A Boring Blueprint for AI Governance
A plan to develop a resilient response to the challenges of AI through pragmatic, incremental, bottom-up governance rather than catastrophic thinking and extreme controls.
Other Information
Context ~ In his Substack post "On Effective Altruism" (October 2026), written in response to The Economist's cover story calling effective altruism "this century's biggest idea," Adam Thierer argues that much effective-altruist thinking about AI treats morality as an optimization problem and AI safety as a matter for top-down control by enlightened elites. Drawing on Hayek's "pretence of knowledge," Thomas Sowell's "vision of the anointed," and Aaron Wildavsky's Searching for Safety, he contends that safety emerges from decentralized experimentation, feedback, and learning from failure rather than from anticipatory controls, and that speculative extinction probabilities ("p(doom)") have no validated method behind them. He proposes instead what he calls a "boring blueprint" of pragmatic, incremental measures, most of which are already in place and being continually refined.
Acknowledged Risks ~ Thierer does not dismiss AI risks. He concedes that effective altruists are right that some AI-enabled capabilities pose enormous risks, some already materializing, and that certain applications will require more safeguards, testing, liability rules, security practices, and targeted policies.
Stakeholder Authority ~ A question the blueprint raises is who imposes its safeguards, and by what authority, if not a central regulator. One answer is the stakeholders of AI services: both those who use them and those who may be affected by them. Users can impose conditions through purchasing, contracting, insurance, and investment decisions. Affected non-users, who have no purchasing power to withhold, rely mainly on liability for actual harms and on enforcement of existing consumer-protection and product-safety laws, which the blueprint explicitly endorses. Published commitments and performance reports strengthen both forms of leverage by supplying the evidence needed to show whether duties have been met.
Limitation ~ Stakeholder leverage binds most tightly where stakeholders are concentrated, such as large purchasers, insurers, and investors, and least where they are diffuse. The developers of the most consequential systems may be the least dependent on any single stakeholder's goodwill. How decentralized arrangements can enforce cooperation, as distinct from coordinating those already willing to cooperate, remains an open question.
Symmetry ~ The evidentiary discipline Thierer calls for applies in both directions. If no validated method supports high estimates of catastrophic risk, none supports confidence that such risk is negligible. Likewise, the commitments of developers who treat safety as an engineering problem, such as Nvidia CEO Jensen Huang's statement that a product should not be released unless its maker is confident in its safety, can and should be made verifiable in the same way as the commitments of those who emphasize catastrophic risk.
Verifiable Virtue ~ This plan is complementary to Verifiable Virtue (https://stratml.us/docs/VV4AI.xml), which seeks accountability for AI developers that does not depend on trusting anyone's stated good intentions. That plan's goals for independent verification, epistemic diversity, and public performance reporting would put into practice several elements of this blueprint, including independent testing and certification, incident reporting, and continuous refinement through trial and error, while subjecting risk estimates to stated assumptions, adversarial review, and tracking over time.
This plan has been inferred and rendered in StratML format by Claude.ai in dialog with Owen Ambur focusing on Adam Thierer's Substack post: https://adamthierer.substack.com/p/on-effective-altruism
It can be edited in the form at https://stratml.us/forms/Claude/Part1.html
🏢Adam Thierer AT Senior fellow, Technology and Innovation team, R Street Institute
Stakeholders:
👥 👥 👥 👥 👥 👥 👥 👥 👥 👥 👥 👥 | Source & SubmitterSource:https://adamthierer.substack.com/p/on-effective-altruism Period: to Published: |
Vision
A society that manages the risks of AI through experience, resilience, and continuous learning rather than fear
Mission
To address the challenges of AI through sensible iteration, adaptation, and pragmatic policies that target actual harms while preserving the freedom to innovate
Values
Goal 1: Resilience 🔗
Gradually develop a more resilient response to the challenges posed by AI.
Stakeholders:
👥AI Developers
👥Security Experts
👥Insurers
Other Information
Overview ~ Thierer's summary of the blueprint lists measures most of which are already in place and constantly being refined, especially in response to security incidents at major AI firms. New vulnerabilities will emerge, as they have in every context, but through sensible iteration, adaptation, and pragmatic policies, society can muddle through.
Objective 1.1: Cybersecurity 🔗
Bolster cybersecurity coordination.
Objective 1.2: Infrastructure 🔗
Harden digital infrastructure.
Objective 1.3: Patching 🔗
Patch software constantly.
Objective 1.4: Detection 🔗
Expand defensive capacity and detection.
Objective 1.5: Liability and Insurance 🔗
Use system liability and insurance to price and allocate risk.
Other Information
Insurance ~ A commenter on Thierer's post suggested requiring frontier model developers to obtain meaningful insurance before deployment, letting sophisticated capital price the risk. If insurers will not underwrite a developer's safety case, that is a signal the model may not be ready for deployment. Prices convey information, and liability places responsibility on the humans who deploy AI systems. Stakeholder Authority ~ Insurance requirements are one means by which users and investors, rather than regulators, can impose safeguards. Liability is the principal means available to affected non-users.
Goal 2: Communication 🔗
Maintain continuous communication and crisis coordination regarding emerging AI risks.
Stakeholders:
👥Governments
👥AI Developers
👥Professional Associations
👥Security Experts
Other Information
Model ~ Regular channels for discussing emerging risks would be comparable in spirit to Cold War crisis-communication mechanisms. The immediate objective is trust, de-escalation, and the gradual formation of shared norms, not a legally binding global AI constitution.
Objective 2.1: Channels 🔗
Maintain regular channels among governments, developers, professional associations, and security experts for discussing emerging risks.
Objective 2.2: Vulnerability Disclosure 🔗
Communicate continuously about vulnerabilities.
Objective 2.3: Norms 🔗
Build trust, de-escalate tensions, and gradually form shared norms.
Goal 3: Polycentric Governance 🔗
Pursue many ongoing, overlapping governance efforts rather than relying on a single international authority.
Stakeholders:
👥Governments
👥AI Developers
👥Technical Organizations
👥Universities
👥Civil Society Groups
Other Information
Model ~ Internet governance was built on the tradition of "rough consensus and running code": experimentation, iterative improvement, and operational agreement where possible, rather than waiting for universal political consensus. Polycentric arrangements, with technology including AI used to reduce their complexity and accelerate coordination, may be the most hopeful course for oversight and governance. See Tooling for Better Coordination in Less Time: https://stratml.us/docs/TBCLT.xml Submitter's Notes: The U.S. Strategy Data Fellowship initiative of the General Services Administration (https://stratml.us/docs/USSDF.xml) seeks to make public-sector strategic plans AI-ready and interoperable, emphasizing voluntary collaboration rather than centralized control. If governments, firms, standards bodies, and civil-society groups engaged in AI governance published their objectives in a common machine-readable format, overlaps, gaps, conflicts, and opportunities for collaboration among their efforts could be identified without a central coordinator, reducing the coordination costs that otherwise limit polycentric arrangements. The Model Plan for Virtual Organizations (https://stratml.us/docs/MP4VO.xml) describes how such efforts can be formed, operated, adapted, and concluded with the minimum organizational and technological capabilities necessary, with governance proportionate to risk, structures added only as experience demonstrates their value, and learning through experimentation. Its objective for agent governance, with controls proportionate to the authority delegated to AI-enabled agents, is itself an example of bottom-up AI governance.
Objective 3.1: Multistakeholder Efforts 🔗
Engage governments, firms, technical organizations, universities, and civil-society groups in overlapping governance efforts.
Objective 3.2: Rough Consensus 🔗
Seek operational agreement through experimentation and iterative improvement rather than universal political consensus.
Goal 4: Standards 🔗
Develop soft law, technical standards, and best practices that can be revised as the technology changes.
Stakeholders:
👥Standards Development Organizations
👥AI Developers
Other Information
Bodies ~ Organizations such as IEEE, ISO, ACM, and OECD, as well as NIST and its Center for AI Standards and Innovation (CAISI) in the U.S. government, develop such standards. They can influence behavior without giving an international body coercive power over models, computing infrastructure, or research. Machine-Readability ~ Standards, commitments, and incident reports published in open, machine-readable formats, such as StratML (ISO 17469-1), can be more readily compared, aggregated, and verified.
Objective 4.1: Safety Frameworks 🔗
Develop safety frameworks and risk assessments.
Objective 4.2: Auditing Practices 🔗
Develop auditing practices.
Objective 4.3: Incident Reporting 🔗
Establish incident-reporting systems.
Other Information
Trial and Error ~ Learning from failure, which Wildavsky identified as the source of safety, depends on failures being reported, analyzed, and shared.
Objective 4.4: Professional Norms 🔗
Develop professional norms for AI developers and security researchers.
Objective 4.5: Revision 🔗
Revise standards as the technology changes.
Goal 5: Certification 🔗
Rely on voluntary certification and coordinated oversight instead of formal top-down licensing and controls.
Stakeholders:
👥Certification Bodies
👥AI Developers
👥Security Researchers
Other Information
Rationale ~ AI developers and security researchers are often best positioned to identify new vulnerabilities. Independent model testing and certification bodies are expected to become more prevalent. Verifiable Virtue ~ Independent verification by evaluators free of disqualifying ties to those they evaluate, with methods published along with results, is a goal of https://stratml.us/docs/VV4AI.xml
Objective 5.1: Coordination 🔗
Coordinate existing initiatives and convene experts through governance-coordinating bodies and quasi-autonomous nongovernmental organizations.
Objective 5.2: Audits 🔗
Administer voluntary audits and certifications.
Other Information
Stakeholder Authority ~ Certification is voluntary for developers, but purchasers, insurers, and investors may make it a condition of doing business with them.
Objective 5.3: Security Culture 🔗
Cultivate a culture of security, professional responsibility, information-sharing, and cooperation.
Goal 6: Minilateral Cooperation 🔗
Cooperate among smaller collections of capable, like-minded states rather than through grand multilateral schemes.
Stakeholders:
👥Governments
Other Information
Rationale ~ Grand multilateral schemes do not work on complex issues like AI alignment. Global "pacing" plans and "pauses" wrongly assume that China and other nations will indefinitely honor restraints that American policymakers impose on domestic innovators. Submitter's Note ~ Coalitions of like-minded states could operate as virtual organizations, forming around explicitly published shared objectives and adapting or concluding as circumstances change. See https://stratml.us/docs/MP4VO.xml
Objective 6.1: Coalitions 🔗
Form focused coalitions of capable, like-minded states that can act more quickly.
Objective 6.2: Independence 🔗
Avoid giving authoritarian governments veto power over democratic nations' technology policies.
Goal 7: Harm Enforcement 🔗
Target actual harms and hostile actors rather than general-purpose AI or computation.
Stakeholders:
👥Affected Parties
👥Governments
Other Information
Rationale ~ Enforcement directed at harmful outcomes, supplemented by narrowly tailored interventions where genuine gaps emerge, avoids blanket restrictions that would forgo the benefits of innovation. Stakeholder Authority ~ For those who may be affected by AI services without using them, liability for actual harms is the principal means of holding developers and deployers accountable. Published commitments and performance reports help supply the evidence needed to show whether duties have been met.
Objective 7.1: Existing Law 🔗
Enforce existing consumer-protection, product-safety, liability, and criminal laws against harmful outcomes.
Objective 7.2: Gap Interventions 🔗
Supplement existing law with narrowly tailored interventions where genuine gaps emerge.
Objective 7.3: Hostile Actors 🔗
Take targeted action internationally against malicious military uses and clearly hostile states.
Objective 7.4: Export Controls 🔗
Apply carefully limited export controls where justified.