Turning AI Policy Into Executable Code Is a Radical Idea — And It Might Be the Most Honest One

NewsOnScale Staff

August 17, 2026

For years, AI governance has operated on the honor system. A company publishes a responsible AI framework, posts it to a webpage with tasteful typography, and regulators — lacking technical staff, subpoena power, or clear standards — largely take them at their word. The resulting accountability gap is not a bug in the current system. For many incumbents, it is the feature.

That may be why a project attempting to encode AI policy directly into auditable, executable code is worth watching closely. Backed by Red Hat, NVIDIA, and IBM, the initiative represents a concrete attempt to drag governance out of the PDF era and into something that can actually be tested.

## What 'Policy as Code' Actually Means

The core idea is straightforward, even if the technical implementation is not. Rather than describing an AI governance requirement in natural language — say, 'models must not exhibit demographic bias in hiring decisions' — you write that requirement as a formal specification that a machine can evaluate against a real system. Pass or fail. Logged. Repeatable.

This is not a new concept in software engineering. Infrastructure-as-code and compliance-as-code have existed in cybersecurity and cloud governance for over a decade. The extension to AI policy is the novel part, and it is considerably harder. AI systems are probabilistic, context-sensitive, and often opaque in ways that a firewall rule is not. Turning a nuanced regulatory principle into a test suite without losing the principle's meaning is genuinely difficult work.

But 'difficult' is not the same as 'impossible,' and the alternative — governance that exists only on paper — has a documented track record of failure.

## Who Controls the Standard Controls the Outcome

The involvement of NVIDIA, IBM, and Red Hat is both the project's greatest asset and the thing that deserves the most scrutiny. These are not neutral parties. NVIDIA sells the compute infrastructure that AI models run on. IBM sells enterprise AI services. Red Hat sells the operating environments many of those services live inside. All three have significant commercial interests in how AI compliance is defined and measured.

That does not make their participation illegitimate. Industry consortia have produced genuinely useful open standards before. But it does raise the question of governance capture: if the companies building AI infrastructure are also writing the compliance tests that their own products must pass, the independence of those tests is structurally compromised — regardless of anyone's intentions.

The open-source nature of the project provides some protection. Public repositories can be audited by outside researchers, civil society organizations, and regulators with technical staff. Contributions can be tracked. Decisions can be challenged. Open-source is not a guarantee of neutrality, but it is a precondition for the kind of external accountability that proprietary compliance frameworks cannot offer.

## The Regulatory Arbitrage Problem

This project lands at a moment when AI governance is fragmented across jurisdictions in ways that create significant compliance uncertainty — and significant opportunity for arbitrage. The Bloomberg regulatory brief, the UNESCO roadmap for Georgia, and the ongoing fights over sandbox provisions in U.S. legislation all point to the same underlying problem: regulators are writing rules faster than they can write the measurement tools to enforce them.

Executable policy specifications could help close that gap. A regulator that lacks the staff to audit a large language model deployment could, in principle, require that deployment to pass a published test suite. The test suite becomes the regulation in practice.

That is a powerful shift — and a dangerous one if those test suites are written primarily by the industry being regulated.

## The Question Worth Asking

The project's ambition deserves credit. Accountability mechanisms that are verifiable, public, and technically rigorous are exactly what AI governance currently lacks. But the legitimacy of any compliance standard ultimately rests on who wrote it, who can challenge it, and who enforces consequences when it is violated.

Right now, the answers to those questions are: three major technology vendors, unclear, and nobody in particular. That is the problem the project should be evaluated against — not the elegance of the code.