AI companies now release new models constantly, but no central authority signs off on them the way the FDA approves a drug. The real decision-maker is the company that owns the model, through an internal safety team that sets its own criteria — and then grades its own homework.
This is where things get questionable. Companies face two conflicting incentives — ship fast to win the market, versus hold back to reduce risk. When these two forces collide, nobody knows which one wins until something actually goes wrong.
Governments are trying to play a bigger role, through frameworks like the EU AI Act or executive orders in the US. But the problem is that law can’t keep pace with technology — new models ship every few months, while legislation takes years to draft.
Meanwhile, the independent evaluators who should serve as a neutral referee usually depend on funding or access from the very same companies they’re supposed to be checking.
Behind the image that sums up this power landscape in one glance
This image isn’t here for decoration. It’s meant to show that the decision-making cycle loops back on itself — labs release the models, regulators trail a year behind, and independent evaluators end up operating under the shadow of the very companies they’re supposed to check.
The interesting part is that the arrows in the diagram barely lead anywhere. Every party points back at each other. There’s no single node you can point to and say, “this is where the final decision gets made.” That’s exactly the problem this article is about to dig into.
The night a model got pulled from the market
Remember when a major company’s image-generation feature got suspended overnight because the outputs went so wrong it made headlines? Or the case of an open-weight model that the internal safety team flagged before release, but it still leaked out to the public anyway?
What’s worth thinking about is that each “pull” didn’t come from a court order or a government agency. It came from an internal team at the company itself deciding to hit the stop button — sometimes because of social media backlash, sometimes because of an internal report nobody outside ever saw the details of.
The lingering question is: who approved the release in the first place, and who has the authority to say “that’s enough”? If the same team makes both calls, the criteria they use remain a black box that outsiders can’t see into.
So where does the real decision-making power actually sit in this system?
Let’s break it into three layers. The first layer is the labs themselves — they assess their own model’s risk, set their own criteria, and decide to release on their own terms. This is, in practice, the highest authority in the system, because no one sees the raw data before they do.
The second layer is government agencies, which hold real, legally enforceable power. But by the time a law catches up to technology that changes every quarter, it’s almost always too late.
The third layer is independent evaluators (third-party evaluators), who function something like auditors — they test the models and write reports. But most of them only have the power to “recommend,” not the power to “order a halt.”
The result: the party with the most information (the lab) is usually the only one with real stop-order authority, while the parties who should hold that authority in principle (governments, independent evaluators) end up with little more than a supporting voice.
From an era of voluntary cooperation to an era of binding rules
Back in the GPT-2 era (2019), the world was still experimenting with “staged release” — rolling out a model step by step and watching the response. All of it rested on the lab’s own voluntary choice; nobody could actually force it.
Now things are different. The EU AI Act has real legal force — it’s no longer just a guideline to skim through.
| Factor | Voluntary Era (before 2023) | Regulatory Era (present) |
|---|---|---|
| Model | Self-regulation, staged release | EU AI Act legally enforced |
| Stop authority | Rests entirely with the lab | Formal incident-reporting system |
| Pre-release review | No central standard | AI Safety Institute evaluates frontier models |
What’s changed is that a real “mechanism” now exists — even if it doesn’t cover every country yet.
When these mechanisms meet real life
Picture an IT team at a Thai company about to deploy a chatbot for customers. The first thing they should check is the model card — the document that says what data the model was trained on, where its limitations lie, and what it has previously failed at. No documentation means deploying an unknown quantity to real users.
Another case: a startup picks a new open-weight model to build on top of. Here, red-teaming (having an outside team try to break the model’s rules before release) matters a lot, because an open-weight model can’t easily be patched after it’s already out.
As for staged release — rolling out to a small group first — that’s what protects the parent who’s worried about their kid talking to a chatbot, because problems surface faster before the rollout widens. But without a recall mechanism to back it up, even catching a problem in time doesn’t mean you can actually stop it.
A clear side-by-side: who regulates AI, and how
Right now the world runs three parallel approaches — there’s no single unified standard.
The EU AI Act is genuinely legally binding, with clear risk tiers and real penalties — but its rule-making process is slow and can’t keep up with technology. The US relies on the NIST AI RMF as a recommended framework, plus executive orders that can flip with every new administration, layered on top of inconsistent state laws — more flexible, but with no real teeth.
Meanwhile, companies’ self-governance approach — things like an RSP or a Preparedness Framework — is the fastest, since a company can issue its own rules immediately and adapt quickly to new models. But the loophole is that nobody can force compliance; if a company wants to skip a step, it can.
| Factor | EU AI Act | US (NIST + EO) | Self-governance (RSP/PF) |
|---|---|---|---|
| Strictness | Legally binding, with penalties | Advisory, non-binding | Company's own rules |
| Speed of adaptation | Slow, through legislative process | Moderate, shifts with each EO | Fastest, can adapt instantly |
| Main gap | Can't keep pace with new technology | No national-level enforcement teeth | No one checks it outside the company |
The pros and cons of a system where no one holds absolute authority
With no single party holding sole decision-making power, the system becomes a constant back-and-forth of checks and balances — governments set rules, companies set their own standards, researchers keep watch, and each side keeps the others from going too far.
The upside is there’s no single point of failure that can bring the whole system down. If one party slips up, another is still watching.
But the downside is just as clear. Decisions move slowly because they require agreement across multiple parties, and gaps open up where no one takes full responsibility. When a cross-border AI problem hits — where it’s unclear who’s at fault — laws that differ by country and company end up conflicting with each other, letting some issues slip through simply because no one clearly owns them.
Pros
- +No single point of failure that can bring down the whole system, since multiple parties check and balance each other
- +Power is distributed, reducing the risk of decision-making being monopolized by one party
Cons
- −Decisions move slowly, since they require agreement across multiple parties
- −Gaps open up where no one takes responsibility, when problems cross the boundaries between parties
- −Rules conflict across countries and companies, making real enforcement difficult
The cost nobody talks about when discussing “safe AI”
Compliance rules designed to rein in the tech giants end up, in practice, weighing more heavily on small startups — because legal and audit teams are a fixed cost that big companies can absorb far more easily. This is a quiet form of regulatory capture: rules that claim to protect consumers end up becoming a wall that keeps new competitors from ever showing up.
Then there’s the delay. Countries outside the main negotiating table — including Thailand and Southeast Asia — usually get new AI features later, because companies choose to roll out first in markets where the rules are already clear.
The most dangerous part is the illusion that “passed review = 100% safe.” A “certified” badge makes users let their guard down, even though most evaluations are just a snapshot at one point in time — they don’t guarantee how a model will behave in every situation that follows.
What to watch next — not just who ends up holding the final say
For Thai developers and business owners, there are really three signals worth tracking: the actual enforcement dates of the EU AI Act (since major platforms tend to adjust their policies worldwide to this benchmark, not just in Europe), the assessment reports increasingly coming out of various AI Safety Institutes, and ASEAN’s stance on a cross-border AI governance framework, which still isn’t very clear.
These three things are what will determine which AI features reach us sooner or later — and what limitations they’ll come with.
The question worth sitting with is: if the “safe enough” standard in each region starts to conflict with the others, how should Thai businesses building on foreign AI platforms plan for that uncertainty?