By PYMNTS | November 6, 2025

|

The Oxford Martin AI Governance Initiative has released new research that challenges the idea that artificial intelligence requires an entirely new regulatory architecture. Instead, the study argues that global institutions can build on the safety and risk standards that already govern complex industries such as aviation, energy and finance.

The paper examines how the emerging “frontier AI safety frameworks” being developed by major labs align with, and diverge from, established international standards such as ISO 31000 and ISO/IEC 23894. It concludes that the most effective approach is not to replace these standards but to adapt and extend them.

“The question is not whether AI should be regulated,” the authors write. “It is how existing systems can evolve to govern technologies that move faster than any regulation ever has.”

Bridging Two Worlds

The Oxford analysis maps two distinct approaches that have grown in parallel. Frontier AI safety frameworks, or FSFs, are internal policies created by developers such as OpenAI, Anthropic and Google DeepMind to manage risks tied to models. These frameworks include mechanisms for model evaluation, incident reporting and capability thresholds, benchmarks that indicate when a system becomes capable enough to warrant additional scrutiny.

Such frameworks are nimble, but they vary widely in scope and consistency. Most were built for single organizations rather than as cross-industry standards.

International safety standards, by contrast, have decades of history in highly regulated fields. They focus on continuous improvement, role definition, traceability and governance. Their strength lies in structure, but they were not designed for fast-moving, self-learning technologies that can evolve between audit cycles.

Advertisement: Scroll to Continue

The Oxford study suggests that each approach solves for what the other lacks. Frontier frameworks provide speed and practical insight. Established standards bring discipline and comparability. A governance model that combines the two, the researchers argue, would be better equipped to balance innovation with accountability.

Building a Shared Language for Risk

Oxford’s research proposes integrating those thresholds into the structured loops already familiar to compliance teams: identify, analyze, evaluate and treat. When a model crosses a specific threshold, for instance, by showing unexpected reasoning ability or multi-domain behavior that event should automatically trigger a formal review, documentation and mitigation plan.

This procedural rigor, the study argues, would make frontier-AI oversight more transparent to regulators, insurers and other stakeholders. It would also clarify how organizations define risk and determine when intervention is necessary.

The concept aligns with “Safety Cases: A Scalable Approach to Frontier AI Safety,” which describes a safety case as “a structured argument, supported by evidence, that a system is safe enough in a given operational context.” Both analyses emphasize evidence-based assurance and external validation over self-certification.

Creating a “shared language of risk,” Oxford’s researchers write, is central to scaling AI governance. Without that alignment, governments and developers will continue to talk past each other, using different criteria for the same problems.

Putting Into Practice

The study frames this convergence as a practical evolution rather than a philosophical one. The goal is to make artificial intelligence governance operational, measurable and compatible with existing institutions. It argues that safety frameworks should not rely solely on company self-regulation but should be auditable through processes already recognized by international standards bodies.

That perspective represents a shift in tone from the more alarmist narratives that have surrounded frontier models. Instead of focusing on existential risks, Oxford’s researchers point to the tools that already exist to handle high-impact technologies from risk registers to third-party audits and certification programs.

The Oxford study fits into a wider movement toward codifying AI governance through standards rather than ad hoc rules. The EU AI Act will rely on harmonized standards to operationalize compliance for high-risk systems, turning abstract legal requirements into auditable technical practices. In the United States, the NIST AI Risk Management Framework provides a voluntary roadmap that organizations can use to evaluate and reduce risk across the AI lifecycle.

For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.