The governance stack: hard law, soft law, and everything between

Lesson 1 of 5 in How AI Governance Works: Laws, Standards, and Everything Between.

You already know why AI needs governing. This module answers the next question: what does "governing" actually consist of?

The honest answer is: not one thing. When people say "AI regulation" they might mean a statute that fines you 7% of global turnover, a set of principles forty-seven governments politely endorsed, a 51-page management-system standard you can be certified against, or a company’s own internal review board. These instruments differ in who wrote them, who they bind, and what happens when you ignore them — and confusing them is the most common beginner error in this field.

The field sorts them along one master axis: hard law versus soft law.

Hard law is binding. A legislature enacted it, a regulator enforces it, a court will hold you to it, and violating it carries defined penalties. The EU AI Act is hard law: place a prohibited AI system on the EU market and you face fines of up to €35 million or 7% of worldwide annual turnover. GDPR, Texas TRAIGA, Colorado’s SB 26-189 — all hard law.

Soft law is everything persuasive but not binding: intergovernmental principles (OECD, UNESCO), voluntary frameworks (NIST AI RMF), codes of conduct, declarations from summits. No fine follows from ignoring the OECD AI Principles. So why do they matter? Because soft law is where consensus forms before legislatures act — the OECD’s 2019 definition of an AI system became, nearly word for word, Article 3(1) of the EU AI Act. Soft law is hard law in rehearsal.

Between the two sits a third category that trips everyone up: standards. Written by private bodies like ISO and CEN-CENELEC, voluntary by default — but capable of acquiring legal force when a law points at them. Hold that thought; lesson four is devoted to it.

The AI governance stack

  1. Hard law — Binding — enforced by regulators and courts

    Statutes and regulations with defined scope, obligations, and penalties. Slowest to make, strongest when made. Ignoring it is illegal, not just unwise.

  2. Soft law — Persuasive — political and reputational force

    Principles, declarations, voluntary frameworks, and codes of conduct. No penalties, but they shape hard law, guide courts and regulators, and set the vocabulary everyone negotiates in.

  3. Technical standards — Voluntary — until a law points at them

    Consensus documents from standards bodies specifying how to do something well: management systems, risk processes, testing methods. Certifiable, auditable, and the bridge between legal text and engineering practice.

  4. Organizational practice — Self-imposed — policies, boards, commitments

    Internal AI policies, ethics review boards, model cards, usage restrictions, and voluntary public commitments. The layer where all the layers above either become real behaviour — or don’t.

Key terms: hard law, soft law, standard, regulation, voluntary framework

Interactive sorting exercise: Sort each instrument into its layer of the governance stack.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.