Governing Through the Cloud: The Intermediary Role of Compute Providers in AI Regulation
webCredibility Rating
4/5
High(4)High quality. Established institution or organization with editorial oversight and accountability.
Rating inherited from publication venue: Centre for the Governance of AI
This paper argues that compute providers should serve as regulatory intermediaries for AI governance, outlining technical mechanisms for oversight including record-keeping, verification, and enforcement roles relevant to AI safety policy.
Metadata
Importance: 72/100working paperanalysis
Summary
The paper argues that compute providers should bear legal and ethical responsibilities in AI regulation, serving as securers, record keepers, verifiers, and enforcers. It analyzes technical feasibility of deriving governance-relevant properties (workload type and compute consumed) from non-confidential data. Using US Executive Order 14110 as a case study, it outlines how compute oversight schemes could be implemented and internationalized.
Key Points
- •Compute providers can serve four regulatory roles: securers, record keepers, verifiers of customer activities, and enforcers against rule violations.
- •Non-confidential data already accessible to compute providers can reveal key governance properties: workload type (training vs. inference) and compute consumed.
- •US Executive Order 14110 is used as a case study for implementing compute provider record-keeping requirements.
- •Internationalization of compute oversight is identified as critical for effective AI regulation enforcement.
- •Balancing privacy/confidentiality with risk mitigation is a central challenge as compute providers take on expanded regulatory roles.
Cached Content Preview
HTTP 200Fetched Jun 29, 20264 KB
Governing Through the Cloud
The Intermediary Role of Compute Providers in AI Regulation
As jurisdictions around the world take their first steps toward regulating the most powerful AI systems, such as the EU AI Act and the US Executive Order 14110, there is a growing need for effective enforcement mechanisms that can verify compliance and respond to violations. We argue that compute providers should have legal obligations and ethical responsibilities associated with AI development and deployment, both to provide secure infrastructure and to serve as intermediaries for AI regulation. Compute providers can play an essential role in a regulatory ecosystem via four key capacities: as securers , safeguarding AI systems and critical infrastructure; as record keepers , enhancing visibility for policymakers; as verifiers of customer activities, ensuring oversight; and as enforcers , taking actions against rule violations. We analyze the technical feasibility of performing these functions in a targeted and privacy-conscious manner and present a range of technical instruments that can be employed. In particular, we describe how non-confidential information, to which compute providers largely already have access, can be used to derive two key governance-relevant properties of a computational workload: its type —e.g, large-scale training or inference— and the amount of compute it has consumed. Using AI Executive Order 14110 as a case study, we outline how the US is beginning to implement record keeping requirements for compute providers. We also explore how verification and enforcement roles could be added to establish a comprehensive AI compute oversight scheme. We argue that internationalization will be key to effective implementation, and highlight the critical challenge of balancing confidentiality and privacy with risk mitigation as the role of compute providers in AI regulation expands.
Read paper Read paper Theme
AI Regulation Date
March 13, 2024
author
s
Lennart Heim, Tim Fist, Janet Egan, Sihao Huang, Stephen Zekany, Robert Trager, Michael A Osborne, Noa Zilberman
Share
Research Summary
Footnotes
Further reading
Related publications
AI Regulation
Delays to Frontier AI in the EU and UK
June 2026
Technical Report
John Lidiard, Oleksandra Vereschak, Tom Gibbs, and Markus Anderljung
In recent years, frontier AI companies have sometimes delayed the release of new models to the EU and UK – or not released them at all. To what extent has...
AI Regulation
Requirements for Model Specifications in the EU GPAI Code of Practice
March 2026
Policy Brief
Alan Chan
The EU GPAI Code of Practice commits Signatories to providing a description of intended model behavior...
AI Regulation
Labeling of AI Agent Activity in Article 50 of the EU AI Act
November 2025
Policy Brief
Alan Chan
The online activities of AI agents could distort human beliefs and behaviors. For example, humans could mistake...
A
... (truncated, 4 KB total)Resource ID:
23dd4e59ff0ab100 | Stable ID: sid_5Jb4uZOAHg