Governance Theater: The Gap Between Passing Laws and Enforcing Them

There is a distinction that almost no AI policy discussion makes clearly enough: the difference between having a law and having governance. A law is text. Governance is the institutional capacity to interpret, apply, monitor, and enforce that text against entities with more technical resources than the enforcers possess. By this standard, the global state of AI governance is far weaker than the volume of legislation suggests.

The EU AI Act is the clearest case study. Passed in March 2024, it is the most comprehensive AI regulatory framework ever enacted. Its risk-based classification system, transparency obligations, and conformity assessment requirements represent years of deliberation. And yet: two years later, the enforcement architecture is incomplete. National competent authorities in most member states have not been designated. The AI Office has a staff of roughly 140 people to oversee compliance across a market of 450 million people and the world’s second-largest digital economy. The Omnibus VII amendments are not corrections to bad policy — they are acknowledgments that the institutions built to enforce good policy cannot keep pace with deployment.

A regulatory framework without enforcement capacity is not a framework. It is an aspiration with a compliance deadline. The EU AI Act is discovering what every ambitious governance project discovers: the hard part is not writing the rules. The hard part is building the institutions to apply them.

The United States faces a mirror image of the same problem. Where the EU has one comprehensive law and insufficient enforcement infrastructure, the U.S. has no comprehensive federal law and 1,561 state bills creating a patchwork that no single entity can monitor. The AMERICA AI Act proposes to solve fragmentation through preemption, but its own enforcement requirements — third-party bias audits, catastrophic risk reporting to DHS, quarterly workforce impact assessments — assume institutional capacities that do not currently exist at the federal level. The FTC, which would shoulder significant enforcement responsibility, has seen its budget flatline while the number of AI-deploying entities it oversees has grown exponentially.

The judiciary, by contrast, is demonstrating what enforcement actually looks like. The Supreme Court’s denial of certiorari in Thaler settled the AI authorship question without a multi-year rulemaking process. In the same month, U.S. District Judge Jed Rakoff ruled in a matter of first impression that litigation-related communications with generative AI platforms are not protected by attorney-client privilege — a decision with immediate, concrete consequences for every law firm using AI tools. Courts move slowly by design, but when they act, the results are binding. Regulators move quickly on paper and slowly in practice.

The Structured Emergence lens from previous issues applies here with particular force. In Issue 4, we argued that governance living in the relationships between institutions is harder to displace than governance in any single law. The enforcement illusion reveals the corollary: governance that exists only as legislation, without the institutional relationships to apply it, is governance in name only. The states passing AI bills are building real governance only if they also build the enforcement mechanisms — attorneys general with technical staff, audit infrastructure, complaint systems. The EU passed the world’s best AI law. The question is whether it can build the world’s first AI enforcement apparatus before the law becomes irrelevant.

The Authorship Line: Supreme Court Closes the Door on AI Inventors

The Supreme Court’s denial of certiorari in Thaler v. Perlmutter is now the definitive statement on AI and authorship in U.S. law. Dr. Stephen Thaler sought copyright protection for art created autonomously by his AI system DABUS. The Court’s refusal to hear the case leaves the D.C. Circuit ruling intact: the Copyright Act requires human authorship. Period. Businesses can protect AI-assisted works only where there is “sufficient human involvement” in directing, prompting, or altering the output. The practical implication: every company using generative AI for content creation now needs a documented human-in-the-loop process — not for ethics, but for intellectual property protection.

The Privilege Crack: AI Communications Are Not Attorney-Client Protected

U.S. District Judge Jed Rakoff (S.D.N.Y.) ruled in a matter of first impression that litigation-related communications with generative AI platforms are not protected by attorney-client privilege. The logic is direct: attorney-client privilege requires a confidential communication between a client and their attorney. When you send a prompt to ChatGPT, you are communicating with a third-party service, not your lawyer. The ruling has immediate consequences for every law firm and corporate legal department using AI tools for litigation strategy, document review, or case analysis. If it’s discoverable, it’s a liability.

The Copyright Counterattack: AMERICA AI Act Says Training Isn’t Fair Use

Buried in the AMERICA AI Act’s 291 pages is a provision that could reshape the AI industry’s economic foundation: the bill explicitly declares that “unauthorized reproduction, copying, or computational processing of copyrighted works” for AI training is not fair use under the Copyright Act. If enacted, this would resolve in creators’ favor the central legal question in the New York Times v. OpenAI litigation and dozens of similar cases. Combined with the NO FAKES Act provisions for unauthorized use of likenesses, the bill represents the most aggressive congressional assertion of IP rights against AI companies to date.

The State Momentum: 78 Chatbot Bills in 27 States

The state AI legislative surge shows no sign of slowing. The count now stands at 1,561 bills across 45 states for the 2026 session alone, with 78 bills specifically targeting AI chatbot interactions with minors across 27 states. Vermont Governor Phil Scott signed a synthetic media elections bill on March 5. Washington completed its session having passed five AI bills. Pennsylvania’s SB 1090 cleared the Senate 49–1. The pattern is consistent: where Congress debates frameworks, states pass laws. And where the EU delays enforcement, American state attorneys general are already building enforcement capacity. The democratic energy remains at the state level, regardless of what the federal preemption debate concludes.

Every story in this issue points to the same uncomfortable truth: passing an AI law and governing AI are not the same thing.

The EU AI Act is the most comprehensive piece of AI legislation ever written. It is also, as of March 2026, largely unenforceable — its deadlines delayed, its enforcement infrastructure incomplete, its member states unprepared. The AMERICA AI Act is 291 pages of ambition that assumes federal enforcement capacities no one has built. The 1,561 state bills will face their own enforcement reckoning as they move from statute to practice.

The judiciary offers a counterpoint. Courts don’t write comprehensive frameworks. They answer specific questions — can AI be an author? are AI chats privileged? — and their answers are immediately binding. No implementation timeline. No simplification package. No code of practice. The law, applied.

Oklahoma’s approach is instructive precisely because it is not trying to solve AI governance in a single bill. Six legislative vectors — agency use, legal personhood, electoral integrity, child safety, personal rights, education — plus executive-branch operational frameworks, plus the energy governance questions of HB 3917 and SB 480. Each piece is enforceable on its own terms. Each institution can build capacity for its own domain. The governance is distributed not because distribution is elegant, but because distributed governance is governance that can actually be enforced.

The Structured Emergence principle completes the picture: the enforcement illusion arises when governance is concentrated in a single ambitious instrument that depends on institutional capacity that doesn’t exist. Governance that emerges from multiple institutions, each enforcing within its competence, is messier on paper and more effective in practice. The question for AI policy in 2026 is no longer who should govern AI. It is who can govern AI — meaning, who has the actual institutional capacity to enforce the rules they write. The answer, increasingly, is courts and states. Not because they’re best, but because they’re real.