AI Governance Needs Interoperable Protocols, Not Just Laws

As AI systems become increasingly embedded in critical global infrastructure, the need for robust governance frameworks is urgent. However, current approaches, which rely heavily on fragmented, jurisdiction-specific laws like the EU AI Act or the NIST AI Risk Management Framework, are creating a complex and inconsistent regulatory landscape. A new position paper contends that AI governance should move beyond laws alone and embrace ISO-like interoperability protocols. The authors propose developing standardized, machine-readable risk communication mechanisms, similar to "AI nutrition labels." These labels would contain unified metrics for crucial aspects like bias, energy consumption, and data provenance, facilitating easier cross-jurisdictional compliance. Drawing parallels with the GDPR's operationalization through standards like ISO 27001, this approach aims to lower barriers for small and medium enterprises (SMEs), reduce redundant regulatory efforts, and build public trust. The paper addresses concerns that standards might stifle innovation by suggesting modular, versioned protocols designed to evolve with technological advancements. Ultimately, it calls for a shift from siloed legal compliance to a system of interoperable technical conformance, establishing a shared global language for responsible AI deployment.