Governments Race to Test AI: What Changes Now
Global regulators move from principles to practice
Governments are shifting from broad pledges on artificial intelligence to hands-on testing of powerful models. In the United States and the United Kingdom, new public institutes are building common evaluations to probe safety claims. The European Union’s landmark AI Act is entering its staged rollout. And the United Nations has set a baseline of human rights expectations. Together, these moves signal a new phase in AI governance: less talk, more measurement.
Experts say the long-running debate over AI risks — from biased outcomes to misinformation and cyber threats — is giving way to structured, repeatable tests designed to verify what systems can and cannot safely do. The push will affect how companies design, release, and maintain AI models. It could also shape how researchers and open-source communities access and study them.
US and UK build a shared safety testing backbone
In 2024, the US National Institute of Standards and Technology (NIST) launched the AI Safety Institute Consortium, bringing hundreds of organizations into a shared effort to develop evaluations for AI safety, security, and trustworthiness. The consortium draws on NIST’s earlier AI Risk Management Framework, which describes a lifecycle approach to identifying, measuring, and mitigating harms.
The UK created its own AI Safety Institute in late 2023 following the Bletchley Park AI Safety Summit, where major developers pledged to provide model access for testing. In May 2024, the US and UK safety institutes signed a memorandum of understanding to coordinate research and align evaluation methods. The goal is to avoid duplicative work and to encourage interoperable tests that can be run across different models and jurisdictions.
US policy momentum dates to the White House’s 2023 Executive Order, which directed agencies to foster “safe, secure, and trustworthy AI.” The UK’s strategy centers on independent assessments of frontier systems and sharing of results with relevant authorities. Both moves reflect a view that pre-release testing and ongoing monitoring should become standard.
Europe’s AI Act sets binding rules, phased in over years
The EU’s AI Act — the first comprehensive AI law by a major regulator — entered into force in 2024. Its application is staggered. Bans on certain uses, such as some forms of biometric categorization, take effect relatively quickly. Requirements for general-purpose AI models and most high-risk systems arrive later, giving companies time to adapt. The Act’s purpose, as set out in Article 1, is to establish “harmonised rules for artificial intelligence” across the bloc.
The law’s risk-based approach places stricter obligations on high-risk applications like medical devices, critical infrastructure, and employment tools. It also creates duties for developers of general-purpose AI (GPAI), including technical documentation and reporting, with tougher obligations for models that pose systemic risks. The European Commission will issue detailed guidance and standards to operationalize the law, supported by national market surveillance authorities.
Human rights baseline from the United Nations
In March 2024, the UN General Assembly adopted a resolution urging countries to ensure AI systems respect fundamental rights. It calls on states and companies to “respect, protect and promote human rights” throughout the AI lifecycle and to support responsible data practices, transparency, and accountability. While nonbinding, the resolution is a signal of global policy expectations and a benchmark against which national rules may be measured.
Why testing is rising to the top
Regulators and researchers argue that better testing addresses several persistent problems:
- Opaque capabilities: Advanced models learn behaviors not always apparent from their design. Structured evaluations can surface dangerous or unexpected outputs.
- Generalization: Models behave differently outside lab conditions. Robust tests help gauge performance under stress and in new contexts.
- Consistency: Comparable tests allow policymakers and buyers to evaluate claims across vendors and versions.
- Monitoring over time: AI systems change with updates and user interactions. Continuous testing can catch regressions and new risks.
Risk categories under discussion include disinformation, privacy leakage, cyber offense, capability elicitation (such as detailed harmful instructions), bias and discrimination, and safety in domain-specific uses like healthcare and finance.
Industry reaction: compliance costs and clarity
Large AI developers have generally welcomed standardized tests that clarify expectations, even as they warn of increased costs. Vendors say harmonized evaluations reduce uncertainty and help product teams prioritize safety features earlier in the development cycle. Enterprise buyers, meanwhile, are asking for more reliable attestations, including evidence of red-teaming, model cards, and post-deployment incident reporting.
Smaller firms and open-source communities worry about burdens that could hinder innovation. They argue that evaluation toolkits should be free, open, and usable without specialized hardware. Policymakers acknowledge the challenge. Both the NIST consortium and the UK institute have emphasized practical guidance and public benchmarks to keep the bar high without shutting out new entrants.
What changes for companies now
Legal and technical teams are preparing for a more formal compliance environment. Analysts point to several near-term steps:
- Map use cases to risk: Classify applications under emerging rules, especially where EU high-risk categories may apply.
- Build evaluation pipelines: Integrate red-teaming, adversarial prompts, and domain tests into CI/CD so models are checked before and after release.
- Document thoroughly: Maintain training data provenance records, model cards, and change logs aligned to regulators’ expectations.
- Prepare for disclosure: Anticipate requests from customers and authorities for test results, sign-off procedures, and incident responses.
- Track standards: Monitor NIST, ISO/IEC, and EU harmonized standards that will define acceptable tests for specific risks.
Open questions regulators still need to answer
Despite progress, key issues remain. First, how to test capability hazards that are hard to measure, such as strategic manipulation or advanced cyber skills. Second, how to ensure independent access for testers while protecting security and intellectual property. Third, how to coordinate across borders so one set of tests satisfies multiple regimes.
There is also debate over transparency. Companies are reluctant to publish full evaluation suites, arguing that attackers could use them to game models. Civil society groups respond that secrecy undermines public oversight. Expect a middle path: private, detailed tests for pre-release checks, and public, reproducible benchmarks for accountability.
The bottom line
AI governance is entering an operational era. The US and UK are standing up shared testing programs. The EU is rolling out binding obligations, with the toughest requirements still ahead. And the UN has framed the human rights baseline. For developers, the message is simple: prove it. Claims about safety and reliability will increasingly need to be backed by standardized evaluations, documented processes, and ongoing monitoring.
The work will be incremental and technical, but the stakes are broad. As one US policy document puts it, the goal is AI that is “safe, secure, and trustworthy.” The next two years will show whether common tests and clearer rules can make that promise real without freezing innovation. For now, the world’s major regulators are betting that better measurement is the surest path to safer machines.
