Every major technology regulation arrives after the harm has already been distributed. This is not a failure of government. It is a structural feature of how innovation and accountability interact.

There is a pattern in the history of technology regulation that is consistent enough to be called structural. A new technology is developed and deployed. Early adopters benefit. Harms accumulate, initially in populations with limited political voice. The harms become visible enough that they cannot be ignored. Regulatory frameworks are proposed, debated, and eventually implemented. By this point the technology has been operating for years or decades and the early harm has already been distributed. Seat belts. Leaded petrol. Social media and adolescent mental health. The sequence is the same every time. AI is following it at a speed that makes the governance lag more consequential than in most previous cases.

What the Governance Gap Actually Means

In my technology and AI course I use a framework built around five analytical lenses: Governance Lag, Tradeoffs, Power and Autonomy, Escalation, and Incentives. The governance gap is not primarily a legal problem. It is an accountability problem. In the absence of regulatory frameworks, the question of who is responsible when an AI system causes harm is genuinely unclear, and that unclarity is not accidental. It is structurally useful to the parties that deploy the systems. The European Union’s AI Act, which came into force in 2024, represents the most comprehensive attempt yet to regulate AI by risk category. It is an important development that is already responding to a technology landscape that continued to develop during the years it took to pass.

The public has already noticed the gap. In the Stanford AI Index 2026, 46% of Koreans say they trust their government to regulate AI responsibly, below the global 54% and far behind Singapore at 81% (Chapter 9, Figure 9.3.1). Inside companies the vacuum is the same shape: policy arrives after practice, and people have stopped waiting for it.

The Tradeoffs Lens

Every technology deployment involves choices between competing values, and those choices are made by specific parties for specific reasons, not by the technology itself. An AI system that improves hiring efficiency creates a tradeoff. Speed and cost reduction on one side. The risk of systematic bias and reduced accountability on the other. That tradeoff is made by the organisation deploying the tool. The technology does not make the tradeoff. People do. And the tradeoff is almost always made by parties who benefit from the efficiency gains and bear limited direct cost from the risks.

A Worked Example: The Credit Model in Yeouido

Hana is a 41 year old compliance manager at a mid sized consumer lender in Yeouido. Last year her company started using a machine learning model to recommend credit limits. A loan officer reviews every recommendation and clicks approve. In practice, each officer handles around two hundred files a day and overrides almost none. When a customer complained that his limit had been cut without explanation, the company’s first answer was that a person had made the decision. Technically, that was true.

This is the tradeoffs lens in a single click. The company gained speed. The customer carried the risk. And the governance gap was filled with a procedure that looked like human judgment but was not. Korea’s privacy regulator has already named this pattern. The Personal Information Protection Commission treats a decision as automated where there is no substantive intervention by a person with proper authority, and notes that a process with only formal sign off steps can still count as fully automated.

What the Korean AI Basic Act Settles, and What It Leaves Open

Korea’s AI Basic Act came into force on 22 January 2026, and it closes part of the gap. According to the Ministry of Science and ICT announcement on 정책브리핑, a business must tell users in advance when its product or service uses high impact or generative AI, and a system in which a person intervenes in the final decision is treated as controllable and falls outside the high impact category. The ministry also said it would defer regulation for at least a year so that companies have time to prepare.

The left column is the gap closing. The right column is the gap that remains. Notice that the second row cuts both ways: the exemption for a human final decision only works if the human is real. Hana’s loan officers, with two hundred files a day and no practical power to disagree, are exactly the kind of review the privacy regulator would not count.

The same logic holds outside Korea. The NIST AI Risk Management Framework, released on January 26, 2023, is intended for voluntary use, and it names Govern alongside Map, Measure and Manage as one of its elements. Voluntary is the important word. Until a rule makes you, governance is something you choose to do.

What This Means for Professionals Using AI Tools

The practical implication for any professional using AI tools is that they are operating in a governance gap right now. That does not mean AI tools should not be used. It means the professional using them retains responsibility for the output, regardless of what the tool produced. Research from the OECD on AI accountability consistently finds that the framing of AI as a decision maker rather than a decision support tool is one of the most significant contributors to accountability failures. The tool did not decide. You decided with the tool’s assistance. The distinction matters most when something goes wrong. The professionals and organisations that develop clear internal accountability frameworks for AI use before regulation forces them to will be significantly better positioned than those that wait.

Hana did this for her team in a single afternoon. The step that changed something was the second one. The company now caps the number of files each officer reviews in a day and asks for a written reason whenever an officer approves a lower limit. That costs speed. It is also the first point at which the person in the loop can genuinely disagree with the model.

You do not need to work in finance to run the same afternoon. A marketing team that lets a tool pick which customers get a discount, or an HR team that lets one rank internal applicants, is making decisions about people in exactly the same gap. Start with the list. Most teams find at least one tool on it that nobody remembers approving.

Fold the checklist into your quarterly communication audit, and use The Offload Line to decide which parts of a task a tool should never own. The Long Game tests whether your own judgment holds once pressure arrives. For the cultural side, the AI conversation nobody is having at work and the escalation ladder show how small gaps become large ones, and why AI literacy can no longer be optional covers the skills underneath.

→ The governance and accountability frameworks in this article are drawn from my technology and AI course. I bring these to corporate and institutional audiences through speaking engagements and workshops. The Work With Us page has the details.

---

Update, September 2026: Two developments since this was written prove the point. Korea’s AI Basic Act took effect on 22 January 2026 and explicitly covers AI used in hiring, performance evaluation and other employment decisions, with a one year grace period on fines (Cooley, Littler). In Europe, the Digital Omnibus agreed in June 2026 pushed the EU AI Act’s high risk obligations back from August 2026 to December 2027, while transparency rules still apply from 2 August 2026 (Gibson Dunn). Policy is still arriving after the tools.