The layer above the state
Global AI governance is best read by function. Five kinds of instrument now sit above the nation state, and each does a different job.
Principles (OECD, UNESCO)
The OECD AI Principles (2019, updated 2024) remain the reference point for intergovernmental AI policy and the source of much of the vocabulary of national AI policies. The UNESCO Recommendation on the Ethics of Artificial Intelligence (2021) extends similar commitments across more than 190 member states. The G7 Hiroshima Process (2023) added a code of conduct for organisations developing advanced systems. These instruments confer legitimacy and a shared language, and carry few binding obligations of their own.
Conventions and law (Council of Europe, European Union)
The Council of Europe Framework Convention on Artificial Intelligence (2024) is the first legally binding international treaty on AI, open to signature beyond Europe. The EU AI Act (2024) is domestic law with extraterritorial reach: any government whose firms sell into the single market inherits parts of its logic whether it chooses to or not. Between them, they define the binding end of the spectrum: obligations with dates, scope and enforcement.
Standards (ISO, NIST)
ISO/IEC 42001 (2023) defines an auditable AI management system. The NIST AI Risk Management Framework (2023) and its Generative AI Profile (2024) supply the risk vocabulary most jurisdictions now borrow. Standards are voluntary by nature and contractual in practice: they enter through procurement clauses, certification schemes and regulatory references.
Institutions (AI Security Institute, CAISI, United Nations, OECD)
The institutional layer has consolidated quickly. National AI safety institutes emerged from the Bletchley summit (2023) and formed an international network in 2024. The renaming of the United Kingdom institute to the AI Security Institute and of the United States institute to the Center for AI Standards and Innovation (both 2025) signals the field's shift toward security and standards. The Global Partnership on AI has folded into the OECD, and the United Nations has established a Global Dialogue on AI Governance together with an Independent International Scientific Panel (2025).
The summit cycle
Bletchley (2023) framed frontier safety. Seoul (2024) secured voluntary frontier-model commitments. Paris (2025) broadened the agenda to action and investment, and New Delhi (2026) continued the cycle. Summits set expectations and create moments of accession, while every allocation of responsibility inside a national administration remains open.
Timeline: Bletchley 2023 (frontier safety), Seoul 2024 (commitments), Paris 2025 (action), New Delhi 2026 (impact).
Sheet 01 of 13, the global-to-national funnel: the global layer provides principles and vocabulary, model rules to transpose, standards to reference, evaluation science to borrow, and clubs to join. Every government still decides the allocation of functions, sequencing across sectors, the capability and its funding, legal anchoring, and cross-sector coherence.
What remains with governments
Every instrument above stops short of the decisions that shape a national system. The five questions that structure Part III of this playbook are precisely the ones the global layer cannot answer.
- Allocation. Which entity carries standard-setting, evaluation and testing, assurance, and use-regulation? No treaty assigns them.
- Sequencing. Does the regime arrive economy-wide at once, or sector by sector as regulatory maturity allows? No standard sequences a rollout.
- Capability. Where does the safety and security evaluation function live, and who funds its upfront cost? Membership of the institute network presumes it exists.
- Anchoring. Which domestic instruments make the design binding? The answer depends on the jurisdiction: a dedicated law, targeted amendments or an existing statutory plan. Adoption without transposition carries limited practical effect.
- Coherence. How do finance, energy, health and telecom regulators apply one framework without producing divergent rules? Interoperability abroad starts with coherence at home.
Common failure mode. Citation without transposition. Governance programs may cite the OECD Principles or the EU AI Act in their preambles while the underlying design makes limited use of either. A cited instrument takes effect only when a named domestic instrument carries it, with an owner, a date and a review cycle.
The rest of this playbook is about making those five decisions well. Chapter 2 examines what happens when they are skipped: the implementation gap that separates published programs from working governance systems.