International AI Governance

Learning Objectives

After completing this lecture, you will be able to:

• Understand the key concepts of international ai governance in a government context
• Connect international ai governance to your agency's AI initiatives
• Identify next steps for applying these concepts in your role

Key Topics Covered

-
Bilateral agreements

-
Standards harmonization

-
Trade implications

-
Five Eyes, NATO, OECD coordination

Why This Matters for Government

Government agencies face unique challenges when it comes to AI adoption. This lecture addresses these challenges head-on by providing cios, chief ai officers, agency technology leaders with the knowledge and frameworks needed to navigate AI in the public sector responsibly and effectively.

As part of the L4 (AI Architect) curriculum, this lecture builds on the foundational principle that every AI system in government ultimately serves citizens. Whether you are working with AI tools daily or setting strategy for your agency, understanding international ai governance is essential for responsible, effective government AI adoption.

Lecture URL: https://skill.re/learn/govt/international-ai-governance.php

======================================================================

TRANSCRIPT: International AI Governance

======================================================================

You will understand the emerging international AI governance landscape, including bilateral agreements,

multilateral frameworks, and standards harmonization efforts. You will learn how international policies

affect U.S. government AI operations, how to navigate conflicting international requirements, and how to

participate in standards development that shapes the global AI ecosystem. By the end, you'll be able to

assess international compliance obligations for your agency's systems, particularly those affecting

international partners, and design governance structures that align with both U.S. and international requirements.

If you're building AI systems that operate across borders or partner with international governments,

your compliance landscape is no longer just federal--it's global. The U.S. is not developing AI governance

in isolation. Simultaneously, the European Union is implementing its AI Act. China is establishing its own

regulatory framework. NATO is developing AI governance standards. The United Nations is working on AI

governance principles. Standards organizations like ISO are developing international AI standards.

This creates a complex compliance challenge: How do you build systems that satisfy U.S. requirements AND

meet international requirements that sometimes conflict?

This session walks you through the international AI governance landscape. We'll examine the major

instruments--bilateral agreements, multilateral frameworks, and technical standards. We'll show you how to

assess which international requirements apply to your systems. We'll explore strategies for managing

conflicting requirements. And we'll examine how international governance is likely to evolve over the

next 5-10 years.

The core insight: International AI governance is no longer a foreign policy concern. It's an operational

requirement for agencies building systems that cross borders or depend on international partnerships.

UNDERSTANDING INTERNATIONAL AI GOVERNANCE

The international AI governance landscape is fragmented. There's no single global AI governance framework.

Instead, there are overlapping bilaterals, multilaterals, and technical standards, each issued by different

authorities, each with different compliance implications. Your job is to understand this landscape and

navigate it strategically.

WHY THIS MATTERS FOR GOVERNMENT

The stakes are significant. International compliance affects: (1) whether your systems can operate in certain

markets, (2) whether your agency can partner with international governments or multilateral institutions,

(3) whether your technology can be imported/exported, (4) whether your data sharing agreements are legally

valid, (5) whether your supply chain is secure. Getting this wrong can result in loss of partnerships,

restricted market access, reputational damage, and security vulnerabilities.

BILATERAL AGREEMENTS AND FRAMEWORKS

Most international AI governance currently happens bilaterally--between the U.S. and specific countries or

regions.

U.S.-EU FRAMEWORK AGREEMENTS

The U.S. and European Union are negotiating comprehensive AI governance frameworks. Current status:

• Agreement on principles and values (democratic governance, rights protection, transparency)
• Ongoing negotiation on technical standards harmonization
• Data sharing agreements that account for GDPR and U.S. requirements
• Joint working groups on AI safety, security, and standards

Implications for your agency:

• If you partner with EU agencies or operate in EU markets, you must comply with both U.S. and EU requirements
• EU AI Act applies to systems sold/deployed in EU, even if developed in U.S.
• Data sharing must satisfy GDPR requirements
• Contracts with EU partners must address regulatory conflicts
• Standards for data protection, transparency, and human oversight are more stringent in EU

U.S.-NATO AI GOVERNANCE

NATO is establishing AI governance standards for member states. Key initiatives:

• NATO AI Strategy: Establishes principles for NATO AI use
• NATO Innovation Fund: Invests in AI startups and capabilities
• AI Ethics Group: Develops standards for responsible AI in defense
• Standards for interoperability across allied systems

Implications for your agency:

• If you're in Defense, State, Homeland Security, or other agencies supporting NATO, you must comply with NATO standards
• AI systems used in joint operations must meet NATO standards
• Supply chains for AI systems used with NATO allies must meet NATO security standards
• Intelligence sharing agreements must account for AI governance differences among allies

U.S.-ALLY BILATERAL AI AGREEMENTS

The U.S. is negotiating bilateral AI governance agreements with key allies: Australia, Canada, Japan,

South Korea, UK, and others. These agreements typically cover:

• Data sharing frameworks
• Standards harmonization
• Joint research and development
• Interoperability protocols
• Supply chain security

Implications for your agency:

• If you collaborate with ally agencies, bilateral agreements govern the terms
• Your systems must be compatible with allied systems
• Data sharing agreements must satisfy both U.S. and ally requirements
• Vendor selection may be constrained by bilateral agreements

U.S.-ADVERSARY FRAMEWORKS

For adversary nations (China, Russia, Iran, North Korea), governance is focused on restriction and

containment rather than harmonization:

• Technology export restrictions
• Restrictions on data sharing and partnerships
• Requirements for supply chain security
• Monitoring requirements for systems that may be used against U.S. interests

Implications for your agency:

• Any systems, data, or partnerships involving adversary nations require explicit approval
• Supply chains must be carefully vetted to ensure no critical components come from restricted sources
• Hiring international staff may be restricted if they work on certain AI systems
• Technology transfer to international partners requires licensing

MULTILATERAL FRAMEWORKS AND STANDARDS

Beyond bilaterals, multiple multilateral initiatives are shaping global AI governance:

UNITED NATIONS AI INITIATIVES

The United Nations is establishing principles for AI governance:

• UN High-Level Panel on Artificial Intelligence: Issued principles for AI that respects human rights
• UNESCO Recommendations on AI Ethics: Establishes principles for responsible AI
• OHCHR (Office of High Commissioner for Human Rights): Issued guidance on AI and human rights

These are not binding, but they're influential. Major governments and companies are aligning their policies

to UNESCO and UN principles.

Implications for your agency:

• UN-principles-aligned AI governance is increasingly expected
• If your agency coordinates with UN agencies, alignment with UN principles is important
• Public disclosure of your AI governance should reference alignment with UN principles
• Staffing and advisory structures should reflect diversity principles emphasized in UN frameworks

OECD AI PRINCIPLES

The Organization for Economic Co-operation and Development (OECD) issued AI Principles that 40+ countries

have endorsed. The principles cover:

• AI benefit realization
• Human-centered values and fairness
• Transparency and explainability
• Robustness, security, and safety
• Accountability

The U.S. has endorsed OECD principles. They're becoming the baseline for international expectations.

Implications for your agency:

• Systems should be designed to satisfy OECD principles
• Public transparency statements should reference alignment with OECD principles
• Risk assessment methodologies should address OECD principles

INTERNATIONAL STANDARDS ORGANIZATION (ISO)

ISO is developing international AI standards:

• ISO 42001: AI Management Systems
• ISO 42101: AI Concepts and Terminology
• ISO 42110: AI Risk Management
• ISO 22989: AI Lifecycle Stages and Data

Unlike UN principles or OECD principles, ISO standards are technical specifications that can be formally

certified. Compliance is verifiable.

Implications for your agency:

• If you work internationally, ISO compliance becomes increasingly important
• Systems designed to ISO standards are more easily integrated with international partners
• ISO certification signals quality and trustworthiness to international stakeholders

THE EU AI ACT AND EXTRATERRITORIAL COMPLIANCE

The European Union's AI Act is the most comprehensive and binding international AI governance framework

currently in effect. It's important to understand because it affects U.S. organizations, not just EU organizations.

THE EU AI ACT STRUCTURE

The EU AI Act categorizes systems by risk level:

• Prohibited: Systems creating unacceptable risks (e.g., social credit systems). These cannot be deployed in EU.
• High-Risk: Systems that could affect fundamental rights or safety. These require impact assessments,

human oversight, transparency, and documentation.

• Limited-Risk: Systems interacting with citizens (e.g., chatbots). These require transparency.
• Minimal-Risk: Systems with minimal risk.

COMPLIANCE IMPLICATIONS FOR U.S. AGENCIES

If your agency's systems are deployed to or accessed by EU citizens, the EU AI Act applies, even if the

system is developed in the U.S. This includes:

• Systems deployed on EU cloud infrastructure
• Systems accessible to EU citizens via the internet
• Systems that process EU citizen data

Specific compliance obligations:

• Prohibited systems: Cannot be deployed. Period.
• High-risk systems: Must conduct impact assessments covering rights and safety, implement human oversight

mechanisms, ensure transparency, maintain documentation

• Limited-risk systems: Must disclose that users are interacting with AI
• Minimal-risk systems: No specific requirements, but best practices are recommended

MANAGING CONFLICTING REQUIREMENTS

U.S. requirements (EO 14110, OMB M-24-10) and EU requirements (EU AI Act) sometimes differ:

• EU requires specific documentation that U.S. doesn't mandate
• U.S. emphasizes security and national security; EU emphasizes rights protection
• EU has stricter data protection requirements
• U.S. emphasizes innovation; EU emphasizes safety guardrails

Strategy for managing conflicts:

• Design systems to satisfy the more stringent requirement
• Document your interpretation and compliance approach
• Engage with regulators in both jurisdictions if conflicts are significant
• Consider separate system configurations for different markets if harmonization isn't possible

STANDARDS HARMONIZATION AND PARTICIPATION

A major focus of international AI governance is standards harmonization--aligning technical standards across

countries so systems can interoperate and comply with multiple jurisdictions simultaneously.

CURRENT HARMONIZATION EFFORTS

ISO, NIST, and emerging government standards are converging on similar approaches to:

• Risk assessment methodologies (increasingly aligning with NIST AI RMF)
• Testing and evaluation protocols (red-teaming, fairness testing, adversarial testing)
• Documentation requirements (system cards, impact assessments, monitoring plans)
• Transparency and disclosure mechanisms

Where standards are converging, compliance becomes simpler. Design your systems to meet converged standards,

and you're more likely to be compliant across multiple jurisdictions.

PARTICIPATING IN STANDARDS DEVELOPMENT

As standards bodies (ISO, NIST, IEEE, IEC) develop AI standards, they solicit input from government

stakeholders. Participation is important because:

• U.S. influence in standards development shapes what becomes global baseline
• Early participation means your agency's requirements are considered
• Participation signals to international partners that your agency is engaged and responsible

If your agency has resources, participate in standards development:

• Nominate experts to standards committees
• Provide feedback on standards drafts
• Host working groups or subcommittees
• Fund research addressing open standards questions

SUPPLY CHAIN AND VENDOR MANAGEMENT ACROSS BORDERS

International AI governance has significant implications for supply chains. Governments worldwide are

increasingly focused on supply chain security.

BILATERAL SUPPLY CHAIN REQUIREMENTS

U.S. allies increasingly require:

• Vendor security vetting (background checks, financial stability, security certifications)
• Data residency commitments (data stays within specific countries)
• Source code access for critical systems
• Regular security audits
• Provenance documentation for all components

For your agency:

• If you're selling AI systems to allied governments, expect these requirements
• If you're procuring AI systems from allied vendors, expect these requirements to be enforced
• Supply chain documentation and traceability are essential

EXPORT CONTROLS

U.S. export control regulations restrict certain AI technologies from being exported to specific countries

(currently focused on China, Russia, Iran, North Korea). Key restrictions:

• Advanced semiconductor chips used in AI
• Certain algorithms and technical documentation
• AI systems with dual-use military implications

For your agency:

• AI systems developed with U.S. federal funding may have export restrictions
• Partnerships with international agencies may be restricted if the partner is in a restricted country
• Hiring international staff may be restricted if they work on certain AI systems
• Technology transfer to international partners requires licensing

EMERGING GOVERNANCE TRAJECTORIES

Overview

International AI governance is evolving rapidly. Several trends are worth watching:

TREND 1

The baseline for international AI governance is rising. EU standards are stricter than U.S. standards.

Expect other regions (Canada, Japan, South Korea, Australia) to follow EU's approach. Over the next

5-10 years, the global baseline will likely drift toward EU-level stringency.

Implication: Design your systems to meet stricter standards now. Don't design to the minimum U.S.

requirement and expect to easily adapt to international requirements later.

TREND 2

The world is not converging on a single AI governance standard. Instead, we're seeing fragmentation into

blocs: Democratic-led standards (U.S., EU, allies) and authoritarian standards (China, Russia). Systems

designed for one bloc may not be compatible with the other.

Implication: For systems that operate globally, plan for potential fragmentation. Build modular systems

that can adapt to regional requirements without complete redesign.

TREND 3

International governance is increasingly focused on frontier AI systems--large language models, advanced

generative AI. These systems raise unique risks and are receiving regulatory attention.

Implication: If your agency builds or deploys frontier AI, expect international scrutiny. Standards for

frontier AI are evolving rapidly.

TREND 4

International supply chain governance is becoming a proxy for geopolitical competition. Ally nations are

working to secure "trusted" supply chains. Adversary nations are restricted.

Implication: Supply chain decisions are increasingly political. Choices about which vendors and cloud

providers to use have geopolitical implications beyond technical performance.

ANTI-PATTERN 1

Description: Assuming that international compliance is only relevant if you're explicitly working

internationally. Many agencies discover international compliance obligations only when a crisis forces it.

Risk: When you finally need to comply, you're in a reactive mode. You may need to redesign systems,

renegotiate contracts, or exit markets. All of this is expensive and disruptive.

What goes wrong: Your agency develops an AI system for domestic use. Later, a federal agency or international

organization wants to use the system. You discover it's not EU AI Act compliant. Now you need to go back and

fix it. Or you discover export control restrictions that prevent technology transfer. Or you find that a

vendor doesn't meet bilateral security requirements.

How to avoid: Assess international relevance of your systems early. Even if systems are currently domestic,

design them to be internationally compliant. Plan ahead. Don't wait until you have a crisis to understand

international compliance requirements.

ANTI-PATTERN 2

Description: Attempting to comply with every international standard, framework, and principle, resulting

in over-engineered systems and governance structures.

Risk: You sacrifice innovation and agility trying to satisfy every possible requirement. You spend resources

on compliance activities that don't materially improve safety or trustworthiness.

What goes wrong: You decide your system must be ISO 42001 certified, NIST AI RMF compliant, OECD-principles

aligned, EU AI Act compliant, and NATO-standards compatible. You hire consultants to manage each standard.

You add process layers to your governance. Your development cycles slow down significantly.

How to avoid: Prioritize standards based on relevance. If you primarily operate domestically, NIST AI RMF

and OMB guidance are primary. EU compliance is secondary. If you work internationally, adjust priorities.

Focus on converged standards where possible. Don't implement every standard equally. Distinguish between

binding requirements, best practices, and aspirational principles.

ANTI-PATTERN 3

Description: Assuming that if you have bilateral agreements with international partners, compliance

conflicts are resolved.

Risk: Bilateral agreements typically establish the framework, but they don't resolve all technical conflicts.

You still need to make design decisions about how systems will work when facing conflicting requirements.

What goes wrong: You have a data sharing agreement with an EU partner. The agreement says you'll comply with

GDPR. But your system needs to log certain data for security purposes, and GDPR restricts what data can be

retained. The agreement doesn't specify how this conflict is resolved. Now you have ambiguous requirements

and a technical problem that agreements don't solve.

How to avoid: Bilateral agreements establish the framework, but you need technical governance to resolve

specific conflicts. Engage technical experts and legal counsel together to determine how conflicting

requirements will be addressed in actual system design. Document these decisions.

ANTI-PATTERN 4

Description: Treating international AI governance as purely technical, without understanding its

geopolitical implications.

Risk: You make supply chain or partnership decisions based purely on technical criteria or cost, without

understanding geopolitical implications. Later, these decisions create problems.

What goes wrong: You select a cloud provider because they have the best technical performance and lowest

cost. Later, you discover the provider has restricted partner access because of export controls. Or you

discover the U.S. government doesn't trust the provider because of national security concerns. Now you need

to migrate systems.

How to avoid: Understand geopolitical context. Consult with your agency's international affairs office

or security office early in vendor selection and partnership decisions. Understand which countries are

considered allies, which are restricted, and what this means for supply chains and partnerships.

PROMPT 1

Your agency has developed an AI system that's currently used domestically. You've received interest from:

• An EU government agency
• A NATO ally (Canada)
• A UN agency
• A government in a non-aligned country (India)

For each potential international user, identify:

a) What international governance frameworks apply?

b) What additional compliance requirements would be needed?

c) Are there conflicts between requirements?

d) Can your current system be deployed, or does it need modification?

e) What's your recommendation?

PROMPT 2

Your agency operates three AI systems:

• A predictive model for equipment maintenance (internal use only)
• A public-facing chatbot that answers citizen questions
• A facial recognition system used by border agents

Each system is deployed on EU cloud infrastructure and accessible to EU citizens. For each system:

a) What's the risk classification under the EU AI Act?

b) What compliance obligations apply?

c) What's your current compliance status?

d) What changes are needed to achieve compliance?

PROMPT 3

You're designing an AI system that must comply with:

• U.S. requirements: Emphasis on security and performance monitoring
• EU requirements: Emphasis on data protection and rights protection
• NATO requirements: Emphasis on interoperability and security certification

These requirements sometimes conflict (e.g., data retention needed for performance monitoring conflicts with

GDPR restrictions). How would you:

a) Identify specific conflicts?

b) Assess the severity of each conflict?

c) Develop design approaches that satisfy all requirements?

d) Document your decisions?

PROMPT 4

Your agency is establishing a research partnership with universities in three countries: Canada (ally),

Singapore (non-aligned), and China (restricted). The partnership involves:

• Joint development of AI models
• Data sharing for training
• Publication of research results

For each partnership:

a) What bilateral or multilateral frameworks apply?

b) What governance agreements are needed?

c) What restrictions apply?

d) How would you structure the partnership to satisfy all requirements?

PROMPT 5

Your agency wants to participate in standards development to influence how international AI standards evolve.

Develop a strategy that includes:

a) Which standards bodies to focus on? (ISO, NIST, IEEE, IEC, others?)

b) Which standards initiatives are most relevant to your agency's work?

c) What expertise and resources would be required?

d) How would you staff standards participation?

e) What's the expected return on investment?

• International AI governance is fragmented across bilateral agreements, multilateral frameworks, and

technical standards. There's no single global standard. You must understand the landscape relevant to

your systems.

• If your systems operate internationally or interact with international partners, international compliance

is not optional. Plan for it from the beginning, not after the fact.

• The EU AI Act is the most comprehensive binding international framework. Expect other regions to follow.

Design your systems to EU standards, and you're more likely to be compliant globally.

• Bilateral agreements with international partners establish frameworks, but they don't resolve all

technical conflicts. You need governance structures to handle conflicts when they arise.

• Standards harmonization is ongoing. Converged standards make compliance simpler. Participate in standards

development where possible to influence global baselines.

• Supply chain and vendor decisions have geopolitical dimensions. Consult with security and international

affairs staff early in vendor selection processes.

• Geopolitical fragmentation is happening. Design systems to be modular enough to adapt to different

regional requirements without complete redesign.

EU AI ACT

European Union regulation that establishes binding requirements for AI systems in the EU, organized by risk

level. Applies to systems deployed in or accessible to EU citizens, regardless of developer location.

BILATERAL AGREEMENT

Formal agreement between the U.S. government and a specific country that governs joint operations, data

sharing, standards alignment, or other cooperative arrangements.

NATO AI STRATEGY

NATO's framework for AI use across member states, establishing principles for responsible AI and standards

for interoperability across allied systems.

STANDARDS HARMONIZATION

Process of aligning technical standards across countries so systems designed to one standard are more likely

to comply with others. ISO, NIST, and government bodies are working to harmonize AI standards.

EXPORT CONTROLS

Restrictions on transferring certain technologies, knowledge, or data outside the U.S., typically for national

security or foreign policy reasons. Apply to certain advanced AI capabilities.

DATA RESIDENCY

Requirement that data stays within a specific geographic location (country, region, EU). Common in

international agreements to address data protection and sovereignty concerns.

OECD AI PRINCIPLES

Agreed principles for AI governance endorsed by 40+ countries, covering AI benefit realization, human-centered

values, transparency, robustness, and accountability.

International AI governance is not a foreign policy concern--it's an operational requirement for agencies

building systems that affect international partnerships, operate across borders, or process international data.

The complexity comes from fragmentation: No single global standard exists. Instead, overlapping bilateral

agreements, multilateral frameworks, and technical standards create a patchwork of requirements. Your job

is to understand this patchwork and navigate it strategically.

This means:

• Assessing international relevance of your systems early
• Understanding which frameworks apply to your specific systems
• Designing systems to satisfy stricter requirements and be adaptable to regional variations
• Engaging with international affairs and security staff in governance decisions
• Participating in standards development where possible
• Planning for geopolitical fragmentation while working toward standards convergence

The agencies that excel at international compliance are the ones that treat it as integral to AI governance,

not as an afterthought.

Take 20 minutes to answer these questions:

• Do any of your agency's AI systems operate internationally or affect international partners?
• What international governance frameworks apply to your systems?
• Where are the biggest international compliance gaps?
• How well does your agency understand the geopolitical dimensions of international AI governance?
• How could your agency participate more effectively in international standards development?

International AI governance is moving toward stricter, more comprehensive requirements. The smart

agencies are the ones that anticipate this trend and design systems to meet higher standards now,

rather than retrofit compliance later. Design globally. Think ahead. Lead, don't follow.

Government AI CLUB Certification Program

Level 4: AI Architect | International AI Governance | Lecture 4.2.2

A GOVT.CLUB initiative.

<- 4.2.3 State and Local Government AI Policy
4.2.5 AI Policy Impact Assessment ->

Start Your CLUB Certification

This lecture is part of L4: AI Architect -- 120 hours of comprehensive government AI training.

Explore CLUB Certification

Related Lectures

L4
4.2.1 -- Drafting Agency AI Policies
180 min - Workshop + Template

L4
4.2.2 -- Navigating the Federal AI Landscape
150 min - Lecture + Tracker

L4
4.2.3 -- State and Local Government AI Policy
150 min - Lecture + Comparison