Informal Standard-Setting

AI Governance Rules Are Forming Outside Transparent Processes, IAPP Warns

The International Association of Privacy Professionals (IAPP) published an op-ed on April 28, 2026, identifying three recent non-legislative events that are materially shaping global AI governance without transparent deliberation or meaningful input from affected governments and populations. The piece argues that geopolitical pressures and procurement decisions are driving de facto AI rules in ways that bypass formal regulatory channels, creating accountability gaps that compliance teams may not be tracking. The IAPP urges privacy and governance professionals to engage civil society organizations, secure sustainable funding for oversight initiatives, and build direct partnerships with regulators to fill these gaps. For enterprise compliance teams, the analysis flags a systemic risk: material AI governance obligations may emerge from informal or opaque processes rather than published legislation or regulation, making standard regulatory monitoring insufficient. Organizations operating across multiple jurisdictions should audit their governance tracking practices to account for non-legislative standard-setting activity. The finding is particularly relevant for teams assessing AI deployment risk in markets where procurement frameworks or bilateral agreements may function as de facto regulatory instruments.