{"id":52,"date":"2026-01-31T15:41:00","date_gmt":"2026-01-31T15:41:00","guid":{"rendered":"https:\/\/veritasjps.com\/blog\/?p=52"},"modified":"2026-03-18T15:47:11","modified_gmt":"2026-03-18T15:47:11","slug":"non-binding-guidance-enforcement-gaps","status":"publish","type":"post","link":"https:\/\/veritasjps.com\/blog\/non-binding-guidance-enforcement-gaps\/","title":{"rendered":"The Enforcement Void: How Non-Binding Regulatory Guidance Produces Structural Accountability Gaps"},"content":{"rendered":"\n

Executive Summary<\/strong><\/h2>\n\n\n\n

Regulatory bodies increasingly rely on non-binding regulatory guidance rather than binding rules to govern high-risk domains \u2014 including artificial intelligence in financial services. The assumption is that flexibility encourages innovation while maintaining oversight. The evidence contradicts this.<\/p>\n\n\n\n

Compliance science consistently identifies enforcement credibility, not instrument design, as the variable that determines whether regulated entities change behaviour or produce documentation. The EU AI Act’s phased enforcement (2025\u20132027) offers a live test: 18 of 27 member states missed the August 2025 deadline to designate national competent authorities. The UK’s Financial Conduct Authority has explicitly declined to introduce AI-specific rules. No binding federal AI framework exists in the United States.<\/p>\n\n\n\n

This analysis examines the structural failure pattern that emerges when non-binding guidance proliferates without enforcement teeth \u2014 and what institutional accountability looks like when every jurisdiction’s enforcement architecture is incomplete.<\/p>\n\n\n\n

The Compliance Science Problem: Why Non-Binding Guidance Underperforms<\/strong><\/h2>\n\n\n\n

The question is not whether non-binding regulatory guidance is theoretically sound. The question is whether it produces behavioural change in regulated entities \u2014 and the empirical record is uncomfortable.<\/p>\n\n\n\n

Wu, Tse and Zhang (2022)<\/a> examined how FDA non-binding guidance documents influenced clinical trial endpoint selection. Their finding was blunt: non-binding guidance “imperfectly influences trialist behaviour.” A quantifiable subset of investigators chose alternative endpoints that guidance did not recommend, not because they disagreed with the science, but because the instrument carried no enforcement consequence. The mechanism matters more than the context. When compliance is optional, a predictable percentage of regulated actors treat the option as permission to diverge.<\/p>\n\n\n\n

The pattern is structural, not anecdotal. Van Rooij et al. (2024)<\/a> synthesised 35 empirical studies on regulatory compliance across the EU, US, and Australia, applying the [EXT-LINK: COM-B (Capability-Opportunity-Motivation-Behaviour) framework \u2192 Michie et al. 2011 original framework paper]. Their conclusion cuts directly against the principles-only model: cooperative regulatory approaches without an inspection backstop produced mixed effectiveness. Face-to-face enforcement with consequences \u2014 inspections \u2014 was the intervention most consistently associated with compliance. Psychological capability, social opportunity, and reflective motivation outperformed physical compliance mechanisms, but only when the enforcement backstop was credible.<\/p>\n\n\n\n

Sah et al. (2024)<\/a> developed a “compliance continuum” model integrating behavioural economics and neuroscience that isolates the mechanism. Compliance is not binary. Firms comply where enforcement credibility is high and do not comply \u2014 or comply incompletely \u2014 where it is low. Non-binding regulatory guidance creates what they call a “low-obligation framing” that systematically depresses compliance motivation in firms with weaker ethical commitments. The implication is structural: guidance without enforcement self-selects for non-compliance among exactly the actors regulators most need to reach.<\/p>\n\n\n\n

\"Timeline<\/figure>\n\n\n\n

Principles-Based Regulation: The Historical Lesson<\/strong><\/h2>\n\n\n\n

The binding-versus-principles debate is not new. Julia Black’s landmark analysis (2010)<\/a> of the UK Financial Services Authority’s principles-based regime from 2001 to 2009 identified four rationales for PBR adoption: effectiveness, durability, efficiency, and ethical outcomes. Each rationale held \u2014 but only contingently. When the FSA exercised enforcement discretion credibly, [LINK: principles-based regulation \u2192 \/principles-based-regulation or equivalent cornerstone] delivered lower compliance costs and comparable outcome quality. When it did not, the regime drifted.<\/p>\n\n\n\n

Then 2008 happened. The failure was not in the principles themselves. It was in the enforcement architecture that surrounded them. Black’s analysis distinguishes between instrument design and institutional will \u2014 a distinction the current AI governance debate consistently fails to make. A principles-based framework backed by credible enforcement can outperform a prescriptive regime. A principles-based framework without it produces regulatory drift. That drift is predictable, not accidental.<\/p>\n\n\n\n

Proponents of principles-based AI governance frequently cite the theoretical advantages of non-binding regulatory guidance without accounting for the enforcement precondition. The FSA’s experience demonstrates that the precondition is not optional.<\/p>\n\n\n\n

The Counterargument: When Binding Rules Fail<\/strong><\/h2>\n\n\n\n

The structural critique cuts both directions. The ESRB Advisory Scientific Committee (2019)<\/a> examined EU financial regulation post-2008 \u2014 the regime that replaced principles-based approaches with detailed prescriptive rules. Their finding directly challenges the assumption that binding rules automatically produce better outcomes: prescriptive regulation “undermined rather than enhanced ethical standards, by substituting compliance for values.”<\/p>\n\n\n\n

The evidence is specific. MiFID II, EMIR, and Solvency II generated documented gaming behaviour, regulatory arbitrage, and box-ticking at prevalence levels comparable to \u2014 or exceeding \u2014 those observed under the prior principles-only regime. The mechanism was regulatory complexity, not regulatory laxity. When rules multiply beyond institutional absorption capacity, organisations optimise for procedural compliance rather than substantive behavioural change.<\/p>\n\n\n\n

This is the regulatory design paradox at the centre of the AI governance challenge. Non-binding regulatory guidance produces compliance gaps because [LINK: enforcement credibility \u2192 \/enforcement-credibility or equivalent analysis] is absent. Binding prescriptive rules can produce compliance gaps because rule volume exceeds institutional capacity. The failure mode differs. The outcome \u2014 accountability without substance \u2014 is the same.<\/p>\n\n\n\n

The resolution lies not in choosing between instruments but in designing enforcement architectures that maintain credibility without generating complexity-driven gaming. Neither the EU, UK, nor US approach to AI governance currently achieves this.<\/p>\n\n\n\n

The 2026 Live Case: AI Governance Enforcement Across Three Jurisdictions<\/strong><\/h2>\n\n\n\n

The EU: Binding Rules, Dormant Enforcement<\/h3>\n\n\n\n

The EU AI Act (Regulation (EU) 2024\/1689) is the most substantial binding AI governance framework globally. It establishes multi-level enforcement: the EU AI Office at the supranational level and national competent authorities at the member state level. The design is structurally sound on paper.<\/p>\n\n\n\n

Operational reality diverges. As of early 2026, only 9 of 27 member states<\/a> have officially designated national competent authorities. The August 2, 2025 deadline has passed with [EXT-LINK: 18 states in various stages of non-compliance \u2192 EU official implementation tracker]. Tracking by Technology’s Legal Edge (November 2025)<\/a> confirms a further 10 states in pending designation, leaving at least 8 with no public progress.<\/p>\n\n\n\n

The structural gap is specific and measurable. The AI Act mandates enforcement obligations for high-risk AI systems but contains no explicit accountability mechanism for member state enforcement dormancy during the transitional period. Designation is a necessary precondition for enforcement. Without designated authorities, the binding framework produces the same outcome as a non-binding one: no enforcement activity. The instrument changed. The enforcement void persists.<\/p>\n\n\n\n

No public data exists on whether even the 9 designated states have commenced enforcement activity. Designation and operational enforcement capacity are analytically distinct. The record is silent.<\/p>\n\n\n\n

The UK: Principles Without Enforcement Infrastructure<\/strong><\/h3>\n\n\n\n

The UK has taken the opposite path. In September 2025, the FCA reconfirmed its position<\/a> as a “technology-agnostic, principles-based and outcomes-focused regulator” and explicitly confirmed it will not introduce AI-specific regulations. Governance relies exclusively on existing frameworks: the Consumer Duty and the Senior Managers and Certification Regime (SMCR).<\/p>\n\n\n\n

The theoretical argument is that these existing powers are sufficient \u2014 AI is a technology, not a separate regulatory domain, and existing conduct rules already capture the relevant harms. The practical test is whether these powers have been exercised: no AI-specific enforcement action, investigation, or supervisory finding has been recorded under either framework. The FCA’s AI Lab<\/a>, launched in October 2024, is a testing and collaboration platform \u2014 not an enforcement mechanism.<\/p>\n\n\n\n

The UK’s own 2025 Anti-Corruption Strategy inadvertently documents the failure pattern. The strategy<\/a> introduces no new offences, no new regulators, and no new legislative duties. Its framing is explicitly about “better enforcement, stronger supervision and more coordinated oversight” using existing powers. That is a government acknowledgment \u2014 in an adjacent policy domain \u2014 that enforcement dormancy is the structural problem, not legislative gaps. Analysts at VinciWorks<\/a> noted the strategy lacks concrete deadlines, while ICAEW<\/a> flagged the absence of specific new rules and gaps in enforcement integration.<\/p>\n\n\n\n

The test writes itself. If the UK government recognises that existing powers without enforcement activation constitute a governance failure in anti-corruption, the same structural logic applies to AI governance \u2014 where enforcement activation is even less advanced.<\/p>\n\n\n\n

\"Illustration<\/figure>\n\n\n\n

The United States: Voluntary Standards Displacing State Rules<\/strong><\/h3>\n\n\n\n

The US presents a third variant. No binding federal AI governance framework exists. Federal governance relies on the NIST AI Risk Management Framework<\/a> \u2014 which is voluntary \u2014 and OMB guidance for federal agencies. FTI Consulting (January 2026)<\/a> describes the result as a “widening regulatory vacuum” being filled by state-level legislation.<\/p>\n\n\n\n

The December 2025 Executive Order on eliminating state AI regulation created an additional structural distortion. Voluntary federal standards now preempt potentially more stringent state binding rules. The mechanism is worth isolating: a non-binding federal framework displaces binding state frameworks, producing a net reduction in enforceable obligations. The enforcement void is not a gap \u2014 it is an architectural choice.<\/p>\n\n\n\n

The FSB’s October 2025 report<\/a> on AI monitoring in financial services confirms the global picture. Financial authorities’ AI monitoring remains at “an early stage.” Data gaps and a lack of standardised taxonomies prevent effective monitoring. No binding monitoring framework exists at the G20 level. Regulators acknowledge they lack the infrastructure to assess whether any AI governance guidance \u2014 binding or voluntary \u2014 is producing [LINK: behavioural compliance \u2192 \/behavioural-compliance or equivalent analysis] change.<\/p>\n\n\n\n

The Guidance Dilution Hypothesis<\/strong><\/h2>\n\n\n\n

The evidence reviewed above establishes that non-binding regulatory guidance produces weaker compliance outcomes than binding instruments backed by credible enforcement. A further hypothesis warrants examination: that the proliferation of guidance documents itself reduces compliance salience \u2014 that each new guidance instrument diminishes the perceived urgency of all prior instruments in the same domain.<\/p>\n\n\n\n

No peer-reviewed study directly tests this in AI governance. The mechanism draws indirect support from the regulatory fatigue literature. [EXT-LINK: Thomson Reuters’ Cost of Compliance surveys (2014\u20132015) \u2192 Thomson Reuters Cost of Compliance Report] documented that the accumulation of regulatory instruments \u2014 binding and non-binding \u2014 generates compliance fatigue, fragmented attention, and reduced salience of individual requirements across financial services.<\/p>\n\n\n\n

The ESRB’s 2019 findings reinforce the mechanism from the binding-rules side: prescriptive rule proliferation produces the same attention-dilution effect. Guidance dilution is not unique to non-binding regulatory guidance \u2014 it is a feature of instrument proliferation itself. What distinguishes non-binding instruments is their vulnerability: they lack the enforcement signal that maintains salience when attention fragments.<\/p>\n\n\n\n

This remains a hypothesis, not a confirmed finding. No study has isolated guidance frequency or volume as an independent variable predicting compliance rate decline in a specific regulatory domain. That gap matters. It is precisely the mechanism that would explain why the accumulation of AI governance guidance across regulators, international bodies, and industry groups has not produced proportional behavioural change.<\/p>\n\n\n\n

Institutional Implications for Regulatory Enforcement<\/strong><\/h2>\n\n\n\n

The evidence supports three structural conclusions.<\/p>\n\n\n\n

First, enforcement credibility is the decisive variable<\/strong> \u2014 not whether the instrument is binding or principles-based. Black (2010) and Van Rooij et al. (2024) converge on this from different methodological traditions. Sah et al. (2024) provide the behavioural mechanism. A principles-based framework with credible enforcement outperforms a prescriptive framework without it. The instrument type matters less than the enforcement architecture surrounding it.<\/p>\n\n\n\n

Second, the EU AI Act’s transitional period (August 2024 \u2013 August 2026) represents a known failure window.<\/strong> The regulation establishes binding obligations. It does not establish accountability for the period during which member states fail to designate enforcement authorities. During the transition, a binding framework and a non-binding one produce identical enforcement outcomes: none. Institutional designers should treat this gap as a systemic risk, not an administrative delay.<\/p>\n\n\n\n

Third, the US approach \u2014 voluntary federal standards preempting binding state rules \u2014 produces a net reduction in enforceable obligations.<\/strong> This is not a principles-versus-rules trade-off. It is a structural choice to reduce enforcement capacity. Institutional oversight bodies should assess whether this architecture creates accountability gaps that no existing enforcement mechanism can close.<\/p>\n\n\n\n

The evidence does not support a simple prescription that binding rules are superior. The ESRB’s findings caution against that conclusion. What the evidence does support is that regulatory architectures without credible enforcement \u2014 whether they rely on non-binding regulatory guidance or prescriptive rules \u2014 produce predictable compliance failures.<\/p>\n\n\n\n

Those failures concentrate among the regulated entities that pose the highest institutional risk.<\/p>\n\n\n\n

\n\n\n\n

About VeritasJPS<\/strong><\/h4>\n\n\n\n

VeritasJPS provides evidence-based research and advisory at the intersection of regulatory governance, institutional design, and [LINK: behavioural compliance science \u2192 \/behavioural-compliance-science or equivalent cornerstone]. Our work supports institutional decision-makers \u2014 judges, policymakers, and compliance leaders \u2014 with rigorous analysis grounded in empirical evidence and legal scholarship.<\/p>\n\n\n\n

Learn more:<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Compliance science shows enforcement credibility \u2014 not instrument design \u2014 determines whether non-binding regulatory guidance changes behaviour. Analysis of the EU AI Act, UK FCA, and US federal frameworks reveals structural accountability gaps across every major jurisdiction.<\/p>\n","protected":false},"author":1,"featured_media":54,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[48,49,47,29],"class_list":["post-52","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-policy-brief","tag-ai-governance","tag-enforcement-credibility","tag-regulatory-governance-2","tag-structural-failure-2"],"_links":{"self":[{"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":2,"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"predecessor-version":[{"id":57,"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/posts\/52\/revisions\/57"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/media\/54"}],"wp:attachment":[{"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/veritasjps.com\/blog\/wp-json\/wp\/v2\/tags?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}