Compliance Is the Floor, Not the Ceiling

There is a sentence I hear in almost every boardroom conversation about responsible AI: “We comply with all applicable regulations.” It is offered as reassurance. I have learned to hear it as a warning sign, because in AI the gap between what is legal and what is right is wider than in almost any other field I have audited.

Why compliance is the floor

Regulation is, by design, a lagging instrument. The EU AI Act was proposed in April 2021, before generative AI reached the mainstream; its rules for general-purpose AI models had to be added during the negotiations, and it has already been amended once, by the 2026 Digital Omnibus. Most jurisdictions, including most of the MENA region, still govern AI through non-binding principles rather than enforceable law. An organisation that calibrates its ethics to its legal obligations is calibrating to the slowest-moving reference point available, in the fastest-moving technology of our time.

The casework shows the consequence. A widely used US care-management algorithm under-identified Black patients for extra care because it predicted health costs rather than health need. A proprietary sepsis model missed most of the patients who developed sepsis in an independent validation. A state supreme court allowed the COMPAS risk score to be used at sentencing, with warnings attached. None of these produced a finding that a law had been broken. The harm was real; the compliance, as far as anyone established, was intact.

If your governance framework cannot register that kind of event, it is not an ethics framework. It is a legal risk register wearing a lanyard.

What “beyond compliance” means in practice

I am wary of ethics talk that never touches an operational process: principles posters, one-off training, an ethics board that meets quarterly and decides nothing. In my work I have found that ethical governance only becomes real when it is built into the same machinery that runs the rest of the management system. That is the thinking behind the Ethical Governance Integration Model (EGIM). Its core idea is simple to state: ethical commitments must be expressed as operational requirements, with owners, evidence and audit trails, inside the AI lifecycle rather than alongside it.

The model organises that work into five dimensions, each mapped to ISO/IEC 42001 so it runs alongside a management system rather than as a separate programme. Maturity is assessed against fifty criteria. The part that matters most for this argument is the six keystone criteria. Each asks for evidence that governance actually changed something: a leader accepted cost or delay, the ethics board changed a decision, an impact assessment changed a system. Without that evidence an organisation cannot reach the top two maturity levels, however good its documentation.

That is what “beyond compliance” means in operational terms. Not more principles, but evidence that the principles cost something when it mattered.

Where binding law is thin

For organisations in the MENA region, “beyond compliance” carries an extra meaning: in many of our jurisdictions there is, as yet, little binding AI law to comply with. That is not a holiday. It is a transfer of responsibility, from legislators to leadership. When the law does not draw the line, the board does, whether or not it realises it.

The reference points for drawing it are freely available: the OECD AI Principles, the UNESCO Recommendation on the Ethics of Artificial Intelligence, adopted by UNESCO’s 193 member states in 2021, NIST’s AI Risk Management Framework, and the ethics principles published by national bodies such as Saudi Arabia’s SDAIA. What they cannot do is turn themselves into process. That part is the organisation’s job.

Commitment into machinery

The uncomfortable truth about ethics beyond compliance is that it requires the organisation to want something more than a certificate. No auditor can give you that. What we can verify is whether the wanting, where it exists, has been turned into process, evidence and accountability. That transformation, commitment into machinery, is the entire game.

This article is part of the AI Governance in Practice series. Start with the series introduction, or see the cases behind it in When Algorithms Err.