An Evaluation Framework for National AI Regulation

Kaushik Sanjay Prabhakar; Tarun Adarsh R S; Amal Dhivyan Gregory; Sreeparvathy Sajeev; Utkarsh Tomar; Avyay M Casheekar

cs.CYAug 15, 2026

An Evaluation Framework for National AI Regulation

Authors: Kaushik Sanjay Prabhakar, Tarun Adarsh R S, Amal Dhivyan Gregory, Sreeparvathy Sajeev, Utkarsh Tomar, Avyay M Casheekar

Organizations: University of Illinois Chicago · Vellore Institute of Technology · University of Michigan Law School

Abstract

Governments use laws, institutions, funding programs and nonbinding guidance to shape how AI is developed and used. Comparing these national approaches is difficult. A binding rule and a detailed voluntary framework can address the same problem but create different duties. The resources needed to carry them out also differ by jurisdiction. This paper develops an evaluation framework for the documented design and implementation readiness of national AI policy. The comparison covers China, India, Japan, Singapore, South Korea, the United Kingdom and the United States. The European Union is included as a supranational comparator. The framework evaluates a versioned portfolio of official instruments rather than one prominent law or strategy. Its criteria ask whether the portfolio governs serious AI risks and whether responsible institutions can implement its commitments. They examine coverage across the AI lifecycle and the protections available to people affected by AI systems. Public benefit and responsible innovation remain a separate part of the assessment. Each sub-criterion is scored through ordered anchors and tied to the provision that supports the judgment. The protocol also records the source search, missing evidence, included instruments and cutoff date. The result is a traceable comparison of policy content that keeps category differences visible. It evaluates what a portfolio provides on paper. It does not estimate enforcement success or policy outcomes.

Figures & tables

Figure 1: AI Policy Evaluation Framework

Figure 2: Components of a national AI ecosystem

Country	Infrastructure for AI Compute	Economic and Political Environment	Demand and Talent in AI
Singapore	The government committed S$270 million to expand the National Supercomputing Centre and related training. Commercial providers also operate accelerator capacity and local cloud regions ( Keat 2024 ; G 2025 ) .	The economy grew 4.8% in 2025. Budget measures committed S $1 billion over five years to AI and S$ 150 million to the Enterprise Compute Initiative. These investments operate alongside nonbinding governance tools ( Ministry of Trade and Industry, Singapore 2026 ; The Edge Singapore 2024 ; Mothership 2025 ; Personal Data Protection Commission Singapore 2020 ) .	The national strategy identifies finance, healthcare, logistics, and public services as areas for wider use. NUS, NTU, and public research bodies support research and training. The strategy targets 15,000 AI practitioners by 2028, and Singapore issued an agentic AI framework in January 2026 ( Smart Nation Singapore 2019 ; Infocomm Media Development Authority, Singapore 2026 ) .
Japan	ABCI 3.0 became publicly available in January 2025 with 6,128 NVIDIA H200 GPUs and a stated peak of 6.22 EFLOPS at FP16. Fugaku and private or cloud capacity extend the compute base ( NVIDIA 2025a ; Takano et al. 2024 ) .	A large economy and sustained technology investment support public and private AI programs. Human-centered principles and sectoral guidance now operate alongside the 2025 AI Promotion Act, which relies on guidance, information requests, and public disclosure rather than private-sector penalties ( Wolf 2025 ; Cabinet Office, Government of Japan 2025 ; Government of Japan 2025 ) .	Manufacturing, healthcare, and robotics create demand. The University of Tokyo, AIST, and other institutions use shared infrastructure for research, while government and university programs support AI education and training ( Insights 2023 ; Harris 2024 ) .
India	The PARAM series and National Supercomputing Mission provide public high-performance computing. The IndiaAI compute portal reported more than 38,000 GPUs onboarded by March 2026, alongside commercial cloud regions ( Department of Science and Technology 2022 ; Digital India 2026 ; APAC Media 2023 ) .	Nominal GDP was estimated at about $4.15 trillion in 2025, with 6.6% real growth projected for fiscal year 2025–26. The IndiaAI Mission operates alongside the 2023 data-protection statute, 2025 rules, and voluntary AI Governance Guidelines ( International Monetary Fund 2025 ; Press Information Bureau, Government of India 2025 ; Ministry of Electronics and Information Technology, Government of India 2025 ) .	Demand spans healthcare, agriculture, education, and urban services. IITs, IIITs, IISc, public agencies, and research hubs support development and training, while sources continue to report unmet demand for advanced skills ( Singh et al. 2025 ; Peterson 2024 ; Arnab Kumar and Mahindru 2024 ; Stanly 2024 ) .
United Kingdom	ARCHER2, CSD3, and Isambard-AI provide scientific and AI computing capacity. London, Cambridge, Oxford, Manchester, and Edinburgh host additional commercial and research clusters ( Research and Innovation 2021 ; Shainer 2021 ; University of Bristol 2025 ; Korolov 2025 ) .	Nominal GDP reached about £3.03 trillion in 2025. The government adopted all 50 recommendations of the AI Opportunities Action Plan and retained a regulator-led approach built around nonstatutory principles, the AI Security Institute, and regulatory sandboxes ( House of Commons Library 2026 ; Clifford and Department for Science, Innovation and Technology 2025 ; Department for Science, Innovation and Technology 2025 ; Rough and House of Commons Library 2026 ) .	Oxford, Cambridge, Imperial College London, University College London, and the Alan Turing Institute support research and government collaboration. UKRI doctoral funding, industry partnerships, and international recruitment form part of the training system ( Benn 2025 ; Sharma 2024 ) .

Table 1: Cross-National AI Ecosystem Comparison

Country	Infrastructure for AI Compute	Economic and Political Environment	Demand and Talent in AI
United States	El Capitan, Frontier, and Aurora ranked second through fourth on the June 2026 TOP500 list. Commercial capacity includes large GPU clusters and custom accelerators from Google, AWS, and Cerebras. The National AI Research Resource pilot provides shared resources for academic and public-interest research ( TOP500.org 2026b ; Miller and Gelles 2024 ; Google Cloud 2026 ; Amazon Web Services 2026 ; Cerebras Systems 2026 ) .	Nominal GDP was about $30.5–30.8 trillion in 2025. Executive Order 14179 and the July 2025 AI Action Plan emphasize innovation, infrastructure, and national leadership, while export controls on advanced chips changed several times during 2025 ( U.S. Bureau of Economic Analysis 2026 ; The White House 2025b ; The White House / Office of Science and Technology Policy 2025 ; Bureau of Industry and Security, U.S. Department of Commerce 2025 ) .	MIT, Stanford, CMU, federally funded institutes, and industry laboratories support a large research base. The United States remains a major destination for researchers and engineers, while immigration policy affects recruitment and retention ( Maslej et al. 2025a ; Oschinski et al. 2025 ) .
European Union	EuroHPC coordinates shared public supercomputing systems across member states. The InvestAI initiative targets €200 billion in public and private AI investment, including support for large shared facilities ( European Union 2021a ; European Commission 2025b ; European Commission 2025a ) .	GDP was €16.22 trillion in 2024. The AI Act entered into force in 2024, and Regulation 2026/1744 revised parts of its implementation schedule. Collective digital policy and member-state implementation make the EU a supranational comparator rather than a single national environment ( Eurostat 2026 ; European Commission 2024b ; European Union 2026 ; European Commission 2026 ) .	Universities, national laboratories, and the ELLIS network support research across member states. EU programs support adoption in manufacturing, finance, healthcare, and public services, while private AI investment remains below the US level ( Eurostat 2025 ; Tambiama Madiega with Rafał Ilnicki; Graphics: Eulalia Claros 2024 ; Stanford Institute for Human-Centered Artificial Intelligence 2026 ) .
South Korea	Samsung and SK Hynix supply memory used in AI systems. Naver, Kakao, domestic cloud providers, and a government-industry plan for more than 260,000 GPUs support public and private compute ( Park 2024 ; Chang-won 2021 ; NVIDIA 2025b ) .	Nominal GDP was about $1.86–1.87 trillion in 2025. The AI Basic Act took effect on January 22, 2026, and distinguishes high-impact AI by sector and consequence from high-performance AI defined partly through a$ 10^{26}$ operation threshold ( International Monetary Fund 2026 ; Republic of Korea 2025 ; Jon 2026 ) .	Healthcare, finance, manufacturing, urban planning, and public services create demand. KAIST, Seoul National University, and industrial laboratories support research, patents, education, and workforce development ( McFaul et al. 2023 ) .
China	LineShine ranked first on the June 2026 TOP500 list at 2.198 exaFLOPS. Huawei’s Atlas 900 A3 SuperPoD connects up to 384 Ascend chips, while domestic cloud providers and the East Data West Computing program support a distributed compute base ( TOP500.org 2026a ; Huawei 2025 ; Alibaba Cloud 2026 ; Tencent Cloud 2026 ; State Council of the People’s Republic of China 2024a ) .	Final revised GDP for 2024 was 134.81 trillion yuan, with reported real growth of 5.0%. The August 2025 AI Plus initiative, synthetic-content rules, and AI-specific amendments to the Cybersecurity Law supplement existing platform and data regulation ( National Bureau of Statistics of China 2025 ; Zhou and Interesse 2025 ; State Council of the People’s Republic of China 2025 ; Cyberspace Administration of China and others 2025 ; National People’s Congress Standing Committee 2025 ) .	Universities, public institutes, and laboratories at DeepSeek, Moonshot AI, Zhipu AI, Alibaba, and other firms support a large research base. China produced 23.2% of AI publications in 2023, while independent evaluations placed its leading systems months behind the strongest closed US systems in 2026 ( Stanford Institute for Human-Centered Artificial Intelligence 2025 ; Center for AI Standards and Innovation and National Institute of Standards and Technology 2026 ; Center for Strategic and International Studies 2026 ) .

Table 2: Cross-National AI Ecosystem Comparison continued

Category 1. AI Risk Governance and Safety
1. Safety Standards	2. Red Teaming and Auditing	3. Human Oversight and Interventions
4. System Interfacing and Delimitation	5. Long-Term AI Governance and Infrastructure Resilience
Category 2. Effectiveness and Feasibility
6. Institutional Capacity and Authority	7. Clarity and Specificity	8. Enforceability
9. Measurability	10. Resource Requirements	11. Incentive Alignment
Category 3. Comprehensiveness and Scope

Table 3: Overview of AI Policy Evaluation Framework Criteria

Appendix figures & tables42 assets

Supplementary material from the paper’s appendix.

Appendix

No.	Country	Scientific Supercomputing Facilities	Private Company Clusters	Cloud Compute Regions
1	Thailand	The TARA system reports a theoretical peak near 500 teraFLOPS from 4,136 Intel Xeon CPU cores and 28 NVIDIA Tesla V100 GPUs ( Sakdhnagool et al. 2021 ) .	Siam.AI and other firms have announced private AI infrastructure investments ( Leesa-nguansuk 2025 ) .	Alibaba Cloud and other large providers offer cloud services in Thailand ( Zulhusni 2025 ) .
2	Malaysia	YTL’s AI Cloud in Johor uses NVIDIA systems for commercial and research workloads ( YTL Group 2024 ) .	YTL and cloud providers have announced private data-center and accelerator capacity in Malaysia ( YTL Group 2024 ) .	AWS and Microsoft have announced or opened Malaysian cloud regions ( Ines Lin 2024 ) .
3	Vietnam	Viettel and research institutions have developed computing facilities for scientific and AI workloads ( Viettel 2022 ) .	Vingroup supports AI research and data infrastructure through VinAI and VinBigdata ( Merritt 2021 ; VinAI 2024 ) .	Foreign and domestic providers offer cloud services, while the cited AWS presence was an edge location rather than a full region ( AWS 2022 ) .
4	Philippines	The National Center for AI Research was established to support applied research and public-sector projects ( dtiwebteam 2024 ) .	Converge ICT and Supermicro announced data-center infrastructure for AI workloads ( Loyola 2024 ) .	The reviewed cloud source describes an expanding domestic data-center market ( Karen 2022 ) .
5	Indonesia	Indosat and NVIDIA announced AI cloud infrastructure using high-density accelerator systems ( Wire 2024 ; NVIDIA 2022 ) .	GoTo and other technology firms operate private infrastructure for consumer and business services ( Baskoro 2024 ) .	AWS, Google Cloud, and Microsoft operate or have announced cloud regions in Indonesia ( Mehra 2024 ) .
6	Singapore	The government committed S$270 million to expand the National Supercomputing Centre and related training ( Keat 2024 ) .	Commercial providers operate private cloud and accelerator capacity in Singapore ( G 2025 ) .	AWS, Microsoft Azure, and Google Cloud operate Singapore cloud regions ( G 2025 ) .

Appendix

Table 4: Infrastructure for AI Compute by Country

No.	Country	GDP and Economic Growth	Political and External Context	Regulatory Frameworks	Resource Availability
1	Thailand	The Eastern Economic Corridor and national plans identify advanced technology as an economic priority ( under the Ministry of Digital Economy and (MDES) 2021a ) .	The national AI strategy and Eastern Economic Corridor provide the selected policy context ( under the Ministry of Digital Economy and (MDES) 2021c ) .	Industry 4.0 programs operate alongside data-protection and cybersecurity rules ( under the Ministry of Digital Economy and (MDES) 2021b ) .	NSTDA supports technical training and research ( NSTDA 2019 ) .
2	Malaysia	The economy and national development plans support investment in digital infrastructure ( IMF 2025a ) .	The cited investment analysis and the NVIDIA-YTL project show continued foreign and domestic infrastructure commitments ( Hattangudi et al. 2024 ; MIDA 2024b ) .	Data-protection, consumer, transaction, and cybersecurity rules form the relevant regulatory base ( ITA 2024 ) .	Solar projects and the YTL Green Data Center add power and data-center capacity ( MIDA 2024a ; YTL 2022 ) .
3	Vietnam	Rapid economic growth and public digital-infrastructure programs support technology investment ( FocusEconomics 2024 ; Hanh 2024 ) .	National digital-transformation policy provides the selected policy context ( US Department of State 2024 ) .	The National Digital Transformation Roadmap operates alongside developing data and AI rules ( Hoa 2025 ; Samuel 2021 ) .	Reviewed sources document foreign partnerships and domestic research institutions, but do not provide a comparable estimate of high-end compute access ( NVIDIA 2024 ; Tazrout 2021 ) .
4	Philippines	The cited forecast reported post-pandemic growth near 5–6% ( IMF 2025b ) .	No comparable quantitative stability measure was retained for this review.	The National AI Roadmap 2.0 supports research, adoption, and responsible-use guidance ( DTI 2024 ) .	Renewable-energy development can support data-center expansion, though the cited sources do not quantify AI-specific supply ( Tachev 2024 ; IMF 2020 ) .
5	Indonesia	The cited forecast placed the digital economy above $130 billion by 2025 ( ITA 2025 ) .	No comparable quantitative measure was retained for this field.	The Personal Data Protection Law and national ethics guidance provide the main horizontal rules relevant to AI ( Deradjat et al. 2025 ; Digital Policy Alert 2023 ) .	The cited source describes domestic energy and infrastructure resources but does not isolate AI use ( East Ventures 2025 ) .
6	Singapore	The economy grew 4.8% in 2025. Budget measures committed S $1 billion over five years to AI and S$ 150 million to the Enterprise Compute Initiative ( Ministry of Trade and Industry, Singapore 2026 ; The Edge Singapore 2024 ; Mothership 2025 ) .	No comparable quantitative measure was retained for this field.	Data-protection and cybersecurity rules operate alongside nonbinding AI frameworks. A dedicated agentic AI framework followed in January 2026 ( Baig et al. 2024 ; Infocomm Media Development Authority, Singapore 2026 ) .	Singtel and the National Supercomputing Centre provide commercial and public compute capacity ( Gomes 2024 ; Chia 2024 ) .

Appendix

Table 5: Economic and Political Environment by Country

No.	Country	Local Demand for AI solutions	Research Institutions	Talent Pool
1	Thailand	The cited reporting describes investment in domestic AI services and interest among Thai businesses ( Leesa-nguansuk 2025 ) .	NSTDA and universities support AI research and collaboration with industry ( Dharmaraj 2025b ) .	Government and university programs provide training in AI and data science ( Dharmaraj 2025b ) .
2	Malaysia	Reviewed sources describe AI adoption in finance, healthcare, and manufacturing as part of wider digitalization efforts ( ITA 2024 ) .	The Malaysia Genome Institute and MRANTI support research and commercialization in advanced technologies ( Malaysiakini 2024 ) .	Education programs seek to expand the workforce, while reported shortages remain in AI, data analytics, and cybersecurity skills ( Vietnamplus 2025 ) .
3	Vietnam	PhoBERT documents work on Vietnamese-language models, while the reviewed sources also describe applications in healthcare, transportation, and finance ( Dat Quoc Nguyen 2020 ) .	VinAI and university research groups conduct AI research and collaborate with overseas institutions ( Nhandan 2025 ) .	Universities and companies fund AI training, while the reviewed source reports shortages in advanced expertise ( Dharmaraj 2025a ) .
4	Philippines	The national AI roadmap and the National Center for AI Research identify healthcare, agriculture, and manufacturing as areas for AI development ( Dti 2024 ) .	The roadmap links the center with universities and industry partners for research and knowledge transfer ( Dti 2024 ) .	The roadmap includes reskilling and workforce development intended to address reported talent shortages ( Dti 2024 ) .
5	Indonesia	The reviewed report identifies fintech, electronic commerce, and healthcare as areas of AI adoption and places AI within the “Making Indonesia 4.0” agenda ( Ministry of Industry 2018 ) .	Bandung Institute of Technology, the University of Indonesia, and other institutions conduct AI and data-science research ( Ministry of Industry 2018 ) .	The report identifies gaps in workforce readiness and describes public programs in digital skills and STEM education ( Ministry of Industry 2018 ) .
6	Singapore	The National AI Strategy identifies finance, healthcare, logistics, and public services as areas for wider AI use ( Smart Nation Singapore 2019 ) .	The National University of Singapore, Nanyang Technological University, and public research organizations support research and industry collaboration ( Smart Nation Singapore 2019 ) .	The strategy sets a target of tripling the number of AI practitioners to 15,000 by 2028 and describes scholarships and training programs ( Smart Nation Singapore 2019 ) .

Appendix

Table 6: Demand and Talent in AI by Country

Policy Instrument	Covered Actors	Documented Provisions	Implications for AI Systems	Implementation Status and Limitations
European Union Artificial Intelligence Act (2024) ( European Union 2021b ; European Parliamentary Research Service 2022 )	AI Developers, Businesses, Public Sector, End Users	1. Prohibits specified AI practices 2. Imposes duties on providers and deployers of high-risk systems 3. Adds transparency duties for specified systems 4. Regulates general-purpose AI models 5. Provides conformity assessment, documentation, oversight, and penalties	1. High-risk systems must meet applicable risk-management, data, documentation, oversight, accuracy, robustness, and cybersecurity duties 2. Specified practices are prohibited 3. General-purpose AI providers have separate documentation and risk duties	1. Entered into force in August 2024 2. Prohibited-practice and general-purpose AI provisions began applying in February and August 2025 ( European Commission 2024b ) 3. Regulation 2026/1744 revised several application dates ( European Union 2026 )
General Data Protection Regulation (GDPR, 2018) ( European Union 2016 )	Organizations, AI Developers, Individuals	1. Requires a lawful basis for processing personal data 2. Data minimization 3. Rights concerning solely automated decisions 4. Access to meaningful information about the logic involved where applicable 5. Conditions for transfers outside the European Economic Area	1. Applies when model development or use processes personal data 2. Truly anonymized data falls outside the Regulation 3. Article 22 limits specified decisions based solely on automated processing	1. Binding and directly applicable since 2018 2. Enforced by national supervisory authorities 3. Does not provide a general AI approval regime
Digital Services Act (DSA, 2022) ( European Commission 2022 )	Online Platforms, Consumers, Regulators	1. Recommender-system transparency 2. Advertising transparency 3. Systemic-risk assessment and mitigation for very large services 4. Notice, complaint, and redress procedures for content moderation	1. Applies to platform systems used for recommendation, advertising, and content moderation 2. Requires risk mitigation by very large online platforms and search engines 3. Does not impose a general ban on models that amplify harmful content	1. Binding platform regulation 2. Obligations depend on service type and size 3. Enforced by the Commission and national Digital Services Coordinators

Appendix

Table 7: European Union AI Policy Overview

Policy Instrument	Implementing Body	Purpose and Provisions	Implications for AI Systems	Implementation Status and Limitations
Executive Order 14110 (2023), revoked January 20, 2025 ( White House 2023 ; The White House 2025a )	Executive Office of the President	1. Directed federal action on safety, security, privacy, civil rights, research, and workforce issues 2. Used Defense Production Act authority for specified reporting 3. Directed agencies to develop standards and guidance	1. Required specified developers to report training and safety information 2. Directed evaluations and standards for several high-impact uses	1. Revoked on January 20, 2025 2. No longer forms the operative federal executive-order framework
Executive Order 14179 (Jan. 2025) & America’s AI Action Plan (July 2025) ( The White House 2025b ; The White House / Office of Science and Technology Policy 2025 )	Executive Office of the President and federal agencies	1. Reorients federal policy toward US AI leadership 2. Directs revision of the NIST AI RMF 3. Renames the AI Safety Institute as the Center for AI Standards and Innovation (CAISI) 4. Organized around innovation, infrastructure, and international diplomacy	1. Removes or revises several prior federal requirements 2. Directs work on infrastructure, standards, procurement, exports, and security evaluations	1. Operative federal policy at the cutoff 2. The AI Diffusion Rule was rescinded in May 2025 before taking effect 3. State AI laws remain outside this federal portfolio
AI Bill of Rights Blueprint (2022) ( White House 2022 )	White House OSTP	1. Nonbinding principles on safe systems, discrimination, privacy, notice, explanation, and human alternatives 2. Includes technical companion guidance	1. Provides design and governance guidance for automated systems 2. Creates no approval requirement or penalty	1. Published as a White House blueprint 2. Nonbinding and not a source of legal authority
National AI Initiative Act (2020) ( U.S. Congress 2020 )	US Congress	1. Establishes a coordinated federal AI research and development program 2. Supports research institutes, education, standards, and interagency coordination	1. Authorizes programs and coordination rather than model-specific approval rules	1. Binding statutory basis for federal programs 2. Does not create a comprehensive private-sector AI regime
AI Risk Management Framework (NIST AI RMF) (2023) ( National Institute of Standards and Technology (NIST) 2023 )	NIST	1. Voluntary framework for managing AI risks across the lifecycle 2. Organized around Govern, Map, Measure, and Manage functions	1. Provides a common risk-management vocabulary and process 2. Creates no independent approval requirement	1. Voluntary unless another instrument incorporates it 2. Does not itself authorize penalties or suspend systems
California Consumer Privacy Act and California Privacy Rights Act ( California State Government 2023 )	California State Government	1. Grants access, deletion, correction, and opt-out rights for covered personal information 2. Adds limits and rights for sensitive personal information	1. Applies to covered businesses that process personal information in AI development or use 2. Does not create a general AI training-data consent rule	1. Binding state law with threshold and exemption rules 2. Enforced by the California Privacy Protection Agency and Attorney General 3. Not part of the federal portfolio score unless the declared scope includes subnational law

Appendix

Table 8: United States AI Policies Overview

Policy Instrument	Implementing Body	Purpose	Documented Provisions	Implementation Status and Limitations
Artificial Intelligence in Healthcare Guidelines (AIHGle)	Ministry of Health (MOH), Health Sciences Authority (HSA), Integrated Health Information Systems (IHiS)	1. Guide safe development and use of AI in healthcare	1. Recommends validation, monitoring, fairness, responsibility, explainability, and patient-centered design ( Ministry of Health Singapore et al. 2023 ) 2. Addresses data governance and cybersecurity	1. Guidance rather than a standalone approval statute 2. Separate medical-device and professional rules can create binding duties
Personal Data Protection Act (PDPA) and Sector-Specific Guidelines	Personal Data Protection Commission (PDPC)	1. Protect personal data processed by organizations 2. Provide nonbinding AI governance guidance	1. Requires compliance with consent, purpose, notification, access, correction, protection, retention, and transfer duties where applicable 2. The Model AI Governance Framework provides separate organizational guidance ( Personal Data Protection Commission Singapore 2020 )	1. The PDPA is binding and technology neutral 2. The Model AI Governance Framework is nonbinding
MAS FEAT Principles	Monetary Authority of Singapore (MAS)	1. Promote fairness, ethics, accountability, and transparency in AI use within financial sector	1. Sets fairness, ethics, accountability, and transparency principles ( Monetary Authority of Singapore 2021 ) 2. Supports assessment methods for financial institutions	1. Sectoral supervisory guidance rather than a general AI statute
Healthcare Cybersecurity Essentials Guidelines	Ministry of Health (MOH)	1. Protect healthcare AI systems and IT infrastructure against cyber threats	1. Recommends access control, protection, detection, response, recovery, and staff practices ( Ministry of Health Singapore 2022 )	1. General healthcare cybersecurity guidance rather than an AI-specific rule
Human Biomedical Research Act (HBRA)	Ministry of Health (MOH)	1. Ensure ethical compliance and data privacy in biomedical AI research	1. Requires review, consent, and protection for covered human biomedical research ( Ministry of Health Singapore 2007 )	1. Binding for research within its statutory scope 2. Not a general approval regime for AI models or clinical products

Appendix

Table 9: Overview of Singapore AI Policies

Policy Instrument	Covered Actors	Documented Provisions	Implications for AI Systems	Implementation Status and Limitations
UK IPO AI and IP Consultation and Government Response, 2021 and 2022 ( UK Intellectual Property Office 2022 )	1. Creators, rights holders, researchers, AI developers, and inventors	1. Considers copyright protection for computer-generated works, text and data mining, and patent protection for AI-devised inventions 2. The 2022 response retained existing protection for computer-generated works and did not change patent inventorship rules 3. The response proposed a broader text and data mining exception, which was not implemented	1. The consultation and response address how existing intellectual property law applies to AI development and output 2. They do not amend the underlying law	1. Consultation opened in October 2021 and the government response was published in June 2022 2. This is intellectual property policy rather than an AI safety or approval regime
UK AI White Paper ( UK Department for Science, Innovation and Technology 2023a )	1. Existing regulators and the organizations within their sectoral remits 2. AI developers and deployers whose activities fall within those remits	1. Uses existing law and existing regulators rather than a single horizontal AI regulator 2. Sets five cross-sector principles covering safety, transparency, fairness, accountability, and contestability 3. Proposes central coordination and support for regulators	1. Regulators apply the principles to AI uses within their existing powers and sectoral context 2. The framework does not create a general licensing or conformity-assessment regime	1. Nonstatutory policy framework whose application initially depended on each regulator’s remit and discretion 2. The October 2025 regulatory blueprint retained the regulator-led approach ( Rough and House of Commons Library 2026 )
National AI Strategy ( UK Government 2021 )	1. Government, research institutions, businesses, and the workforce	1. Sets ten-year priorities for investment, research, skills, adoption, and governance 2. Organizes the strategy around ecosystem needs, diffusion across the economy, and national and international governance	1. Provides strategic direction for public programs and later policy instruments 2. Does not create conduct duties for individual AI systems	1. Published in September 2021 as a strategy rather than legislation 2. The 2025 AI Opportunities Action Plan supplements its infrastructure, adoption, and skills agenda
AI Opportunities Action Plan ( Clifford and Department for Science, Innovation and Technology 2025 )	1. UK government and delivery bodies 2. Regulators and public sector organizations 3. AI developers, researchers, and investors	1. Recommends AI Growth Zones and expanded sovereign compute 2. Proposes better access to public data and stronger adoption capacity 3. Addresses skills, research, procurement, and AI security institutions	1. Expands the infrastructure and institutions available for AI development and use 2. Does not itself set binding conduct rules for particular model classes	1. Published and accepted by the government in January 2025 2. Implementation depends on later budgets, programs, and institutional decisions 3. The plan is a strategy document rather than legislation
UK Algorithmic Transparency Standard ( UK Government Digital Service 2025 )	1. All government departments 2. Arm’s-length bodies that deliver public or frontline services or interact directly with the public 3. Other public-sector bodies can use the standard voluntarily	1. Provides a standard record for an algorithmic tool’s purpose, ownership, data, risks, human oversight, and review 2. Requires publication of records for covered organizations and tools	1. Mandatory scope covers tools that significantly influence a decision with public effect or interact directly with the public	1. Mandatory across central government since 2024 2. The scope and exemptions policy was published in December 2024 and the guidance was updated in May 2025

Appendix

Table 10: United Kingdom AI Policy Portfolio

Policy Instrument	Covered Actors	Documented Provisions	Implications for AI Systems	Implementation Status and Limitations
National Strategy for Artificial Intelligence, 2018 ( NITI Aayog 2018 )	1. Government departments 2. Healthcare, agriculture, education, urban services, and mobility sectors 3. Startups and small and medium enterprises 4. Research institutions	1. Identifies five priority sectors and an inclusive-growth objective 2. Proposes research centers, shared data platforms, skilling, and public-private collaboration 3. Discusses privacy, security, transparency, accountability, and bias as responsible-AI concerns	1. Sets priorities for public programs and sector adoption 2. Does not create approval, audit, or penalty rules for AI systems	1. Nonbinding national strategy rather than legislation 2. Later programs and the 2025 AI Governance Guidelines supplement its development and governance proposals
Digital Personal Data Protection Act 2023 and Rules 2025 ( Government of India 2023a ; Press Information Bureau, Government of India 2025 )	1. Data fiduciaries and processors 2. People whose digital personal data are processed 3. The Data Protection Board and central government	1. Requires a lawful purpose based on consent or a listed legitimate use 2. Provides rights to information, correction, erasure, and grievance redress 3. Sets additional duties for significant data fiduciaries 4. Permits the government to restrict transfers to notified countries or territories	1. Applies when AI training or deployment processes digital personal data within its scope 2. Does not create a separate approval or audit regime for AI systems	1. The 2025 Rules began a staged implementation of the Act 2. Several substantive duties commence on later dates under that schedule 3. The regime is binding data protection law rather than AI-specific regulation
Revised MeitY Advisory on AI Deployment, March 15, 2024 ( AZB and Partners 2024 )	1. Intermediaries and online platforms 2. Providers that make AI tools available through those services	1. Links AI use to existing intermediary due diligence obligations 2. Directs platforms to address unlawful content, discrimination, and electoral integrity 3. Calls for warnings on outputs from under-tested or unreliable systems 4. Addresses identification of synthetic content used as misinformation or deepfakes	1. Does not require prior government permission to release an under-tested model 2. Places the stated duties on intermediaries and platforms rather than all AI developers	1. Superseded the March 1 advisory that had required prior permission 2. Its scope and legal force remain less clear than those of legislation or notified rules
India AI Governance Guidelines, 2025 ( Ministry of Electronics and Information Technology, Government of India 2025 )	1. Central and state government bodies 2. Sector regulators 3. AI developers, deployers, and users	1. Sets principles for trustworthy, people-centered, and innovation-supporting governance 2. Recommends a coordinating governance group and a technical policy committee 3. Recommends risk assessment, incident reporting, and shared technical tools	1. Uses existing law and sector oversight as the base for AI governance 2. Supports proportionate obligations and regulatory sandboxes	1. Issued as national guidance in November 2025 2. Recommendations require later institutional and sector-specific implementation 3. The document does not itself create a comprehensive AI statute

Appendix

Table 11: India AI Policy Portfolio

Policy Instrument	Covered Actors	Documented Provisions	Implications for AI Systems	Implementation Status and Limitations
Act on Promotion of Research and Development and Utilization of AI-Related Technologies, 2025 ( Cabinet Office, Government of Japan 2025 )	1. National and local government 2. Research institutions and businesses 3. AI developers, providers, and users	1. Establishes an AI Strategy Headquarters and a national basic plan 2. Assigns responsibilities for research, adoption, safety, and international cooperation 3. Authorizes information requests, guidance, and public disclosure when misuse harms rights or interests	1. Relies mainly on planning, guidance, voluntary cooperation, and disclosure 2. Does not create a general licensing regime for AI models	1. Promulgated on June 4, 2025 2. Fully in force from September 1, 2025 3. Does not prescribe private-sector fines or criminal penalties for noncompliance
Society 5.0 Vision ( Cabinet Office, Government of Japan 2019 )	1. Government, researchers, and industry 2. Public service and infrastructure sectors	1. Defines a human-centered society that integrates physical and digital systems 2. Connects technological development with economic and social goals	1. Provides strategic direction for AI and related digital technologies	1. A high-level national vision rather than a binding conduct standard
Social Principles of Human-Centric AI, 2019 ( Japanese Ministry of Economy, Trade and Industry 2020 )	1. Government, business, researchers, and the public	1. Addresses human dignity, education, privacy, security, fair competition, fairness, accountability, transparency, and innovation	1. Supplies principles for later strategies and business guidance	1. Nonbinding principles with no direct penalty mechanism
AI Guidelines for Business, Version 1.0 ( Ministry of Economy, Trade and Industry and Ministry of Internal Affairs and Communications, Japan 2024 )	1. AI developers, providers, and business users	1. Consolidates earlier guidance for AI governance and risk management 2. Addresses safety, fairness, privacy, security, transparency, and accountability	1. Provides lifecycle guidance that organizations can adapt to their roles and risks	1. Published jointly by METI and MIC in April 2024 2. Guidance rather than binding legislation

Appendix

Table 12: Japan AI Regulations Overview

Policy Instrument	Covered Actors	Documented Provisions	Implications for AI Systems	Implementation Status and Limitations
Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust ( Republic of Korea 2025 ; Jon 2026 )	Government bodies, AI business operators, and people affected by AI services	1. Establishes national planning and coordination institutions 2. Sets transparency duties for generative and high-impact AI 3. Requires safety measures for high-performance AI 4. Sets safeguards for high-impact AI and encourages fundamental-rights impact assessment	1. High-impact AI is identified by sector, use, and risk to life, safety, or fundamental rights 2. High-performance AI is a separate class tied in part to training compute of at least $10^{26}$ operations 3. Covered systems remain deployable when the applicable duties are met	1. Enacted on January 21, 2025 and effective from January 22, 2026 2. Subordinate rules specify operational details and the high-performance compute threshold 3. The Act combines binding duties with promotion and support measures
Personal Information Protection Act, revised 2023 ( Personal Information Protection Commission, Republic of Korea 2023 )	Personal information controllers and data subjects	1. Sets lawful-basis, purpose, security, and data-subject-rights requirements 2. Article 37-2 provides rights concerning qualifying decisions made through a completely automated system 3. Provides a right to request an explanation of an automated decision	1. Applies when AI development or use processes personal information within the Act’s scope 2. Requires specified responses when a person objects to or requests an explanation of a covered automated decision	1. Binding general data-protection law 2. The automated-decision provisions took effect through the 2023 amendments and implementing decree 3. Does not create a general AI safety approval regime
National Guidelines for AI Ethics, 2020 ( Ministry of Science and ICT, Republic of Korea 2020 )	Government, developers, providers, users, and other AI stakeholders	1. Organizes the guidance around human dignity, public good, and fitness for purpose 2. Sets ten requirements covering human rights, privacy, diversity, data management, accountability, safety, transparency, solidarity, and related duties	1. Provides a nonbinding reference for the development and use of AI	1. Released by the Ministry of Science and ICT in December 2020 2. Creates no direct penalty or approval mechanism

Appendix

Table 13: South Korea AI Policy Overview

Policy Instrument	Covered Actors	Documented Provisions	Implications for AI Systems	Implementation Status and Limitations
Interim Measures for the Management of Generative AI Services, 2023 ( Cyberspace Administration of China 2023 )	Providers of generative AI services offered to the public in mainland China	1. Requires lawful training data and protection of intellectual property and personal information 2. Requires providers to address prohibited content and protect users 3. Connects services with public-opinion attributes or social mobilization capacity to security assessment and algorithm filing rules	1. Applies to public generative AI services rather than internal research and use 2. Requires measures on content, complaints, data, and service security	1. Effective from August 15, 2023 2. Binding administrative measure jointly issued by seven national authorities
Measures for the Labeling of AI-Generated and Synthetic Content, 2025 ( Cyberspace Administration of China and others 2025 )	Generative AI providers, content distribution platforms, application distributors, and users	1. Requires explicit labels for specified generated or synthetic content 2. Requires implicit identifiers in file metadata 3. Sets duties for platforms that distribute or detect covered content	1. Adds provenance information to the production and distribution of synthetic content 2. Prohibits malicious removal, alteration, or concealment of required labels	1. Effective from September 1, 2025 2. Complements the broader AI Plus development initiative ( State Council of the People’s Republic of China 2025 )
Administrative Provisions on Deep Synthesis Internet Information Services, 2022 ( Cyberspace Administration of China 2022 )	Deep synthesis service providers, technical supporters, and users	1. Requires identity verification and information security controls 2. Requires consent when editing biometric information such as faces or voices 3. Requires prominent labels for content that could confuse or mislead the public	1. Regulates covered synthesis services rather than banning the underlying techniques 2. Connects high-risk services to filing and security assessment duties	1. Effective from January 10, 2023 2. Binding administrative provisions
Provisions on the Administration of Algorithmic Recommendations in Internet Information Services ( Cyberspace Administration of China and others 2021 )	Algorithmic recommendation service providers and users	1. Requires disclosure of basic service principles, purposes, and operating mechanisms 2. Gives users a non-personalized option or a convenient way to disable recommendation services 3. Requires filing for services with public-opinion attributes or social mobilization capacity	1. Regulates personalization, ranking, search filtering, dispatching, and related recommendation techniques 2. Sets additional protections for minors, older people, workers, and consumers	1. Effective from March 1, 2022 2. Binding rules jointly issued by four national authorities
Cybersecurity Law, Data Security Law, and Personal Information Protection Law ( Standing Committee of the National People’s Congress of China 2016 ; Standing Committee of the National People’s Congress of China 2021a ; Standing Committee of the National People’s Congress of China 2021b )	Network operators, data processors, personal information processors, and affected people	1. Establishes network security and critical infrastructure duties 2. Requires classified data protection and safeguards for important data 3. Sets lawful bases, individual rights, processor duties, and cross-border rules for personal information	1. Applies to AI developers and providers when their network, data, or personal information processing falls within scope 2. Does not amount to a single AI-specific statute	1. Binding national laws with distinct scopes and enforcement mechanisms 2. The Cybersecurity Law was amended in 2025 with effect from January 1, 2026
Regulations on Network Data Security Management, 2024 ( State Council of the People’s Republic of China 2024b )	Network data processors and other covered organizations	1. Implements duties under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law 2. Addresses personal information, important data, platform duties, and cross-border transfers	1. Applies to AI-related data processing when it meets the regulation’s scope 2. Does not classify or approve AI models as such	1. Promulgated on September 24, 2024 2. Effective from January 1, 2025

Appendix

Table 14: China AI Policy Overview

Paper	Summary	Limitations
UNESCO Readiness Assessment Methodology ( UNESCO 2023 )	The methodology supports a national, multi-stakeholder assessment of legal, social, economic, scientific, educational, and technical conditions for ethical AI. It combines document review, stakeholder participation, and recommendations for policy reform and institutional capacity.	It is a diagnostic country process rather than a fixed rubric for comparing the content of versioned policy portfolios.
Global Index on Responsible AI, 2026 ( Adams et al. 2026 )	The index assesses 135 countries and jurisdictions through 38 indicators that cover policy and implementation, civil-society engagement, enabling conditions, and documented government uses.	It combines policy content with implementation evidence and country conditions, while the present framework isolates the documented design of a declared policy portfolio.
AI Governance InternationaL Evaluation Index, 2025 ( Zeng et al. 2025 )	The index evaluates 40 countries through four pillars, 17 dimensions, and 43 indicators drawn from policy documents, governance practices, research outputs, and risk exposure.	Its unit is national governance capacity rather than the content and legal force of a versioned policy portfolio.
Government AI Readiness Index, 2025 ( Oxford Insights 2025 )	The index evaluates 195 governments on their capacity to use, enable, and govern AI for public benefit.	Readiness includes institutions, infrastructure, skills, and private-sector conditions that lie outside the present rubric.
A Grading Rubric for AI Safety Frameworks ( Alaga et al. 2024 )	The paper grades company frontier AI safety frameworks with seven criteria, 21 indicators, and letter grades from A to F. It also proposes surveys, Delphi studies, and audits as application methods.	The unit is a company’s voluntary safety framework rather than a national portfolio of laws, strategies, budgets, and guidance.
Evaluating AI Providers’ Frontier Safety Frameworks ( Stelling et al. 2025 )	The study applies 65 weighted criteria across four risk-management dimensions to 12 company frameworks. It shows how a detailed rubric can expose vague or missing commitments.	The criteria address catastrophic-risk management by frontier AI providers rather than national governance across sectors and institutions.

Appendix

Table 15: Literature Review of AI Policy Frameworks

Criterion	Definition	Weight
1. Safety Standards	The policy includes specific and adaptable safety standards for AI systems, particularly for high-risk applications and advanced or general-purpose AI risks.	20%
2. Red Teaming and Auditing	The policy mandates or strongly encourages independent audits, red teaming, and other forms of external scrutiny to identify vulnerabilities and ensure compliance.	20%
3. Human Oversight and Interventions	The policy addresses the need for meaningful human control over AI systems, including mechanisms for intervention, override, or deactivation.	20%
4. System Interfacing and Delimitation	The policy considers measures for containing or isolating potentially harmful AI systems to prevent unintended consequences or widespread damage.	20%
5. Long-Term AI Governance and Infrastructure Resilience	The policy demonstrates an understanding of the long-term issues associated with governing advanced AI and infrastructure development.	20%

Appendix

Table 16: AI Risk Governance and Safety Criteria

Sub-criterion	Definition	Indicators
1.1. Specificity of Safety Frameworks or Standards	Are the safety standards clearly defined with specific technical requirements?	1. No specific safety standards mentioned. 2. Vague safety standards with little technical detail, deferred to future development. 3. Some specific safety standards are mentioned, but lack in detail or coverage, with concrete technical requirements and processes outlined for future work. 4. Clearly defined safety standards with considerable technical detail. 5. Comprehensive and highly specific safety standards with detailed technical requirements.
1.2. Coverage of Advanced AI Risks	Do the safety standards address risks from advanced or general-purpose AI systems regardless of the terminology used?	1. No standards address risks from advanced or general-purpose AI systems. 2. The policy recognizes these risks but gives no concrete standard. 3. A concrete standard covers some relevant risks or systems. 4. Clear standards cover the main risks and state when they apply. 5. Detailed and adaptable standards cover capability growth, monitoring, and review.
1.3. High-Risk Application Focus	Are there specific standards for high-risk applications (e.g., autonomous weapons, critical infrastructure)?	1. No differentiation of standards based on risk level. 2. Vague acknowledgment of high-risk applications. 3. Some specific standards for high-risk applications. 4. Clear and stringent standards for high-risk applications. 5. Comprehensive standards for high-risk applications with detailed provisions for risk mitigation.

Appendix

Table 17: Safety Standards Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
2.1. Mandate for Independent Audits	Does the policy mandate independent audits for AI systems, particularly for high-risk applications?	1. No mention of independent audits. 2. Audits encouraged but not mandated. 3. Audits mandated for some high-risk applications. 4. Audits mandated for most high-risk applications. 5. Audits mandated for all high-risk applications and strongly encouraged for others.
2.2. Misuse and Dual-Use Prevention	Does the policy address the potential for AI technologies and systems to be misused or used for harmful purposes, considering their dual-use nature and the need for security measures to prevent unauthorized access, modification, or malicious use?	1. No consideration of the potential for misuse, dual-use risks, or the need for security measures to prevent unauthorized use. 2. Misuse and dual-use risks are acknowledged but not assessed or addressed through any concrete measures. 3. Some assessment of potential misuse and dual-use risks is mentioned, and some general security measures are outlined. 4. Clear guidelines for assessing and addressing misuse and dual-use risks are provided, along with clear and specific security requirements. 5. A comprehensive framework is in place for managing misuse and dual-use risks, including detailed risk assessment processes, guidelines and restrictions related to dual-use technologies, and comprehensive security requirements.
2.3. Red Teaming Requirements	Does the policy specify requirements or guidelines for red teaming exercises?	1. No mention of red teaming. 2. Red teaming encouraged but not defined. 3. Red teaming mentioned with some guidelines. 4. Red teaming requirements are clearly defined. 5. Comprehensive red teaming requirements, including specific methodologies and scenarios.
2.4. External Scrutiny Mechanisms	Does the policy establish mechanisms for external scrutiny beyond audits and red teaming (e.g., public reporting, expert panels)?	1. No mechanisms for external scrutiny. 2. Limited opportunities for external input. 3. Some mechanisms for external scrutiny. 4. Well-defined mechanisms for external scrutiny. 5. Multiple, robust mechanisms for external scrutiny, ensuring transparency and accountability.

Appendix

Table 18: Red Teaming and Auditing Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
3.1. Human-in-the-Loop Requirements	Does the policy mandate human-in-the-loop systems for critical decision-making, especially in high-risk applications?	1. No requirements for human oversight. 2. Human oversight is encouraged but not mandated. 3. Human-in-the-loop required for some critical decisions. 4. Human-in-the-loop required for most critical decisions. 5. Human-in-the-loop mandated for all critical decisions in high-risk applications.
3.2. Meaningful Human Control	Does the policy define what constitutes meaningful human control over AI systems and how it can be maintained?	1. No definition of meaningful human control. 2. Meaningful human control is mentioned but not clearly defined. 3. Some aspects of meaningful human control are addressed. 4. Clear definition of meaningful human control. 5. Comprehensive framework for ensuring meaningful human control, including provisions for human override and intervention.
3.3. Oversight of Autonomous Systems	Does the policy address the specific challenges of overseeing increasingly autonomous AI systems?	1. No consideration of oversight for autonomous systems. 2. Oversight of autonomous systems is mentioned but not addressed in detail. 3. Some guidelines for overseeing autonomous systems. 4. Clear guidelines and requirements for overseeing autonomous systems. 5. Comprehensive framework for overseeing autonomous systems, including provisions for monitoring, auditing, and accountability.
3.4. Override and Deactivation Mechanisms	Does the policy specify clear mechanisms for human operators to intervene in AI system operations, including overriding decisions and safely deactivating or shutting down systems in case of emergency, malfunction, or other critical situations?	1. The policy does not mention override, intervention, or deactivation mechanisms. 2. Mechanisms for override or deactivation are alluded to or mentioned as possible but are not clearly defined or detailed. 3. Mechanisms for human override of AI decisions or system deactivation are defined for some critical scenarios, but not comprehensively for both, or are not easily accessible. 4. Clear mechanisms for both human override of AI decisions and system deactivation (including emergency shutdown) are defined for most critical scenarios, with reasonable accessibility. 5. Comprehensive, easily accessible, and robust mechanisms for both human override of AI decisions and system deactivation (including emergency shutdown procedures) are clearly defined, well-documented, and readily available for all relevant scenarios.

Appendix

Table 19: Human Oversight and Interventions Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
4.1. Research and Development Guidelines	Does the policy provide guidelines for research and development of containment or isolation techniques for advanced AI?	1. No mention of containment or isolation research. 2. Containment research is encouraged but not prioritized. 3. Some guidelines for containment research. 4. Clear guidelines for containment research and development. 5. Comprehensive guidelines and funding for containment research, recognizing its importance.
4.2. Deployment Restrictions	Does the policy restrict the deployment of AI systems that cannot be adequately contained or isolated?	1. No restrictions on deployment based on containment. 2. Vague restrictions with unclear criteria. 3. Some restrictions based on containment feasibility. 4. Clear restrictions based on containment feasibility for high-risk applications. 5. Comprehensive restrictions for any AI system that cannot be adequately contained or isolated.
4.3. Emergency Protocols	Does the policy include provisions for emergency protocols in case of containment or isolation failures?	1. No mention of emergency protocols. 2. Emergency protocols are underdeveloped. 3. Some emergency protocols are defined. 4. Clear emergency protocols are established. 5. Comprehensive emergency protocols, including backup containment and mitigation strategies.

Appendix

Table 20: System Interfacing and Delimitation Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
5.1. Adaptive Governance	Does the policy include mechanisms for adapting governance structures and regulations as AI technology, particularly AGI, advances?	1. No mechanisms for adaptation. 2. Adaptation is possible but not clearly defined. 3. Some mechanisms for adaptation based on new information. 4. Clear process for reviewing and updating policies in response to AGI advancements. 5. Flexible and adaptive governance framework with built-in mechanisms for continuous learning and adjustment.
5.2. AI Supply Chain Security and Resilience	Does the policy address security risks within the AI supply chain (hardware, software, data, vendors), promotes resilience against disruptions or compromises, and includes strategic measures to foster domestic capabilities, aiming to reduce critical dependencies and enhance national self-sufficiency in key AI technologies.	1. No mention of AI supply chain risks, resilience, or national dependencies. 2. Vague acknowledgement of supply chain risks with no specific requirements or strategies for domestic capacity. 3. Identifies some AI supply chain risks and recommends basic security practices or domestic sourcing preference, but lacks concrete strategic plans, dedicated funding, or specific incentives for AI self-sufficiency. 4. Requires specific risk management practices for critical AI supply chain elements and includes targeted initiatives with dedicated funding or strong incentives to bolster domestic capacity and reduce dependencies in key AI technology areas. 5. Mandates a comprehensive national strategy for AI supply chain security and resilience, integrating robust risk management, resilience plans against disruptions, significant investment in domestic self-sufficiency, and clear goals to reduce critical foreign dependencies.

Appendix

Table 21: Long-Term AI Governance and Infrastructure Resilience Sub-criteria and Indicators

Criterion	Definition	Weight
6. Institutional Capacity and Authority	The policy establishes appropriately empowered, independent, resourced, and coordinated institutions to implement, oversee, and enforce it.	16.67%
7. Clarity and Specificity	The policy provisions are clearly defined, specific, and actionable, avoiding ambiguity and leaving little room for misinterpretation.	16.67%
8. Enforceability	The policy includes mechanisms for monitoring compliance, detecting violations, and enforcing its provisions, including appropriate penalties for non-compliance.	16.67%
9. Measurability	The policy objectives and intended outputs are measurable, allowing later assessment of implementation and results.	16.67%
10. Resource Requirements	The resources required for implementing and enforcing the policy are realistic, feasible, and proportionate to the policy’s objectives.	16.67%
11. Incentive Alignment	The policy aligns incentives for developers, deployers, users, and other affected actors to promote responsible AI development and deployment.	16.67%

Appendix

Table 22: Effectiveness and Feasibility Criteria

Sub-criterion	Definition	Indicators
6.1. Dedicated Oversight Body	Existence and specific mandate of a body (or bodies) primarily responsible for AI policy implementation, oversight, and enforcement.	1. No specific body identified or proposed for AI oversight. Responsibility is unassigned. 2. Mentions the need for oversight but relies on existing bodies without clearly expanding their mandate or resources for AI. 3. Designates an existing body or proposes a new body but with an unclear, limited, or overlapping mandate specific to AI governance. 4. Clearly designates or establishes a specific body with a defined mandate covering key aspects of the AI policy implementation and oversight. 5. Establishes or clearly empowers a dedicated body with a comprehensive, clearly defined, and primary mandate covering all major policy areas, including monitoring, guidance, and coordinating enforcement.
6.2. Independence and Authority	Level of operational independence from political or corporate influence and the legal authority granted to the oversight body.	1. The oversight body (if any) has no specified independence or distinct legal authority for AI matters. 2. Vague statements about needing authority or impartiality, but no structural guarantees or specific powers defined. 3. Some measures for independence are outlined (e.g., reporting structure), but legal authority for key actions (e.g., investigation, binding guidance) is limited or unclear. 4. Clear provisions ensuring significant operational independence and defined legal authority for key functions (e.g., investigation, issuing fines, setting standards within delegated powers). 5. Strong structural/statutory independence guaranteed, coupled with comprehensive legal authority (e.g., independent rule-making within its mandate, broad investigative powers, direct enforcement capabilities).
6.3. Resources and Expertise	Adequacy of dedicated funding, staffing, and necessary technical, legal, and ethical expertise within the oversight body.	1. No mention of specific resource allocation or expertise requirements for the oversight body. 2. Acknowledges the need for resources/expertise but provides no concrete commitments or plans. 3. Some resource allocation is mentioned but does not match the mandate. The policy refers generally to a need for diverse expertise. 4. Specifies dedicated funding streams or significant budget allocation and mandates the inclusion of specific technical, ethical, and legal expertise. 5. Guarantees substantial, ring-fenced, long-term funding, mandates specific high-level expertise across relevant domains, and includes plans for talent recruitment, retention, and training.
6.4. Interagency Coordination Mechanisms	Existence and operation of formal coordination and information-sharing procedures among government bodies involved in AI governance.	1. No mention of coordination between different government agencies on AI. 2. Vague mention of the need for collaboration without establishing specific mechanisms. 3. Establishes informal or ad-hoc coordination mechanisms (e.g., occasional meetings). 4. Establishes formal coordination structures (e.g., standing inter-agency committee or task force) with defined roles and responsibilities for AI policy. 5. Establishes robust, permanent coordination mechanisms with clear mandates, leadership, regular reporting, dedicated resources, and clear protocols for information sharing and joint action on AI governance.

Appendix

Table 23: Institutional Capacity and Authority Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
7.1. Implementation Plan	Clarity, feasibility, and level of detail provided in the policy regarding its implementation plan, including phases, timelines, milestones, and responsible parties.	1. No implementation plan or timeline outlined in the policy. 2. Vague statements about future implementation or gradual rollout without specifics. 3. Outlines some implementation steps or phases but lacks clear timelines, measurable milestones, or specific assignment of responsibilities. 4. Provides a clear implementation plan with distinct phases, key milestones, assigned responsibilities for major actions, and indicative timelines. 5. Provides a detailed, phased implementation plan with specific and measurable milestones, concrete timelines, clearly assigned responsibilities across agencies, and links to resource allocation.

Appendix

Table 24: Clarity and Specificity Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
8.1. Technical Feasibility	Are the technical requirements of the policy feasible to implement with current or near-future technology?	1. Policy requirements are largely unimplementable with current technology. 2. Most requirements are technically challenging or impractical. 3. A notable number of requirements are technically feasible, but others are challenging. 4. Most requirements are technically feasible. 5. All requirements are technically feasible with current or near-future technology.
8.2. Compliance Monitoring	Does the policy establish clear mechanisms for monitoring compliance?	1. No mechanisms for monitoring compliance. 2. Monitoring mechanisms are vaguely defined or inadequate. 3. Some mechanisms for monitoring compliance are outlined. 4. Well-defined mechanisms for monitoring compliance. 5. Comprehensive and robust mechanisms for monitoring compliance, including regular audits and reporting.
8.3. Enforcement Mechanisms	Does the policy specify enforcement mechanisms and penalties for non-compliance?	1. No enforcement mechanisms or penalties specified. 2. Enforcement mechanisms are weak or unclear. 3. Some enforcement mechanisms and penalties are defined. 4. Clear enforcement mechanisms and appropriate penalties are specified. 5. Comprehensive enforcement mechanisms with a range of penalties, including provisions for addressing serious violations.
8.4. Legal Status and Force	Assessment of the policy document’s formal legal standing and its binding nature on relevant actors.	1. Policy is purely informational, aspirational, or strategic (e.g., national strategy document, white paper) with no legal obligations. 2. Policy takes the form of voluntary guidelines, recommendations, or a code of conduct with no direct legal enforceability. 3. Policy uses soft regulatory tools (e.g., mandatory for government procurement only, relies on certification schemes) or has limited binding applicability (e.g., specific narrow sector). 4. Policy is a binding regulation or executive order creating clear legal obligations for defined actors/sectors, with established legal consequences for non-compliance. 5. Policy is enshrined in comprehensive, legally binding primary legislation (Statute/Act) with broad applicability across relevant sectors and strong, clearly defined enforcement powers and penalties.

Appendix

Table 25: Enforceability Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
9.1. Quantifiable Objectives	Does the policy define quantifiable objectives that can be used to measure its success?	1. No quantifiable objectives defined. 2. Objectives are vaguely defined and difficult to measure. 3. Some objectives are quantifiable, but others are not. 4. Most objectives are quantifiable. 5. All key objectives are clearly defined and quantifiable.
9.2. Data Collection and Reporting	Does the policy include provisions for collecting and reporting data relevant to the policy’s objectives and outcomes?	1. No provisions for data collection or reporting. 2. Data collection and reporting are vaguely defined. 3. Some data collection and reporting requirements are outlined. 4. Clear data collection and reporting requirements are specified. 5. Comprehensive data collection and reporting requirements, including provisions for data quality and transparency.
9.3. Performance Metrics	Does the policy define specific performance metrics to assess the effectiveness of AI systems in meeting the policy’s objectives?	1. No performance metrics defined. 2. Performance metrics are vaguely defined or inadequate. 3. Some performance metrics are defined. 4. Clear and relevant performance metrics are specified. 5. Comprehensive set of performance metrics aligned with policy objectives.

Appendix

Table 26: Measurability Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
10.1. Financial Resources	Does the policy consider the financial resources required for implementation and enforcement?	1. No consideration of financial resource requirements. 2. Financial resource requirements are underestimated or unrealistic. 3. Some consideration of financial resource requirements. 4. Realistic assessment of financial resource requirements. 5. Comprehensive analysis of financial resource requirements, including provisions for funding and cost-effectiveness.
10.2. Human Resources	Does the policy consider the human resources (e.g., expertise, personnel) required for implementation and enforcement?	1. No consideration of human resource requirements. 2. Human resource requirements are underestimated or unrealistic. 3. Some consideration of human resource requirements. 4. Realistic assessment of human resource requirements. 5. Comprehensive analysis of human resource requirements, including provisions for training and capacity building.
10.3. Technological Resources	Does the policy consider the technological resources (e.g., infrastructure, tools, data) required for implementation and enforcement?	1. No consideration of technological resource requirements. 2. Technological resource requirements are underestimated or unrealistic. 3. Some consideration of technological resource requirements. 4. Realistic assessment of technological resource requirements. 5. Comprehensive analysis of technological resource requirements, including provisions for infrastructure and tools.

Appendix

Table 27: Resource Requirements Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
11.1. Positive Incentives	Does the policy provide positive incentives (e.g., rewards, recognition) for responsible AI practices?	1. No positive incentives provided. 2. Positive incentives are vaguely defined or weak. 3. Some positive incentives are provided. 4. Clear and meaningful positive incentives are offered. 5. Comprehensive set of positive incentives that effectively promote responsible AI practices.
11.2. Negative Incentives	Does the policy include negative incentives (e.g., penalties, sanctions) for irresponsible AI practices?	1. No negative incentives specified. 2. Negative incentives are weak or unclear. 3. Some negative incentives are defined. 4. Clear and proportionate negative incentives are specified. 5. Comprehensive set of negative incentives that effectively deter irresponsible AI practices.
11.3. Incentive Compatibility	Are the incentives designed to be compatible with each other and with the overall objectives of the policy?	1. Incentives are contradictory or misaligned. 2. Incentives are weakly aligned with each other and with policy objectives. 3. Some incentives are aligned, but others are not. 4. Most incentives are aligned with each other and with policy objectives. 5. Incentives are fully compatible with each other and strongly aligned with the overall objectives of the policy.

Appendix

Table 28: Incentive Alignment Sub-criteria and Indicators

Criterion	Definition	Weight
12. Coverage of AI Lifecycle	The policy addresses the full lifecycle of AI systems, from initial design and data collection to development, deployment, monitoring, and eventual decommissioning.	20%
13. Range of Risks Addressed	The policy covers a wide range of risks associated with AI systems, including technical, ethical, societal, and governance risks.	20%
14. Stakeholder Inclusion	The policy considers the perspectives and roles of developers, deployers, users, regulators, and affected communities.	20%
15. Adaptability to Technological Advancements	The policy includes mechanisms for adapting to new and emerging AI technologies, including provisions for ongoing research, monitoring, and updates.	20%
16. International Harmonization	The policy aligns with or considers international standards, practices, and agreements related to AI governance, promoting consistency and cooperation across borders.	20%

Appendix

Table 29: Comprehensiveness and Scope Criteria

Sub-criterion	Definition	Indicators
12.1. Design Phase	Does the policy include provisions for responsible AI design principles and practices?	1. No consideration of the design phase. 2. Design phase is mentioned but not addressed in detail. 3. Some guidelines for responsible AI design. 4. Clear guidelines and requirements for responsible AI design. 5. Comprehensive framework for responsible AI design, including ethical considerations and risk assessment.
12.2. Data Collection and Preprocessing	Does the policy address data collection, preprocessing, and governance practices?	1. No consideration of data practices. 2. Data practices are mentioned but not addressed in detail. 3. Some guidelines for responsible data practices. 4. Clear guidelines and requirements for data collection, preprocessing, and governance. 5. Comprehensive framework for responsible data practices, including provisions for data quality, fairness, and privacy.
12.3. Development and Testing	Does the policy include provisions for responsible AI development and testing methodologies?	1. No consideration of development and testing. 2. Development and testing are mentioned but not addressed in detail. 3. Some guidelines for responsible development and testing. 4. Clear guidelines and requirements for development and testing, including validation and verification. 5. Comprehensive framework for responsible development and testing, including provisions for robustness, security, and explainability.
12.4. Deployment and Monitoring	Does the policy address the deployment and ongoing monitoring of AI systems?	1. No consideration of deployment and monitoring. 2. Deployment and monitoring are mentioned but not addressed in detail. 3. Some guidelines for responsible deployment and monitoring. 4. Clear guidelines and requirements for deployment and monitoring, including performance tracking and risk assessment. 5. Comprehensive framework for responsible deployment and monitoring, including provisions for continuous evaluation and adaptation.
12.5. Decommissioning	Does the policy address the eventual decommissioning or retirement of AI systems?	1. No consideration of decommissioning. 2. Decommissioning is mentioned but not addressed in detail. 3. Some guidelines for responsible decommissioning. 4. Clear guidelines and requirements for decommissioning. 5. Comprehensive framework for responsible decommissioning, including provisions for data retention, model updates, and system retirement.

Appendix

Table 30: Coverage of AI Lifecycle Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
13.1. Technical Risks	Does the policy address technical risks such as safety, security, robustness, reliability, and integration with existing non-AI systems and infrastructure?	1. No consideration of technical risks. 2. Technical risks are mentioned but not addressed in detail. 3. Some guidelines for addressing technical risks. 4. Clear guidelines and requirements for mitigating technical risks. 5. Comprehensive framework for managing technical risks, including specific standards and best practices.
13.2. Ethical Risks	Does the policy address ethical risks such as bias, fairness, transparency, accountability, and privacy?	1. No consideration of ethical risks. 2. Ethical risks are mentioned but not addressed in detail. 3. Some guidelines for addressing ethical risks. 4. Clear guidelines and requirements for mitigating ethical risks. 5. Comprehensive framework for managing ethical risks, including provisions for ethical audits and impact assessments.
13.3. Societal Risks	Does the policy address societal risks such as job displacement, inequality, social manipulation, and erosion of trust?	1. No consideration of societal risks. 2. Societal risks are mentioned but not addressed in detail. 3. Some guidelines for addressing societal risks. 4. Clear guidelines and requirements for mitigating societal risks. 5. Comprehensive framework for managing societal risks, including provisions for public engagement and social impact assessments.
13.4. Governance Risks	Does the policy address governance risks such as lack of accountability, regulatory gaps, and challenges to international cooperation?	1. No consideration of governance risks. 2. Governance risks are mentioned but not addressed in detail. 3. Some guidelines for addressing governance risks. 4. Clear guidelines and requirements for mitigating governance risks. 5. Comprehensive framework for managing governance risks, including provisions for regulatory oversight and international collaboration.

Appendix

Table 31: Range of Risks Addressed Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
14.1. Stakeholder Identification	Does the policy clearly identify all relevant stakeholders affected by AI systems?	1. No stakeholders are identified. 2. Some stakeholders are identified, but with significant gaps. 3. Most relevant stakeholders are identified. 4. All relevant stakeholders are clearly identified. 5. Comprehensive stakeholder identification, including marginalized and underrepresented groups.
14.2. Stakeholder Engagement	Does the policy include mechanisms for engaging stakeholders in the policy development and implementation process?	1. No mechanisms for stakeholder engagement. 2. Limited opportunities for stakeholder input. 3. Some mechanisms for stakeholder engagement. 4. Well-defined mechanisms for stakeholder engagement. 5. Multiple, robust mechanisms for stakeholder engagement, ensuring diverse perspectives are considered.
14.3. Stakeholder Roles and Responsibilities	Does the policy clearly define the roles and responsibilities of different stakeholders in relation to AI safety and governance?	1. Roles and responsibilities are not defined. 2. Roles and responsibilities are vaguely mentioned. 3. Some roles and responsibilities are defined, but gaps remain. 4. Most roles and responsibilities are clearly defined. 5. Comprehensive definition of roles and responsibilities for all relevant stakeholders, including provisions for accountability and redress.

Appendix

Table 32: Stakeholder Inclusion Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
15.1. Technology Monitoring	Does the policy establish mechanisms for monitoring advancements in AI technology and their potential implications?	1. No provisions for technology monitoring. 2. Technology monitoring is mentioned but not clearly defined. 3. Some mechanisms for technology monitoring are outlined. 4. Clear mechanisms for monitoring technological advancements. 5. Comprehensive framework for monitoring technological advancements, including early warning systems for emerging risks.
15.2. Policy Review and Update	Does the policy include a process for regularly reviewing and updating its provisions in response to new technological developments?	1. No process for policy review or update. 2. Policy review is possible but not clearly defined or mandated. 3. Some provisions for policy review and update. 4. Clear process for regular policy review and update. 5. Comprehensive process for policy review and update, including triggers for review based on specific technological advancements.
15.3. Flexibility and Adaptability	Is the policy framework designed to be flexible and adaptable to accommodate new AI technologies and applications?	1. Policy framework is rigid and inflexible. 2. Limited flexibility to accommodate new technologies. 3. Some flexibility but may not be sufficient for all new technologies. 4. Policy framework is designed to be adaptable to most new technologies. 5. Highly flexible and adaptable framework that can accommodate a wide range of emerging AI technologies, applications, and sudden changes to the AI landscape of a nation.
15.4. Incident reporting, review and global Monitoring	Existence of mechanisms for reporting AI incidents/failures or events and processes for analyzing these incidents to adapt policy and best practices.	1. No formal mechanisms for internal incident reporting/review or systematic global AI monitoring. 2. Informal or ad hoc approaches to incident reporting or global monitoring with no defined structure, analysis, or feedback. 3. Establishes formal but limited/voluntary internal incident reporting or assigns responsibility for basic global monitoring, but lacks systematic analysis and policy feedback integration for either. 4. Formal internal incident reporting/review process (may be limited in scope) and a structured process for regular global AI monitoring and reporting to inform policy reviews. 5. Comprehensive, mandatory internal incident reporting, review, and learning system and robust, continuous global AI monitoring with dedicated analysis and a formal, rapid feedback loop for policy/strategy adaptation.

Appendix

Table 33: Adaptability to Technological Advancements Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
16.1. Alignment with International Standards	Does the policy align with relevant international standards and guidelines for AI governance?	1. No consideration of international standards. 2. Limited alignment with international standards. 3. Some alignment with international standards. 4. Strong alignment with international standards. 5. Comprehensive alignment with international standards, including active participation in their development.
16.2. Cross-Border Data Flows	Does the policy address the challenges of cross-border data flows and data governance in the context of AI systems?	1. No consideration of cross-border data flows. 2. Cross-border data flows are mentioned but not addressed in detail. 3. Some guidelines for managing cross-border data flows. 4. Clear guidelines and requirements for managing cross-border data flows. 5. Comprehensive framework for managing cross-border data flows, including provisions for data localization, data sovereignty, and international data sharing agreements.
16.3. International Cooperation	Does the policy promote international cooperation in AI governance, including mechanisms for information sharing, joint research, and coordinated policy development?	1. No provisions for international cooperation. 2. International cooperation is encouraged but not prioritized. 3. Some mechanisms for international cooperation are outlined. 4. Clear commitments to international cooperation, including specific initiatives and partnerships. 5. Comprehensive framework for international cooperation, including mechanisms for joint research, information sharing, and coordinated policy development.

Appendix

Table 34: International Harmonization Sub-criteria and Indicators

Criterion	Definition	Weight
17. Fairness and Non-discrimination	The policy addresses bias, fairness, and non-discrimination in AI systems, including provisions for identifying, mitigating, and monitoring bias.	25%
18. Transparency and Explainability	The policy promotes transparency and explainability in AI decision-making, enabling affected people to understand relevant outputs or decisions.	25%
19. Privacy and Data Protection	The policy includes provisions for protecting privacy and securing personal data used in AI systems under the applicable data protection rules.	25%
20. Accountability	The policy establishes responsibility for the development, deployment, and use of AI systems, including mechanisms for liability and redress when appropriate.	25%

Appendix

Table 35: User Rights, Protection and Agency Criteria

Sub-criterion	Definition	Indicators
17.1. Bias Detection and Mitigation	Does the policy require or encourage the use of methods for detecting and mitigating bias in AI systems?	1. No consideration of bias. 2. Bias is mentioned but not addressed in detail. 3. Some guidelines for bias detection and mitigation. 4. Clear guidelines and requirements for bias detection and mitigation. 5. Comprehensive framework for bias detection and mitigation, including specific methodologies and metrics.
17.2. Protected Groups	Does the policy explicitly address the potential impact of AI systems on protected groups (e.g., based on race, gender, religion)?	1. No consideration of protected groups. 2. Protected groups are mentioned but not addressed in detail. 3. Some guidelines for protecting the rights of protected groups. 4. Clear guidelines and requirements for protecting the rights of protected groups. 5. Comprehensive framework for protecting the rights of protected groups, including provisions for auditing and redress.

Appendix

Table 36: Fairness and Non-discrimination Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
18.1. Transparency Requirements	Does the policy specify transparency requirements for AI systems, including documentation of data, algorithms, and decision-making processes?	1. No transparency requirements. 2. Transparency is encouraged but not clearly defined. 3. Some transparency requirements are outlined. 4. Clear and specific transparency requirements are specified. 5. Comprehensive transparency requirements, including provisions for data provenance, model documentation, and decision-making logic.
18.2. Explainability Methods	Does the policy encourage or mandate the use of explainability methods to make AI systems more understandable to humans?	1. No consideration of explainability. 2. Explainability is mentioned but not addressed in detail. 3. Some guidelines for using explainability methods. 4. Clear guidelines and recommendations for using explainability methods. 5. Comprehensive framework for explainability, including provisions for different types of explanations (e.g., local, global) and different stakeholder needs.
18.3. Interpretability for Non-Experts	Does the policy consider the need for interpretability by non-experts, including lay users and affected communities?	1. No consideration of interpretability for non-experts. 2. Interpretability for non-experts is mentioned but not prioritized. 3. Some guidelines for making AI systems understandable to non-experts. 4. Clear guidelines and requirements for interpretability by non-experts. 5. Comprehensive framework for interpretability by non-experts, including provisions for user-friendly explanations and interfaces.

Appendix

Table 37: Transparency and Explainability Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
19.1. Data Minimization and Purpose Limitation	Does the policy promote data minimization principles, limiting the collection and use of personal data to what is strictly necessary for the intended purpose?	1. No consideration of data minimization. 2. Data minimization is encouraged but not clearly defined. 3. Some guidelines for data minimization. 4. Clear requirements for data minimization and purpose limitation. 5. Comprehensive framework for data minimization and purpose limitation, including provisions for data deletion and retention policies.
19.2. Data Security	Does the policy mandate appropriate security measures to protect personal data from unauthorized access, use, or disclosure?	1. No specific security measures mentioned. 2. Security measures are encouraged but not defined. 3. Some security measures are outlined. 4. Clear and specific security requirements are specified. 5. Comprehensive security requirements, including encryption, access controls, and regular security audits.
19.3. Consent and Individual Rights	Does the policy ensure that individuals have meaningful control over their personal data, including the right to access, rectify, erase, and restrict processing?	1. No consideration of individual rights. 2. Individual rights are mentioned but not fully addressed. 3. Some provisions for individual rights. 4. Clear mechanisms for individuals to exercise their rights. 5. Comprehensive framework for individual rights, including provisions for informed consent, data portability, and the right to be forgotten.

Appendix

Table 38: Privacy and Data Protection Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
20.1. Responsibility Allocation	Does the policy clearly define the responsibilities of different actors in the AI lifecycle (e.g., developers, deployers, users)?	1. Responsibilities are not defined. 2. Responsibilities are vaguely mentioned. 3. Some responsibilities are defined, but gaps remain. 4. Most responsibilities are clearly defined. 5. Comprehensive definition of responsibilities for all relevant actors.
20.2. Liability Framework	Does the policy establish a liability framework for determining who is liable when AI systems cause harm or errors?	1. No liability framework established. 2. Liability framework is unclear or inadequate. 3. Some aspects of liability are addressed. 4. Clear liability framework for most scenarios. 5. Comprehensive liability framework that addresses various types of harm and different levels of AI autonomy.
20.3. Redress Mechanisms	Does the policy provide mechanisms for individuals or groups to seek redress for harm caused by AI systems?	1. No redress mechanisms provided. 2. Redress mechanisms are limited or difficult to access. 3. Some redress mechanisms are available. 4. Clear and accessible redress mechanisms are established. 5. Comprehensive redress mechanisms, including provisions for compensation, remediation, and appeal.

Appendix

Table 39: Accountability Sub-criteria and Indicators

Criterion	Definition	Weight
21. Societal Benefit	The policy promotes the development and use of AI systems that provide public benefits in areas such as healthcare, education, environmental sustainability, and economic activity.	20%
22. Innovation	The policy fosters responsible AI research, development, and deployment while addressing relevant risks.	20%
23. Economic Growth	The policy supports economic development through AI adoption while addressing challenges such as job displacement and market disruption.	20%
24. Social Equity	The policy addresses how AI benefits and harms are distributed, including effects on marginalized or vulnerable groups.	20%
25. Public Trust	The policy supports warranted public trust through transparency, accountability, public education, and opportunities for participation.	20%

Appendix

Table 40: Socioeconomic Impact and Innovation Criteria

Sub-criterion	Definition	Indicators
21.1. Identification of Beneficial Applications	Does the policy identify specific areas where AI can provide significant societal benefits?	1. No identification of beneficial applications. 2. Beneficial applications are mentioned but not prioritized. 3. Some areas of societal benefit are identified. 4. Clear identification of key areas where AI can provide significant benefits. 5. Comprehensive analysis of potential societal benefits across various sectors.
21.2. Incentives for Beneficial AI	Does the policy provide incentives (e.g., funding, grants, recognition) for the development and deployment of AI systems that address societal needs?	1. No incentives for beneficial AI. 2. Incentives are weak or unclear. 3. Some incentives for beneficial AI are provided. 4. Clear and meaningful incentives for beneficial AI. 5. Comprehensive set of incentives that effectively promote the development and deployment of beneficial AI.
21.3. Measurement of Societal Impact	Does the policy include mechanisms for measuring and evaluating the societal impact of AI systems?	1. No mechanisms for measuring societal impact. 2. Societal impact is mentioned but not measured. 3. Some metrics for measuring societal impact are proposed. 4. Clear metrics for measuring societal impact. 5. Comprehensive framework for measuring and evaluating the societal impact of AI, including both positive and negative impacts.

Appendix

Table 41: Societal Benefit Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
22.1. Support for Research and Development	Does the policy provide support for research and development in AI, including funding, infrastructure, and talent development?	1. No support for AI research and development. 2. Limited support for AI research and development. 3. Some funding and support for AI research and development. 4. Significant funding and support for AI research and development. 5. Comprehensive support for AI research and development, including long-term investments and strategic initiatives.
22.2. Regulatory Sandboxes and Testbeds	Does the policy promote the use of regulatory sandboxes or testbeds to experiment with new AI technologies and applications in a controlled environment?	1. No mention of regulatory sandboxes or testbeds. 2. Sandboxes or testbeds are mentioned but not clearly defined. 3. Some provisions for regulatory sandboxes or testbeds. 4. Clear guidelines and procedures for establishing and operating regulatory sandboxes or testbeds. 5. Comprehensive framework for regulatory sandboxes or testbeds, including provisions for data sharing, risk assessment, and stakeholder engagement.
22.3. Innovation-Friendly Regulation	Is the policy framework designed to be flexible and adaptable to accommodate new AI innovations without stifling their development?	1. Policy framework is rigid and inflexible, hindering innovation. 2. Limited flexibility to accommodate new innovations. 3. Some flexibility but may not be sufficient for all new innovations. 4. Policy framework is designed to be adaptable to most new innovations. 5. Highly flexible and adaptable framework that encourages responsible innovation while mitigating risks.

Appendix

Table 42: Innovation Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
23.1. Investment in AI Ecosystem	Does the policy promote investment in the AI ecosystem, including startups, businesses, and research institutions?	1. No provisions for promoting investment in the AI ecosystem. 2. Investment is encouraged but not prioritized. 3. Some incentives for investing in the AI ecosystem. 4. Clear incentives and support for investment in the AI ecosystem. 5. Comprehensive strategy for promoting investment in the AI ecosystem, including tax breaks, grants, and venture capital initiatives.
23.2. Workforce Development	Does the policy address the need for workforce development and retraining to prepare workers for the changing job market due to AI adoption?	1. No consideration of workforce development. 2. Workforce development is mentioned but not addressed in detail. 3. Some guidelines for workforce development and retraining. 4. Clear guidelines and programs for workforce development and retraining. 5. Comprehensive framework for workforce development, including provisions for education, training, and job placement.
23.3. Market Competitiveness	Does the policy promote fair competition in the AI market, preventing monopolies and ensuring a level playing field for businesses of all sizes?	1. No consideration of market competitiveness. 2. Market competitiveness is mentioned but not addressed in detail. 3. Some guidelines for promoting fair competition. 4. Clear guidelines and regulations to prevent monopolies and promote fair competition. 5. Comprehensive framework for ensuring market competitiveness, including antitrust measures and support for small and medium-sized enterprises.

Appendix

Table 43: Economic Growth Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
24.1. Access to AI Benefits	Does the policy promote equitable access to the benefits of AI technologies, regardless of socioeconomic status, geographic location, or other factors?	1. No consideration of equitable access to AI benefits. 2. Equitable access is mentioned but not prioritized. 3. Some initiatives to promote equitable access. 4. Clear guidelines and programs to ensure equitable access. 5. Comprehensive framework for promoting equitable access to AI benefits, including targeted interventions for marginalized communities.
24.2. Social Safety Nets	Does the policy consider the need for social safety nets like Universal Basic Income (UBI) to support individuals and communities affected by job displacement or other negative consequences of AI adoption?	1. No consideration of social safety nets. 2. Social safety nets are mentioned but not addressed in detail. 3. Some provisions for social safety nets. 4. Clear guidelines and programs for social safety nets. 5. Comprehensive framework for social safety nets, including provisions for retraining, job placement, and income support (UBI).
24.3. Digital Divide	Does the policy address the digital divide and ensure that access to AI technologies and their benefits is not limited by factors such as internet access, digital literacy, or device availability?	1. No consideration of the digital divide. 2. Digital divide is mentioned but not prioritized. 3. Some initiatives to address the digital divide. 4. Clear guidelines and programs to bridge the digital divide. 5. Comprehensive framework for addressing the digital divide, including provisions for infrastructure development, digital literacy training, and affordable access to devices and internet.

Appendix

Table 44: Social Equity Sub-criteria and Indicators

Sub-criterion	Definition	Indicators
25.1. Public Awareness and Education	Does the policy include initiatives to raise public awareness and understanding of AI technologies, their potential benefits and risks?	1. No provisions for public awareness or education. 2. Public awareness is mentioned but not prioritized. 3. Some initiatives to raise public awareness. 4. Clear guidelines and programs for public education on AI. 5. Comprehensive public awareness and education campaigns, including resources for different stakeholder groups.
25.2. Public Engagement	Does the policy provide opportunities for public engagement and consultation in the development and implementation of AI policies?	1. No mechanisms for public engagement. 2. Limited opportunities for public input. 3. Some mechanisms for public consultation. 4. Well-defined mechanisms for public engagement. 5. Multiple, robust mechanisms for public engagement, ensuring diverse perspectives are considered in policy-making.
25.3. Trust-Building Measures	Does the policy promote trust-building measures, such as transparency, explainability, and accountability, in the design and deployment of AI systems?	1. No explicit trust-building measures. 2. Trust is mentioned but not addressed in detail. 3. Some guidelines for promoting trust. 4. Clear requirements for transparency, explainability, and accountability. 5. Comprehensive framework for building and maintaining public trust in AI, including independent audits, certification schemes, and redress mechanisms.

Appendix

Table 45: Public Trust Sub-criteria and Indicators

AI Governance

Artificial intelligence governance studies how laws, institutions, and technical controls shape AI development, deployment, accountability, and social effects.

See all 381 papers

An Instrument to Evaluate Governance Proposals: AI Policy Analysis at Scale
Jul 30, 2026Paulo Carvao, Claudio Mayrink Verdun, Isabel Adler +1LLM Evaluation Policy Evaluation
Mossavar-Rahmani Center for Business and Government · Harvard Kennedy School · Harvard Kennedy School of Government +2
Mapping General-Purpose AI Governance in Twenty AI Middle-Power Jurisdictions
Aug 18, 2026Josephine Schwab, Nathan Naidoo, Ferruccio Barazzutti +2AI Governance AI Accountability
Arcadia Impact AI Governance Taskforce
Policy Convergence and Divergence Across National and Within Regional AI Strategies: A Policy Design Element Analysis
Aug 11, 2026Benjamin Faveri, Brie BhasinAI Governance
CEIMIA · Carleton University · University of Ottawa

Jul 30, 2026J/K move · Enter open · S save

An Instrument to Evaluate Governance Proposals: AI Policy Analysis at Scale

Paulo Carvao, Claudio Mayrink Verdun, Isabel Adler, Jeffrey Zhou

Mossavar-Rahmani Center for Business and Government · Harvard Kennedy School · Harvard Kennedy School of Government+2

LLM Evaluation Policy Evaluation Rubric-Based Evaluation AI Governance

Open paper AskPDF arXiv

This paper introduces a policy analysis framework for systematic, transparent assessment of AI governance proposals in an evolving and contested regulatory landscape. AI policy debates often collapse into binary positions that obscure underlying tradeoffs and normative assumptions. The framework structures policy analysis around multiple policy attributes, allowing users to surface priorities and tensions without prescribing outcomes. We use a mixed-methods approach that integrates qualitative insights from subject matter experts with computational text analysis to inform the design of policy attribute rubrics. This quantifies the relative emphasis of different policy objectives and presents them through comparative visualizations that support interpretability and cross-policy comparison. The paper also examines the use of commercial LLMs for rubric-based policy analysis, benchmarking their outputs against a domain-trained rubric-calibrated model with explicitly defined analytical assumptions. Rather than assessing policy effectiveness or desirability, the framework focuses on relevance and alignment across attributes. By making analytical assumptions explicit, including attribute selection, rubric construction, and weighting schemes, the framework enables users to evaluate whether its embedded priorities align with the users' own normative commitments. The approach is jurisdiction-agnostic and intended to support policymakers, analysts, and researchers navigating complex AI governance environments. Contributions: (1) multidimensional policy assessment through empirically grounded rubrics that surface tradeoffs rather than resolving them; (2) a transparent hybrid methodology combining feedback from subject-matter experts with computational validation; and (3) use of domain-trained rubric-calibrated models as a benchmark for comparing different general-purpose large language models.

Abstract

AI Governance

Explore similar work

An Instrument to Evaluate Governance Proposals: AI Policy Analysis at Scale

Mapping General-Purpose AI Governance in Twenty AI Middle-Power Jurisdictions

Policy Convergence and Divergence Across National and Within Regional AI Strategies: A Policy Design Element Analysis