New AI Governance Paper Argues Deployers, Not Providers, Should Hold Final Authority

In a new paper on arXiv, researcher Zexun Wang tackles a critical question for enterprise AI governance: who should have final say when capable AI systems are embedded in business workflows? The paper compares two competing models. The first, 'frontier-provider sovereignty,' gives privileged authority to the maker of the most powerful models—reflected in arguments for release gating, transparency duties, and compute controls. The second, 'action-centered deployer sovereignty,' places final authority with the organization that authorizes the action, embeds it in a business process, and bears the downstream consequences.

Wang systematically reviews five major governance frameworks—EU AI Act, NIST AI Risk Management Framework, Singapore's Model Framework for Agentic AI, recent Japanese instruments, and Canada's voluntary code—and finds stronger support across them for distributed operational accountability rather than unilateral provider control. The paper further argues that rapid enterprise adoption, declining provider transparency, and widening control gaps increase the value of a portable governance layer centered on governed action rather than provider-native session objects. The conclusion is nuanced: strong upstream authority remains justified for frontier capability gating, but final authority over concrete enterprise action should rest with the deployer and consequence-bearer.