AI Governance: Deployer Sovereignty Favored Over Frontier Provider Control

This paper delves into the critical question of where ultimate authority should lie in the governance of capable AI systems once they are integrated into organizational workflows. It contrasts two primary models: "frontier-provider sovereignty," which grants privileged authority to the developers of the most advanced AI models, and "action-centered deployer sovereignty," which places final authority for high-impact actions with the organization that authorizes, embeds, and bears the consequences of those actions. Through a comparative analysis of various public governance frameworks, including the EU AI Act, NIST AI RMF, Singapore's Model AI Governance Framework, and Japanese and Canadian policies, the paper identifies a stronger trend towards distributed operational accountability rather than unilateral control by frontier providers. The author argues that factors such as rapid enterprise adoption, decreasing transparency from providers, and widening control gaps further underscore the value of a portable governance layer focused on the governed action itself, rather than on provider-specific session objects. The conclusion is nuanced: while strong upstream authority remains justified for gating frontier capabilities, the final authority over concrete enterprise actions is more appropriately located with the deployer, who is ultimately responsible for the legal, operational, and commercial outcomes.