Researchers call for ISO-style AI governance protocols over fragmented laws

In a new position paper accepted as a spotlight at ICML 2026, Azmine Toushik Wasi and five co-authors argue that the current regulatory landscape for AI is dangerously fragmented. Jurisdiction-specific laws such as the EU AI Act, China’s algorithm governance rules, and the U.S. NIST AI Risk Management Framework each impose different compliance expectations, forcing multinational companies and smaller developers to navigate incompatible requirements. The authors contend that governance should not rest on laws alone but on ISO-like interoperability protocols–standardized, machine-readable formats for communicating an AI system’s characteristics. They draw directly on the GDPR precedent, which was made operational through standards like ISO 27001 and Privacy by Design, to show how technical standards can translate broad legal principles into practical compliance.

To make this concrete, the paper proposes AI 'nutrition labels' containing unified metrics for bias, energy consumption, and data provenance. These manifests would allow risk information to travel with models across borders, potentially lowering compliance costs for small and medium enterprises, reducing redundant audits, and building public trust. Critics might worry that standards could stifle innovation, but the authors respond by advocating for modular, versioned protocols that evolve alongside technology. They call for a shift from siloed legal compliance to interoperable technical conformance–a shared global language for responsible AI deployment. The work, accepted to the ICML 2026 Position Paper Track as a spotlight, is available on arXiv under ID 2608.14568.