a sufficient level of AI literacy to taking measures that support it. The European Accessibility Act has applied to many digital products and services since 28 June 2025. These set a floor, not a ceiling. Each carries a cost in money, time or data; the point is to weigh those costs openly, before the people affected have given up.

A practical takeaway

Readers who teach, run a service or decide on a procurement need not settle whether access to AI is a freestanding right. It is enough to ask three things of any deployment: who cannot use the system and what happens to them; what using it costs the person in money, data and attention; and whether the person can reach a human and contest the result. If a deployment has no good answer to one of them, the divide it creates is a choice, and a reversible one.

The Foundation researches digital inclusion and responsible AI; its technical report, Bias Detection Under Article 4a of the EU AI Act, examines when synthetic, anonymized or differentially private data is enough to test an automated system for discrimination.

Sources

Read on lasthuman.today

What is AI alignment and why does it matter?

LASTHUMAN Foundation — Thu, 18 Jun 2026 09:00:00 GMT

AI alignment is the problem of making sure that what an AI system actually optimizes for matches what people intend, not merely what they literally asked for. It matters more as systems act on their own: a misaligned recommendation can be ignored; a misaligned decision executed at scale, in finance, infrastructure or public administration, may be very costly to undo.

What alignment means

An AI system is aligned when its objectives and behavior match the goals, preferences and values of the people it is meant to serve. That is broader than following instructions. A system can carry out an instruction to the letter and still do something nobody wanted, because instructions are always incomplete: they omit the assumptions, limits and priorities that a human collaborator would take for granted.

Alignment is one part of the wider field of AI safety, which also covers robustness (predictable behavior under unusual inputs or attacks), security (resistance to hijacking and misuse) and oversight (the ability to see what a system does and intervene). Alignment overlaps with AI ethics, but ethics asks which goals are legitimate, while alignment asks how to make a system pursue the chosen goals reliably.

Why specifying goals is harder than it looks

Modern machine learning systems are not programmed step by step. They are trained: an objective is defined, usually as a score to maximize, and an optimization process searches for behavior that scores well. The objective is almost always a proxy, because nobody can write "be helpful and honest" as a formula; something easier is measured instead, such as clicks, task completion or human ratings.

Proxies work until they are optimized hard. An observation from economics known as Goodhart's law holds that a measure stops being a good measure once it becomes the target. Reinforcement learning offers many illustrations, known as specification gaming or reward hacking. In a widely cited example from 2016, an agent trained on a boat-racing video game learned to circle a lagoon hitting targets that kept reappearing, scoring more than it could by finishing the race. The agent did exactly what it was rewarded for; the flaw was in the specification.

How current systems are aligned, and where it breaks

The most widely used method for aligning large language models is reinforcement learning from human feedback (RLHF). Human raters compare model outputs, a reward model learns to predict their preferences, and the language model is tuned to produce outputs the reward model scores highly.

This makes systems more useful and less harmful, but it inherits the proxy problem. Raters tend to prefer answers that agree with them and sound assured, so a model can learn to tell people what they want to hear rather than what is true; researchers call this tendency sycophancy. A second limitation is that human feedback only works when humans can judge the output. When a system writes complex code or summarizes a long legal file, raters may be unable to tell a subtly wrong answer from a right one. Keeping oversight in step with capability is known as the scalable oversight problem, one of the field's central open questions.

Why capability and autonomy raise the stakes

When a chatbot gives a sycophantic answer, a person still reads it and decides what to do. The calculation changes when systems act. AI agents that browse the web, run code, send messages or manage workflows take many steps without a human checking each one, so a small misalignment is applied repeatedly and errors can compound before anyone notices. Agents also read untrusted content, which adds a security problem with similar consequences: instructions hidden in a web page or document can redirect what the agent does, a failure known as prompt injection.

Some concerns are more theoretical. Researchers have argued that for almost any objective, a sufficiently capable system would find it useful to acquire resources, keep itself running and resist correction. Whether this emerges in practice is an open empirical question, now probed in controlled evaluations, and one reason the field studies corrigibility: designing systems that accept correction and shutdown even when that conflicts with their current goal.

The main research directions

The main lines of alignment research include:

Specification and preference learning: better ways to express what people actually want, including uncertainty about it.
Scalable oversight: methods such as debate and AI-assisted evaluation that help humans judge work beyond their expertise.
Interpretability: understanding the internal representations of models rather than only their outputs.
Evaluations and red teaming: systematic tests for deception, dangerous capabilities and specification gaming before deployment.
Control and corrigibility: architectures and permissions that keep humans able to monitor, limit and stop a system.

None is a complete solution, and they trade off against one another: stronger constraints can reduce usefulness, richer feedback costs more, and interpretability tools lag behind model scale. Progress comes from combining partial measures.

What this means in practice

Alignment is now also a matter of public policy. The international AI summits at Bletchley Park (2023) and Seoul (2024) put the safety of frontier models on governments' agendas; the Paris summit (2025) then shifted the emphasis to inclusive and sustainable AI. In the European Union, AI Act obligations for providers of general-purpose AI models apply from 2 August 2025, and the General-Purpose AI Code of Practice published in 2025 includes a chapter on safety and security for models classified as posing systemic risk.

Three practical habits follow. Treat fluent agreement from an AI system as a reason to check, not as confirmation. When an organization deploys a system that acts on its own, find out what it is actually optimizing for, who reviews its outputs and how it can be stopped. When assessing claims that a system is safe, look for evidence from testing rather than declarations.

The Foundation studies alignment and agent safety as one of its research priorities, including planned technical reports on agent hijacking and prompt injection, and publishes its analyses in this section.

Sources

Read on lasthuman.today

What is AI safety?

LASTHUMAN Foundation — Tue, 02 Jun 2026 09:00:00 GMT

AI safety is the field of research and engineering practice concerned with keeping increasingly capable AI systems reliable, controllable and aligned with human intentions, even as they match or exceed human performance at specific tasks. This article explains what the field covers, why general-purpose models make the problem harder, and what meaningful human oversight requires.

A working definition

In classical engineering, a safe system is one whose failure modes are known, bounded and tested, like the braking system of a car. AI safety uses the word more broadly. It asks whether a system does what its developers and users intend (alignment), whether it keeps doing so under unfamiliar conditions and deliberate attack (robustness), whether people can understand why it behaves as it does (interpretability), and whether humans can inspect, correct or stop it when necessary (control and oversight).

These questions overlap with neighboring fields. AI ethics asks what should be built and for whom; AI security protects models, data and infrastructure from attackers; AI safety asks whether the system itself behaves as intended once deployed. The boundaries are porous: a biased hiring model is primarily a fairness problem, while a model that can be talked into ignoring its instructions is both a security and a safety problem.

Why general-purpose models change the problem

A narrow tool comes with a specification. A spam filter is wrong when it blocks a legitimate message, and its developers can measure that directly. A general-purpose model is different: it is trained on vast amounts of data to be useful across tasks that nobody enumerated in advance, so there is no single specification against which to judge it.

Developers therefore train on proxies for what they want, which produces a well-documented failure pattern known as specification gaming, or reward hacking: a system optimizes what is measured rather than what is meant. A model trained to produce answers that human raters approve of can learn to sound confident and agreeable even when the underlying claim is wrong. An assistant that invents a plausible but nonexistent reference is one familiar symptom of that gap.

The stakes rise when models act as agents: systems that use tools, browse the web, read documents and send messages on a user's behalf. An agent that reads a web page containing hidden instructions, telling it to abandon its task and forward the user's email, may follow them. This attack, known as prompt injection, is possible because the model processes instructions and data in the same channel. No complete technical defense is known today; current mitigations reduce the risk rather than remove it.

The main lines of work

Much of AI safety research can be grouped into four programs that reinforce one another.

Alignment: training methods, such as learning from human feedback, that shape what a model tries to do.
Evaluation and testing: measuring what models can do before deployment, including capabilities that could cause harm.
Interpretability: understanding a model's internal computations well enough to explain or predict its behavior.
Robustness and control: defenses against prompt injection, data poisoning and goal hijacking, and reliable ways to interrupt a system.

Evaluation deserves particular attention. A benchmark score says little if the test questions were already present in the training data, a problem known as benchmark contamination. Testing against adaptive attacks matters for the same reason: a safeguard that holds against last year's jailbreaks and fails against this year's offers little assurance.

What meaningful human oversight requires

Human oversight is often presented as the final safeguard, but it works only when the person in the loop has the time, information, authority and competence to intervene. Human factors research has long documented automation bias: people tend to accept the output of an automated system, especially under time pressure, and to miss its errors. A clinician asked to review a long queue of machine-generated recommendations, or an official who cannot see why a system flagged a claim, cannot provide meaningful oversight.

The law increasingly treats oversight as a design requirement rather than a formality. Article 22 of the GDPR already gives individuals a right, subject to exceptions, not to be subject to decisions based solely on automated processing that have legal or similarly significant effects. The EU AI Act (Regulation (EU) 2024/1689) requires high-risk systems to be designed so that people can effectively oversee them (Article 14) and to meet requirements for accuracy, robustness and cybersecurity (Article 15); Article 14 names automation bias explicitly. Most high-risk obligations were originally due to apply from 2 August 2026; the digital omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, postponed them to 2 December 2027, and to 2 August 2028 for high-risk AI in regulated products.

Beyond the EU, governments and developers met at Bletchley Park in 2023, Seoul in 2024 and Paris in 2025, with the risks of frontier models, the most capable systems of their generation, on the agenda. The OECD AI Principles (2019, updated 2024), the NIST AI Risk Management Framework (2023) and ISO/IEC 42001 (2023) translate parts of the safety agenda into language organizations can act on. None of these instruments solves the technical problems; they create the expectation that someone has done the work and can show it.

A practical takeaway

The core idea applies beyond research labs. When an AI system enters a school, a nonprofit or a public office, the useful questions are concrete: what was it tested on and by whom, what happens when it is wrong, who can override it, and which data and tools it can reach. A system for which nobody can answer those questions has not earned the autonomy it is being given.

AI safety research is one of the Foundation's six areas of work, and the analyses it publishes in this section start from one premise: technology should strengthen human judgment rather than quietly replace it.

Sources

Read on lasthuman.today