Protesters demonstrate outside of the OpenAI DevDay 2026 conference, Tuesday, Sept. 29, 2026, in San Francisco. (AP Photo/Jeff Chiu)

Multiple Polls Find Most Americans Think AI is Moving Too Fast

President Stubb and Prime Minister Støre in Rovaniemi on September 13, 2026. Photo: Katja Säilä / Finnish Government

AI Governance Needs an Internet-Style Network, Not a Global Overseer

Person hold the speaker to broadcast something

Why Multistakeholder Action Matters More than Ever for Trust & Safety

This image depicts clusters of various mushrooms growing on a network of surveillance cameras against a dark green textured background.

India’s GDPR-Inspired Privacy Law Leaves State Power Unchecked

A woman dressed in green holds a up a poster of a newspaper front page that says "Democracy is not a joke, Gyanesh". She is seen shouting, while at least three police officers appear to be pulling her away from behind as she steadies herself with one hand against the back of a truck.

A protester in Mumbai, India is detained by police during a protest demanding the resignation of the country's chief election commissioner Gyanesh Kumar on Oct. 10, 2026. (AP Photo/Rafiq Maqbool)

India’s SIR Voter Purge Shows Digital Authoritarianism in Action

Mothballed Spirit Airlines passenger planes sit parked at Goodyear Airport, Thursday, May 28, 2026, in Goodyear, Ariz. (AP Photo/Ross D. Franklin)

Spirit Airlines Is Selling Its Workers’ Data. That Can’t Fly.

President Donald Trump speaks in the East Room of the White House in Washington, Tuesday Sept. 29, 2026, during a lunch meeting with top executives of AI firms, as NVIDIA CEO Jensen Huang, left, and Elon Musk listen. (AP Photo/Jacquelyn Martin)

AI Governance Is Being Decided Now, and the Public Isn’t in the Room

In this photo provided by Ukraine's 65th Mechanized Brigade press service, A Ukrainian serviceman launches a drone towards Russian positions at the front line in the Zaporizhzhia region, Ukraine, Wednesday Oct. 7, 2026. (Andriy Andriyenko/Ukraine's 65th Mechanized Brigade via AP)

Coding Kids, Drone Wars and Algorithmic Realism

Teachers attend an artificial intelligence professional development and certification program hosted by learning company Pearson on August 7, 2026, in Miami. Nearly 200 teachers from Miami-Dade County Public Schools participated and are now working toward a verified AI credential as they begin the new school year. The program is part of Pearson's commitment to expand AI learning opportunities for teachers nationwide through the White House's "Pledge to America's Youth: Investing in AI Education." (Jesus Aranguren/AP Content Services for Pearson)

Natasha Singer Details Tech’s Grip on Public Schools

Ukrainian servicemen of the Pathfinder Unmanned Systems Battalion of the 115th Separate Mechanized Brigade attend a training with Vampire UAVs, practicing munition drops at an undisclosed location in Kharkiv region, Ukraine, Thursday, Oct. 8, 2026. (AP Photo/Andrii Marienko)

Steve Feldstein on Bytes, Bullets, Blood and Borders

In this Jan. 16, 2017, file photo, the abandoned childhood home of singer Aretha Franklin sits behind a security fence in Memphis, Tenn. The Franklin birthplace and the surrounding neighborhoods moved to the forefront of a large cleanup effort, as the city refused to accept decay as a fact of life in the urban landscape. (AP Photo/Mark Humphrey, File)

A Data Science Playbook for Social Justice

Who Participates in Politics on Social Media, and Why?

Europe Wants to Regulate AI Friends. But How Do You Curb Dependency?

Taoiseach Micheal Martin and European Commission President Ursula von der speaking during a press conference in the Main Quadrangle at University College Cork, as Ireland begins its presidency of the EU Council. Photo: Liam McBurney/PA Wire IRISH (Press Association via AP Images)

At Ireland’s AI Summit, Tech Industry Dominates as Civil Society Sits Out

A vintage court room with many chairs, benches, and a neon lit ceiling, and black and white portraits on wood panelled walls. 

A courtroom of the US District Court for the Northern District of Illinois. 

Nippon Life v. OpenAI and the Future of AI Legal Work

A grafiti drawing of a white skeleton on an asphalt street with a sewer grid placed direclty where the ribs would be.

 is shared by diegoluis on Flickr (CC-BY)

Tech Hype is Cannibalizing the Future

The street front of a mobile money agent with an Airtel umbrella and sign in the foreground. One person is sitting to the left, reading, another person can be seen from behind inside the store. 

 in Gulu, northern Uganda in 2016 shared by Fiona Graham/WorldRemit on Flickr (CC BY-SA)

In Africa, Digital Payments Could Unlock Tax Revenue if Data is Protected

A pile of narrowly shredded white newspaper with black writing that is not legible.

Cutting Local Journalists, McClatchy Embraces AI Content

Disinformation Conference in Europe Caught Up in Transatlantic Politics

President Donald Trump gestures to Elon Musk as he speaks to reporters at the White House in Washington, Tuesday Sept. 29, 2026, after meeting with top executives of AI firms. (AP Photo/Jacquelyn Martin)

It's Time to Regulate the AI Development Process

Following multiple incidents over the past several months where AI agents operated by 

 intruded on third party systems, industry leaders including Anthropic’s 

 of AI development. But the Trump administration has rejected calls for a slowdown.

“We’re leading China in AI, we’re the most sophisticated country in the world, and frankly, I want to keep it that way because whoever wins AI, wins,” President Donald Trump 

 last month. “And we can put guardrails, we can do this and that. But I think you have a lot of negative forces that are bringing it up that shouldn’t be bringing it up.”

In five national polls in 2026, the share of American adults saying AI is moving too fast or should slow down ranged from 55% to 77%. Each poll worded the question differently, as shown below. In the polls that broke out results by party, Democrats were more concerned about AI than Republicans. But in three of the four polls that asked by party, a majority of Republicans also said AI was moving too fast.

 that Democrats have “seized on” the Trump administration’s resistance to AI regulation “as a line of attack” in the US midterm elections. 

Finland President Alexander Stubb and Norway Prime Minister Jonas Gahr Støre in Rovaniemi on September 13, 2026. Photo: Katja Säilä / Finnish Government

Last month, leaders from a mostly European coalition of more than 30 countries signed a 

 led by the president of Finland and the prime minister of Norway for stronger controls on frontier AI. The document advocates for mandatory pre-deployment testing and independent evaluation, common standards, incident reporting, access to scientific expertise and trusted evaluation. It also proposes exploring a new international institution that could set standards, enable verification and convene states when capability thresholds are crossed. The first part is essential; the second deserves more thought.

Today, too few institutions have the technical capacity to independently understand, test and challenge frontier AI. At the same time, a small number of companies control much of the compute, capital, expertise and access to the most advanced systems. Governments therefore risk becoming dependent on the companies they are trying to regulate for the evidence needed to regulate them.

The answer should be to build capability from the bottom up.

The Internet provides an important lesson because its global reach was built alongside a system of distributed governance. The Internet did not develop around a single institution with authority over the entire network. Different organizations took responsibility for different functions and were connected through common standards, protocols and coordination mechanisms. The 

 (IETF) developed the technical standards that allow different networks and systems to interoperate. The 

 coordinate Internet number resources within their regions. The 

Internet Corporation for Assigned Names and Numbers

 (ICANN) coordinates critical identifiers while working with the technical community and the regional registries. None of these organizations runs the Internet. Their roles are narrower, and their effectiveness comes partly from the fact that they operate within a wider system of distributed technical responsibility.

This architecture was not designed once and imposed from above; it evolved as the network evolved. Problems created new institutions, practices and coordination mechanisms; existing institutions adapted; and technical expertise remained distributed. That did not eliminate politics or conflict. It did, however, prevent the governance of a global network from becoming dependent on a single center of authority or expertise.

The experience of Internet security makes the lesson even clearer. After the 

 disrupted large parts of the Internet, the initial response was fragmented and uncoordinated. The 

 was established, but it did not become a global cybersecurity authority. Instead, incident-response teams proliferated around different networks, sectors and countries. The 

 of the Forum of Incident Response and Security Teams, or FIRST, in 1990 provided a mechanism for those teams to exchange information and coordinate across borders. The model was simple: build technical capability close to where problems occur, then connect that capability.

That approach became particularly important because one network’s security problem is every network’s security problem. A vulnerability discovered in one network can affect thousands of others. The solution was not to put every incident under one institution but to ensure that more institutions could identify, investigate and respond to problems while having mechanisms to share what they learned. FIRST today brings together government, commercial and academic incident-response teams around precisely that principle.

The lesson for AI is not to recreate the IETF, ICANN or CERTs. AI is a very different technology and has a far more concentrated architecture. The lesson is institutional: when a global system is too complex and distributed to be governed effectively from one center, build capability where it is needed and connect it through common processes.

AI currently has almost the opposite problem. Its technical infrastructure is highly concentrated, while its independent governance capacity is still thin. This is where the emerging network of AI safety, security and evaluation institutes matters as these institutes can provide the capacity governments increasingly need: testing models, evaluating risks, investigating incidents, developing benchmarks and challenging industry claims. International cooperation can then make their work comparable and useful beyond their own borders.

Not every country will need a frontier-model laboratory. But a country should be able to develop expertise relevant to how AI will actually be used within its own context. A researcher in Nairobi may identify risks involving language or public-sector applications that an evaluator in Silicon Valley misses. An institution in New Delhi may understand deployment conditions that are invisible to a European laboratory. A national or regional evaluation center can assess not only whether a system is safe in the abstract, but whether it is appropriate for the institutions, populations and infrastructure in which it will operate.

This also speaks to the claims over digital sovereignty. In today’s technological environment, digital sovereignty should not be all about technological self-sufficiency or building every component domestically. It should also be about having the capacity to determine how AI is used within a country’s own legal, economic and social context; to understand its potential benefits and harms; and to make informed decisions about the risks it is prepared to accept.

That requires expertise. A government cannot meaningfully determine how AI should be used if it has to rely entirely on the companies developing it, or on assessments produced somewhere else. The answer is therefore not to centralize expertise but to distribute it and make it interoperable. An evaluation conducted in London should be comparable with one conducted in Nairobi. A benchmark developed in Singapore should be reproducible elsewhere. A vulnerability discovered in one country should not remain there. Methods, evidence, incident reports and lessons should move across borders.

This requires common standards for evaluation, security, data handling and reporting; trusted mechanisms for sharing sensitive information; accreditation so that institutions can demonstrate the technical and security capacity to handle frontier systems; and pathways to controlled model access. This is where a multistakeholder approach can add value to AI governance, by connecting the different capabilities required to test, understand and govern these systems.

Governments can set rules and accountability requirements; companies can provide access and technical information; researchers and independent institutes can test and challenge systems; and civil society can bring perspectives on rights, harms and real-world impacts. The objective is not to give every actor an equal seat at the table, but to ensure that no single actor controls the knowledge needed to govern AI.

The emerging network of AI safety and evaluation institutes is therefore an important part of this architecture. It provides something that another global authority cannot provide on its own: independent technical capacity on the ground. Governments still have a central role in establishing obligations for testing, evaluation, verification, reporting and early warning, as well as setting requirements for access, security and accountability. They should also invest in national and regional expertise. But they do not need to own all of that expertise. International institutions can establish common expectations and facilitate political coordination, while independent institutes provide the technical capacity to determine whether those expectations are being met. The goal should be a system in which expertise is distributed, connected and capable of challenging both governments and companies when necessary.

The priority should be to strengthen the network that can make those rules work: institutes that can independently scrutinize AI, wherever they are needed, and mechanisms that allow what they learn to be shared elsewhere.

The Internet did not become governable because someone eventually found the right institution to put in charge of it. It became governable because technical responsibility was distributed and the people exercising it learned how to coordinate. AI governance should learn the same lesson.

Digital Personal Data Protection Act of 2023

 is scheduled to take full effect on May 13, 2027, affecting a population of 1.4 billion. The law is often described as the country's answer to Europe's General Data Protection Regulation (GDPR).

The laws have the same cast of characters: data "fiduciaries" who collect personal information, data "principals" whose information it is, notice and consent requirements, a right to erasure, and a regulator empowered to impose fines. 

But the similarities end where the state’s powers begin. The GDPR permits restrictions on privacy rights only under specific legal conditions, including necessity and proportionality, and subjects law enforcement data processing to a separate legal framework with its own safeguards. India's law does the opposite. 

It exempts certain law enforcement processing from core data protection obligations without requiring case-by-case authorization, allows the government to exempt entire agencies or classes of data fiduciaries by notification, and permits exemptions for statistical and research purposes subject to conditions. It also gives the government a five-year power to disapply any provision it chooses. 

Supreme Court of India is considering a constitutional challenge

 to these provisions of the law before its core obligations take effect.

The law recognizes two lawful grounds for processing personal data: consent, or one of a closed list of "legitimate uses." That list already includes processing by the state to deliver subsidies, benefits and services, and to perform any function under any law. None of that requires consent.

Section 17 then goes further. Under section 17(1)(c), the law's chapter on the duties of data collectors (apart from a basic duty of compliance and a duty to keep data secure), its chapter on individuals' rights, and its limits on sending data abroad do not apply to any processing "in the interest of prevention, detection, investigation or prosecution of any offense." No notification is needed. No official has to show the processing is necessary. Anything that can be described as serving criminal justice is outside the law by its own terms.

Under section 17(2)(a), the central government may exempt any state agency from the entire law by notification, citing sovereignty, security, public order or the prevention of incitement to offenses. The law sets no standard for the notification and no procedure for challenging it.

Under section 17(2)(b), processing for research, archiving or statistical purposes is exempt as long as the data is not used to take a decision about a specific individual and the processor follows six general standards listed in the rules. No authority checks compliance.

Two more provisions complete the picture. Section 17(4) relieves the state of the duty to erase data once its purpose is served, and of an individual's right to demand erasure. And section 17(5) allows the government, for five years after the law takes effect, to declare that any provision does not apply to any data collector or class of collectors, for as long as it specifies. A law with that clause is a law that can be switched off.

The law also reaches into transparency. Section 44(3) amends India's Right to Information Act so that any information that "relates to personal information" is exempt from disclosure, removing the public-interest test that previously applied. The route by which a citizen could have discovered what the state holds about them has been closed.

These are not abstract concerns. In February 2026, the transparency activist 

 in the Supreme Court challenging sections 17(1)(c), 17(2), 33(1), 36 and 44(3) of the law and two of its rules. The case asks the court to decide whether exemptions of this breadth can stand alongside its own 2017 ruling in 

, in which nine judges held that privacy is a fundamental right and that any intrusion must rest on law, pursue a legitimate aim and be proportionate.

A second case shows what is at stake in practice. In August 2026, 

the court agreed to hear a petition by a member of Parliament

, A.A. Rahim, challenging the Delhi police's use of live facial recognition, smart glasses and fingerprint collection against protesters at Jantar Mantar, the capital's main protest site, with the data allegedly stored by two private companies. When the new law takes effect, processing of exactly that kind will fall within section 17(1)(c). India's only comprehensive privacy statute will have nothing to say about it.

The point of comparing India with Europe is not that India should copy Brussels. It is that the European rules show what the Indian text leaves out.

 lets governments restrict privacy rights for security and law enforcement, but only through "a legislative measure" that respects the essence of fundamental rights and is "necessary and proportionate," and that measure must spell out its purposes, the categories of data, the scope of the restriction, safeguards against abuse and storage periods where applicable. India's section 17(1)(c) does not itself impose comparable requirements for a tailored legislative measure, specified safeguards and a necessity-and-proportionality assessment. It operates more like a broad statutory exemption than a restriction tailored to an individual circumstance.

Europe also did not exempt the police from data protection. It gave them 

, with purpose limits, retention limits, logging, impact assessments and oversight by an independent authority. India's Data Protection Board, by contrast, is appointed through a process in which the central government and cannot be relied on to enforce the Act's ordinary obligations where processing is exempt from the Act.

And where the GDPR treats data revealing race, ethnicity or religion as a special category with extra protection, India's law has no such category. 

 had listed caste, tribe and religious or political belief as sensitive data; the 2023 law dropped the category. That matters in a country whose 

 for every resident for the first time since 1931, alongside Aadhaar, voter and passport numbers where available.

The first is the countries being encouraged to adopt India's model. India promotes its "digital public infrastructure," a stack of identity, payments and data-sharing systems, as a template for the Global South, and the 2023 law is presented as the privacy layer that makes it safe. What the law actually shows is that the form of European data protection travels more easily than its safeguards. Consent, notice and fiduciary duties have been transplanted into a statute that mainly governs how citizens deal with companies; the machinery that constrains the state has stayed behind.

The second audience is in Brussels. The EU and India 

concluded negotiations on a free trade agreement

 in January 2026, and data flows are the natural next conversation. India has no adequacy decision under the GDPR. After the European Court of Justice's 

 ruling in 2020, adequacy depends not only on the rules a country applies to companies but on the limits it places on access by public authorities and on whether individuals have redress. Those are precisely the areas India's law exempts in certain circumstances. Anyone expecting the 2023 law to settle that question is reading its first half and skipping its last.

The fix is not radical, and there is still time. Every exemption should require a specific law that states its purpose, scope, safeguards and retention period. Police processing should be governed by rules of its own rather than exempted from rules altogether. Statistical and research processing should carry enforceable safeguards and an independent check. Caste and religion should be protected as the sensitive categories they plainly are. And the Act’s time-limited exemption power under section 17(5) should go.

The Supreme Court could invalidate or narrow some of these exemptions if it finds them unconstitutional. Parliament could enact all of it. Either way, the country that has done more than any other to export digital infrastructure to the developing world is about to show whether its privacy law binds the state, or only everyone else.

Paul Ash is chief executive of the Christchurch Call Foundation.

In moments of uncertainty, multistakeholder approaches to tackling difficult problems can seem quite demanding. They are certainly not easy.

Governments, tech companies, civil society organizations, researchers, and affected communities bring together people with different incentives, worldviews, and priorities. Conversations can be uncomfortable, and agreement can be elusive.

And yet, at a time of profound technological change and rising geopolitical tension, it is precisely these kinds of spaces that we need most.

Over the past few years, I have watched with growing concern as many of the institutions and forums that helped shape the internet's trust and safety architecture have become increasingly strained. Some have struggled to sustain participation or navigate polarized political environments. And at the same time, focus and resources have shifted toward emerging priorities, particularly around artificial intelligence.

In some respects, that is understandable. AI is capturing a significant share of the world's attention, and new forums are emerging to address the opportunities and risks it presents. Yet the result is that there are fewer spaces today where governments, companies, researchers, and civil society can come together for the kind of sustained, deep engagement needed to tackle difficult issues over time. That should concern all of us.

As we build new forums to address the challenges posed by emerging technologies, we should be careful not to neglect the collaborative infrastructure that already exists.

Not all the challenges we associate with AI are new. Safety, accountability, transparency, governance, resilience, and public trust have long been a part of trust and safety work. What has changed is the speed, scale, and complexity of the environment in which those conversations are taking place.

One thing I've learned from this work is that progress tends to happen when different perspectives are brought together. Our challenges are simply too complex for any one group to tackle alone. These conversations involve competing priorities, legitimate disagreements, and complex trade-offs between safety, innovation, rights, and security. Multistakeholder processes create space for people with different perspectives to work through disagreement constructively, and to co-develop innovative solutions.

We need places where those conversations can happen consistently and in good faith. We need spaces where assumptions can be challenged respectfully and where diverse perspectives and expertise can contribute to better outcomes. Online harms don't stop at the edge of an organization's remit or a country's borders. Addressing them requires the willingness to work across those lines.

That is one of the enduring lessons of the Christchurch Call.

Since its inception, the Call has brought together governments, tech companies, and civil society organizations around a shared objective: preventing terrorists and violent extremists from exploiting online platforms. Participants have not always agreed. However, sustained engagement has helped us build relationships and advance practical initiatives.

One of the clearest examples of this multistakeholder approach in action is the 

 (CRP), developed jointly by members of the Call Community. The CRP enables a rapid and coordinated response to real-world terrorist attacks with an online component. By tackling the spread of terrorist and violent extremist content online when incidents occur, this protocol is intended to deny terrorists and violent extremists the ability to use the internet to expand their harmful impact.

The commitment to practical action also shapes our emerging work on AI. For example, it is reflected in the development of our AI safety benchmark, which assesses how AI systems respond to potentially harmful interactions in multi-turn conversations, using OSINT-grounded scenarios and evaluation criteria designed by experts. We’re looking forward to sharing the benchmark publicly in a few weeks’ time.

This need for collective action feels particularly important today. AI gives us yet another compelling reason to invest in the institutions and relationships that make effective governance possible. New technologies may require new thinking, but in many cases, we should draw on the expertise in existing groups to build on the collaboration that has underpinned progress in trust and safety for years.

 remains committed to that work and values working with organizations and individuals who share the Call’s principles, objectives and commitment to collective action. The strength of the Call comes from the diversity of voices around the table.

The challenges facing the digital environment are unlikely to become simpler in the years ahead. Our experience over the past seven years has shown what can be achieved when governments, industry, and civil society stay engaged, even when consensus is difficult, and as technologies evolve. At a time when technological change is accelerating and geopolitical tensions are reshaping the global landscape, opportunities for deep engagement matter more than ever. Our future will depend not only on the technologies we build, but on our ability to build understanding, trust, and practical solutions together.

March 10, 2026: US Customs and Border Protection officer walks through a busy airport terminal concourse with travelers in Miami, Florida. Shutterstock

March 10, 2026: US Customs and Border Protection officer walks through a busy airport terminal concourse with travelers in Miami, Florida. 

Circuit Court Ruling on Border Searches Deals Serious Blow to Privacy Rights

Tech Policy Press - Technology and Democracy

Tech Policy Press is tracking laws and regulations, along with government investigations and litigation, that will shape the rules and accountability for tech companies.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe