🤖 AI

Post-Deployment Accountability in AI Governance: A Cross-Regulatory Empirical Analysis of AI Incidents

This study empirically analyzes AI incidents against major regulatory frameworks to reveal significant post-deployment accountability gaps, demonstrating that internal monitoring capacity is critical for compliance and proposing the Proactive AI Governance Compliance Framework (PAGCF) to address these systemic deficiencies.

Original authors: Ummara Mumtaz, Summaya Mumtaz

Published 2026-07-16

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Ummara Mumtaz, Summaya Mumtaz

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of Artificial Intelligence (AI) as a massive, bustling city where robots are hired to do everything from diagnosing diseases to approving loans. For a long time, the big worry was just about how these robots were built—making sure they were smart, fair, and didn't have bad code in their brains. But recently, scientists and lawyers have realized that building a robot is only half the story. The real challenge is what happens after the robot starts working. This field is called "post-deployment governance." Think of it like the difference between building a car and actually driving it on the road. You can build a perfect car in a factory, but if you don't have a mechanic checking the brakes every day, a speedometer that actually works, and a clear plan for what to do if the engine catches fire, the car is a danger to everyone.

This paper dives into that "after the factory" phase. It looks at three big sets of rules that governments and organizations have created to keep AI safe: the EU AI Act (a strict set of laws from Europe), the NIST AI Risk Management Framework (a voluntary guide from the US), and the GDPR (a rulebook for protecting personal data). The big question isn't just "Do these rules exist?" but "Do they actually work when things go wrong?" The authors wanted to see if, when an AI system messes up, the people in charge are actually watching, reporting the problem, and fixing it, or if they are just hoping no one notices.

The Great AI Reality Check

Imagine you are a detective investigating a city where 480 different robots have caused accidents between 2020 and 2026. Some robots gave bad medical advice, some rejected loan applications unfairly, and some caused traffic jams. Your job is to check the police reports and see if the robot owners followed the rulebooks they were supposed to have.

The authors of this paper did exactly that. They looked at 480 real-world AI disasters and checked them against nine specific rules from the three major rulebooks mentioned above. They were looking for "evidence"—like a logbook showing someone was watching the robot, a report filed when the robot broke, or a plan to shut it down.

The Big Surprise: The "Ghost" Rules
The results were a bit scary. It turns out that for most of these accidents, the safety rules were basically ghosts. They existed on paper, but you couldn't find any trace of them in the real world.

The EU AI Act: This rulebook says high-risk robots need a "post-market monitor"—basically a security camera that watches the robot 24/7 after it's launched. The study found that in 77.1% of the accidents, there was absolutely no evidence that anyone was watching. It was like driving a car with no brakes and no one checking the dashboard.
The GDPR (Data Protection): This rule says that if you use personal data in a risky way, you must do a "Data-Protection Impact Assessment" (a safety check before you start). The study found that 99.6% of the incidents had no record of this safety check ever being done.
The NIST Framework: This guide suggests you should have a plan to fix things when they go wrong. While some companies did eventually shut down the broken robots (about 57.5% of the time), they usually only did it after the damage was done and the news was already on TV. They weren't fixing it proactively; they were just cleaning up the mess.

The "Systemic" Glitch
The authors also checked if these failures were just random mistakes or if the whole system was broken. They found that 9.8% of the accidents were failures under two or more rulebooks at the same time. This suggests that the problem isn't just that one rulebook is bad; it's that the whole way we manage AI safety is missing a few key gears. It's like a car that has no brakes, no steering wheel, and no seatbelts all at once.

The Secret Weapon: The "Internal Detective"
Here is the most interesting part of the story. The researchers noticed a huge difference between accidents that were found by the company's own team versus accidents found by the outside world (like journalists, angry users, or researchers).

Internal Detection: When a company found the problem themselves, they were much more likely to have followed the rules. For the EU AI Act, 87.5% of these self-found accidents showed compliance.
External Detection: When the outside world found the problem, the compliance rate dropped to a tiny 5.3%.

This suggests that the companies that actually have a "detective" inside their office, watching the robot every day, are the ones who catch the problems early and follow the rules. The companies that wait for the news to break before they know there's a problem are the ones failing the safety checks. The authors suggest that having an internal monitoring system is a huge clue that a company is doing a good job, though they admit they can't prove it causes the good behavior (maybe good companies just happen to have both).

The Proposed Fix: The PAGCF
Since the current system is mostly reactive (fixing things after they break), the authors propose a new plan called the Proactive AI Governance Compliance Framework (PAGCF). Imagine this as a new training manual for robot drivers. Instead of just reacting to crashes, this plan has four steps:

Pre-Deployment Assessment: Before the robot even starts, check its safety gear and make a plan.
Continuous Monitoring: Keep a live camera on the robot 24/7 to catch problems before they become accidents.
Incident Preparedness: Have a "fire drill" ready. Know exactly who to call and what to say if the robot glitches.
Cross-Framework Verification: Make sure you are following all the rulebooks at once, not just one.

What This Means for Us
The paper concludes that we can't just write more rules and hope they work. The rules are already there, but nobody is using them. The biggest lesson is that we need to stop waiting for the news to tell us an AI is broken. We need to build systems that watch the AI while it's working. The authors suggest that if companies start doing this "internal monitoring" first, they could jump from having almost no safety compliance to having over 85% compliance.

It's not a magic wand, and the authors are careful to say this is based on what they saw in the data, not a guaranteed fix. But the message is clear: if we want AI to be safe, we need to stop being the people who clean up the mess and start being the people who prevent the mess in the first place.

Technical Summary: Post-Deployment Accountability in AI Governance

Problem Statement
While post-deployment accountability has become a central pillar of AI governance, there is a lack of empirical evidence regarding whether monitoring, incident reporting, and impact assessment obligations are actually visible when AI systems fail. Existing scholarship is largely normative, focusing on principles or risk classification, rather than evaluating whether specific regulatory obligations are triggered in real-world failure scenarios. This study addresses the gap in understanding whether the "blueprint" of post-deployment governance—defined by the EU AI Act, the NIST AI Risk Management Framework (RMF), and the GDPR—functions effectively in practice.

Methodology
The authors conducted a cross-regulatory empirical analysis of 480 real-world AI incidents recorded in the AI Incident Database (AIID) between 2020 and 2026. The sample was refined through a three-stage screening process (regex-assisted screening, conceptual screening, and manual review) to exclude malicious misuse, misinformation, and non-relevant cases, focusing on governance failures.

The study operationalized compliance by coding incident narratives against nine specific post-deployment provisions across the three frameworks:

EU AI Act: Article 72 (Post-Market Monitoring) and Article 73 (Serious Incident Reporting).
NIST AI RMF: MANAGE 1–4 (Monitoring, Response, Communication, Decommissioning) and GOVERN 4 (Accountability).
GDPR: Article 22 (Automated Decisions), Articles 33–34 (Breach Notification), and Article 35 (Data-Protection Impact Assessments).

Using automated content analysis and keyword matching, each incident was classified as compliant, partially compliant, non-compliant, or having insufficient evidence. The analysis disaggregated results by framework, provision, sector, risk category, and, crucially, the source of incident detection (internal vs. external).

Key Contributions

Provision-Level Empirical Analysis: The first study to map individual real-world incidents to specific regulatory provisions across multiple governance regimes (EU AI Act, NIST, GDPR).
Evidence of Systemic Failure: Demonstrates that governance gaps are not isolated to single frameworks but are systemic, with incidents frequently escaping multiple regulatory controls simultaneously.
Identification of the "Internal-Monitoring Effect": Quantifies a strong correlation between internal detection mechanisms and compliance outcomes, while explicitly acknowledging selection bias threats.
Proactive AI Governance Compliance Framework (PAGCF): Proposes a four-phase, provision-mapped lifecycle methodology designed to address observed failure patterns.

Results

Widespread Accountability Gaps: The findings reveal substantial deficits in post-deployment governance.
- 77.1% of incidents lack evidence of EU AI Act post-market monitoring (Art. 72).
- 99.6% of applicable incidents lack documented Data-Protection Impact Assessment (DPIA) evidence (GDPR Art. 35).
- 92.2% of GDPR-applicable incidents lack sufficient evidence to determine compliance, indicating a massive "evidentiary deficit."
Systemic Nature of Failures: 9.8% of the analyzed incidents were simultaneously non-compliant under two or more frameworks, suggesting that regulatory plurality does not automatically function as a safety net.
The Internal-Monitoring Effect: A stark disparity exists between internally and externally detected incidents.
- Under the EU AI Act, 87.5% of internally detected incidents showed compliance (vs. 5.3% for externally detected).
- Under NIST, 95.8% of internally detected incidents showed alignment (vs. 58.1% for externally detected).
- Statistical testing (Fisher's exact test) confirmed this difference is highly significant ( $p < 0.001$ ), though the authors caution that this may reflect broader organizational maturity rather than monitoring alone.
Reactive vs. Proactive: Most governance actions (e.g., decommissioning under NIST MANAGE 4) occur only after harm is public and external pressure is applied, rather than through continuous risk management.

Significance and Claims
The paper argues that post-deployment accountability is primarily an implementation problem rather than a lack of formal architecture. The formal frameworks exist, but the organizational routines required to make them visible and enforceable are largely missing.

Governance Theatre: The proliferation of regulatory instruments does not guarantee better outcomes; without specific, auditable operational routines, governance risks becoming "theatre" where policy artifacts multiply without enforcement.
The Shift to Proactive Governance: The authors propose that the highest-leverage intervention is shifting governance effort from post-incident damage control to pre-deployment assessment and continuous monitoring.
PAGCF Proposal: The proposed Proactive AI Governance Compliance Framework (PAGCF) offers a four-phase lifecycle:
1. Pre-Deployment Assessment: Unified compliance checklists and risk classification.
2. Continuous Monitoring: Automated performance monitoring, drift detection, and real-time compliance dashboards.
3. Incident Preparedness: Predefined response plans, communication protocols, and accountability assignments.
4. Cross-Framework Verification: Unified scoring and gap analysis across regimes.

The paper concludes that while selection bias limits causal claims regarding internal monitoring, the data strongly suggests that internal monitoring capacity is a key condition for effective post-deployment governance. The PAGCF is presented not as a validated intervention but as a design implication derived from empirical failure patterns, aiming to transform governance from a reactive reputational exercise into a continuous evidentiary system.

The Great AI Reality Check

Technical Summary: Post-Deployment Accountability in AI Governance

More like this