Who Gets to Control AI? The Governance Crisis Nobody's Solving

The EU just pushed back its AI Act enforcement by 16 months. The US is deregulating. China is governing through infrastructure. And the UK is doing nothing and hoping for the best.

Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Jonathan Care, Head of the AI Practice at KuppingerCole.

We're not in an AI revolution. We're in an AI accountability crisis with the most incredible marketing budget the technology industry has ever seen. That's how Richard Cassidy frames it, and it sets the tone for a conversation that goes well beyond the usual AI hype into the governance, sovereignty and regulation questions that nobody has convincingly answered.

The US, EU, China and the UK have each taken fundamentally different approaches to AI governance and they're diverging, not converging. Meanwhile, the companies building the most powerful models are increasingly the ones defining how they should be used, because governments simply can't keep pace. The conversation also gets into why AI's ability to solve complex mathematical problems is starting to worry the people responsible for the cryptography that underpins modern banking, payments and secure communications.

Three key talking points:

Four governance models, zero compatibilityThe US over-innovates, the EU over-regulates, China governs through infrastructure and the UK has principles without law. None of these models is compatible with the others, and the largest organisations in the world operate at the intersection of all of them.When companies define the rules because governments can'tAnthropic publicly refused to provide certain capabilities over concerns about surveillance and military use. That exposed the governance vacuum that exists when legislation can't keep pace with innovation. The companies building the most powerful models are now the ones deciding how they should be used.Cryptography is on borrowed timeAI is solving mathematical problems that have never been solved before. The cryptography that underpins banking, payments and the digital economy is based on the assumption that certain problems are too hard to solve. If AI and quantum computing change that assumption, those foundations look fragile.

This isn't about what AI can do. It's about who gets to decide what it should do.

On what's really driving the AI narrative:

"We're not in an AI revolution, we're in an AI accountability crisis that appears to have the most incredible marketing budgets we've ever seen in the history of investment in companies."

Richard Cassidy

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

In this episode, we covered the following topics:The EU AI Act and Why It's Already BehindThe deadline got pushed back 16 months. We discuss what that tells us about the gap between regulatory intent and enforcement.US Deregulation and Innovation at SpeedThe US is betting that innovation matters more than regulation. We get into what that means for everyone else.China's Infrastructure-First ApproachChina isn't writing big laws. It's governing through 50-plus technical standards and sector-specific measures. We discuss why that model is fundamentally different.The UK's Principles Without LawFive non-statutory principles, enforcement delegated to existing regulators. We explore why that creates the lowest compliance burden but the highest uncertainty.AI SovereigntyEveryone says they want it. Almost nobody can explain what it means. We get into why the conversation matters.When the Model Builders Make the RulesAnthropic drew a public line on what it would and wouldn't provide. We discuss what happens when companies, not governments, define how AI is used.AI and the Threat to CryptographyAI is solving problems that have never been solved before. Find out why tha