In 2020, for instance, Robert Williams was illegally arrested after an AI face recognition attempt failed, one of the many examples that shows that AI has far outstripped efforts to control it. Rising set of ethical rules based on AI responsibilities, developed by governments, international organisations and business actors, while generally voluntary and binding, remain largely ignored in the context of situations where AI systems directly affect human rights and security. There's nothing wrong with principles, it's the mechanism to enforce them. There are few actual rules, if any. Promises are made, but then broken. Ethical guidelines are still in the minority in terms of techniques for governance of AI, as Facebook found out in its involvement with the Cambridge Analytica data fiasco, where the enforced teeth of the General Data Protection Regulation were what proved most clattering. This lesson has not been learnt sufficiently. There is no risk-free mandatory compliance. However, the voluntary approach has failed to work out as intended and these risks need to be weighed against the harm that can be caused by AI if it is not governed. In the opinion of this paper, AI governance should not remain aspirational, it must be enforceable by law. It calls for a policy framework based on mandatory due diligence obligations, transparency, independent oversight and effective sanctions that "actually bite". It also argues that coordinated global enforcement models like the EU AI Act, are required.
