The Enforcement Void: How Non-Binding Regulatory Guidance Produces Structural Accountability Gaps

Executive Summary

Regulatory bodies increasingly rely on non-binding regulatory guidance rather than binding rules to govern high-risk domains — including artificial intelligence in financial services. The assumption is that flexibility encourages innovation while maintaining oversight. The evidence contradicts this.

Compliance science consistently identifies enforcement credibility, not instrument design, as the variable that determines whether regulated entities change behaviour or produce documentation. The EU AI Act’s phased enforcement (2025–2027) offers a live test: 18 of 27 member states missed the August 2025 deadline to designate national competent authorities. The UK’s Financial Conduct Authority has explicitly declined to introduce AI-specific rules. No binding federal AI framework exists in the United States.

This analysis examines the structural failure pattern that emerges when non-binding guidance proliferates without enforcement teeth — and what institutional accountability looks like when every jurisdiction’s enforcement architecture is incomplete.

The Compliance Science Problem: Why Non-Binding Guidance Underperforms

The question is not whether non-binding regulatory guidance is theoretically sound. The question is whether it produces behavioural change in regulated entities — and the empirical record is uncomfortable.

Wu, Tse and Zhang (2022) examined how FDA non-binding guidance documents influenced clinical trial endpoint selection. Their finding was blunt: non-binding guidance “imperfectly influences trialist behaviour.” A quantifiable subset of investigators chose alternative endpoints that guidance did not recommend, not because they disagreed with the science, but because the instrument carried no enforcement consequence. The mechanism matters more than the context. When compliance is optional, a predictable percentage of regulated actors treat the option as permission to diverge.

The pattern is structural, not anecdotal. Van Rooij et al. (2024) synthesised 35 empirical studies on regulatory compliance across the EU, US, and Australia, applying the [EXT-LINK: COM-B (Capability-Opportunity-Motivation-Behaviour) framework → Michie et al. 2011 original framework paper]. Their conclusion cuts directly against the principles-only model: cooperative regulatory approaches without an inspection backstop produced mixed effectiveness. Face-to-face enforcement with consequences — inspections — was the intervention most consistently associated with compliance. Psychological capability, social opportunity, and reflective motivation outperformed physical compliance mechanisms, but only when the enforcement backstop was credible.

Sah et al. (2024) developed a “compliance continuum” model integrating behavioural economics and neuroscience that isolates the mechanism. Compliance is not binary. Firms comply where enforcement credibility is high and do not comply — or comply incompletely — where it is low. Non-binding regulatory guidance creates what they call a “low-obligation framing” that systematically depresses compliance motivation in firms with weaker ethical commitments. The implication is structural: guidance without enforcement self-selects for non-compliance among exactly the actors regulators most need to reach.

Principles-Based Regulation: The Historical Lesson

The binding-versus-principles debate is not new. Julia Black’s landmark analysis (2010) of the UK Financial Services Authority’s principles-based regime from 2001 to 2009 identified four rationales for PBR adoption: effectiveness, durability, efficiency, and ethical outcomes. Each rationale held — but only contingently. When the FSA exercised enforcement discretion credibly, [LINK: principles-based regulation → /principles-based-regulation or equivalent cornerstone] delivered lower compliance costs and comparable outcome quality. When it did not, the regime drifted.

Then 2008 happened. The failure was not in the principles themselves. It was in the enforcement architecture that surrounded them. Black’s analysis distinguishes between instrument design and institutional will — a distinction the current AI governance debate consistently fails to make. A principles-based framework backed by credible enforcement can outperform a prescriptive regime. A principles-based framework without it produces regulatory drift. That drift is predictable, not accidental.

Proponents of principles-based AI governance frequently cite the theoretical advantages of non-binding regulatory guidance without accounting for the enforcement precondition. The FSA’s experience demonstrates that the precondition is not optional.

The Counterargument: When Binding Rules Fail

The structural critique cuts both directions. The ESRB Advisory Scientific Committee (2019) examined EU financial regulation post-2008 — the regime that replaced principles-based approaches with detailed prescriptive rules. Their finding directly challenges the assumption that binding rules automatically produce better outcomes: prescriptive regulation “undermined rather than enhanced ethical standards, by substituting compliance for values.”

The evidence is specific. MiFID II, EMIR, and Solvency II generated documented gaming behaviour, regulatory arbitrage, and box-ticking at prevalence levels comparable to — or exceeding — those observed under the prior principles-only regime. The mechanism was regulatory complexity, not regulatory laxity. When rules multiply beyond institutional absorption capacity, organisations optimise for procedural compliance rather than substantive behavioural change.

This is the regulatory design paradox at the centre of the AI governance challenge. Non-binding regulatory guidance produces compliance gaps because [LINK: enforcement credibility → /enforcement-credibility or equivalent analysis] is absent. Binding prescriptive rules can produce compliance gaps because rule volume exceeds institutional capacity. The failure mode differs. The outcome — accountability without substance — is the same.

The resolution lies not in choosing between instruments but in designing enforcement architectures that maintain credibility without generating complexity-driven gaming. Neither the EU, UK, nor US approach to AI governance currently achieves this.

The 2026 Live Case: AI Governance Enforcement Across Three Jurisdictions

The EU: Binding Rules, Dormant Enforcement

The EU AI Act (Regulation (EU) 2024/1689) is the most substantial binding AI governance framework globally. It establishes multi-level enforcement: the EU AI Office at the supranational level and national competent authorities at the member state level. The design is structurally sound on paper.

Operational reality diverges. As of early 2026, only 9 of 27 member states have officially designated national competent authorities. The August 2, 2025 deadline has passed with [EXT-LINK: 18 states in various stages of non-compliance → EU official implementation tracker]. Tracking by Technology’s Legal Edge (November 2025) confirms a further 10 states in pending designation, leaving at least 8 with no public progress.

The structural gap is specific and measurable. The AI Act mandates enforcement obligations for high-risk AI systems but contains no explicit accountability mechanism for member state enforcement dormancy during the transitional period. Designation is a necessary precondition for enforcement. Without designated authorities, the binding framework produces the same outcome as a non-binding one: no enforcement activity. The instrument changed. The enforcement void persists.

No public data exists on whether even the 9 designated states have commenced enforcement activity. Designation and operational enforcement capacity are analytically distinct. The record is silent.

The UK: Principles Without Enforcement Infrastructure

The UK has taken the opposite path. In September 2025, the FCA reconfirmed its position as a “technology-agnostic, principles-based and outcomes-focused regulator” and explicitly confirmed it will not introduce AI-specific regulations. Governance relies exclusively on existing frameworks: the Consumer Duty and the Senior Managers and Certification Regime (SMCR).

The theoretical argument is that these existing powers are sufficient — AI is a technology, not a separate regulatory domain, and existing conduct rules already capture the relevant harms. The practical test is whether these powers have been exercised: no AI-specific enforcement action, investigation, or supervisory finding has been recorded under either framework. The FCA’s AI Lab, launched in October 2024, is a testing and collaboration platform — not an enforcement mechanism.

The UK’s own 2025 Anti-Corruption Strategy inadvertently documents the failure pattern. The strategy introduces no new offences, no new regulators, and no new legislative duties. Its framing is explicitly about “better enforcement, stronger supervision and more coordinated oversight” using existing powers. That is a government acknowledgment — in an adjacent policy domain — that enforcement dormancy is the structural problem, not legislative gaps. Analysts at VinciWorks noted the strategy lacks concrete deadlines, while ICAEW flagged the absence of specific new rules and gaps in enforcement integration.

The test writes itself. If the UK government recognises that existing powers without enforcement activation constitute a governance failure in anti-corruption, the same structural logic applies to AI governance — where enforcement activation is even less advanced.

The United States: Voluntary Standards Displacing State Rules

The US presents a third variant. No binding federal AI governance framework exists. Federal governance relies on the NIST AI Risk Management Framework — which is voluntary — and OMB guidance for federal agencies. FTI Consulting (January 2026) describes the result as a “widening regulatory vacuum” being filled by state-level legislation.

The December 2025 Executive Order on eliminating state AI regulation created an additional structural distortion. Voluntary federal standards now preempt potentially more stringent state binding rules. The mechanism is worth isolating: a non-binding federal framework displaces binding state frameworks, producing a net reduction in enforceable obligations. The enforcement void is not a gap — it is an architectural choice.

The FSB’s October 2025 report on AI monitoring in financial services confirms the global picture. Financial authorities’ AI monitoring remains at “an early stage.” Data gaps and a lack of standardised taxonomies prevent effective monitoring. No binding monitoring framework exists at the G20 level. Regulators acknowledge they lack the infrastructure to assess whether any AI governance guidance — binding or voluntary — is producing [LINK: behavioural compliance → /behavioural-compliance or equivalent analysis] change.

The Guidance Dilution Hypothesis

The evidence reviewed above establishes that non-binding regulatory guidance produces weaker compliance outcomes than binding instruments backed by credible enforcement. A further hypothesis warrants examination: that the proliferation of guidance documents itself reduces compliance salience — that each new guidance instrument diminishes the perceived urgency of all prior instruments in the same domain.

No peer-reviewed study directly tests this in AI governance. The mechanism draws indirect support from the regulatory fatigue literature. [EXT-LINK: Thomson Reuters’ Cost of Compliance surveys (2014–2015) → Thomson Reuters Cost of Compliance Report] documented that the accumulation of regulatory instruments — binding and non-binding — generates compliance fatigue, fragmented attention, and reduced salience of individual requirements across financial services.

The ESRB’s 2019 findings reinforce the mechanism from the binding-rules side: prescriptive rule proliferation produces the same attention-dilution effect. Guidance dilution is not unique to non-binding regulatory guidance — it is a feature of instrument proliferation itself. What distinguishes non-binding instruments is their vulnerability: they lack the enforcement signal that maintains salience when attention fragments.

This remains a hypothesis, not a confirmed finding. No study has isolated guidance frequency or volume as an independent variable predicting compliance rate decline in a specific regulatory domain. That gap matters. It is precisely the mechanism that would explain why the accumulation of AI governance guidance across regulators, international bodies, and industry groups has not produced proportional behavioural change.

Institutional Implications for Regulatory Enforcement

The evidence supports three structural conclusions.

First, enforcement credibility is the decisive variable — not whether the instrument is binding or principles-based. Black (2010) and Van Rooij et al. (2024) converge on this from different methodological traditions. Sah et al. (2024) provide the behavioural mechanism. A principles-based framework with credible enforcement outperforms a prescriptive framework without it. The instrument type matters less than the enforcement architecture surrounding it.

Second, the EU AI Act’s transitional period (August 2024 – August 2026) represents a known failure window. The regulation establishes binding obligations. It does not establish accountability for the period during which member states fail to designate enforcement authorities. During the transition, a binding framework and a non-binding one produce identical enforcement outcomes: none. Institutional designers should treat this gap as a systemic risk, not an administrative delay.

Third, the US approach — voluntary federal standards preempting binding state rules — produces a net reduction in enforceable obligations. This is not a principles-versus-rules trade-off. It is a structural choice to reduce enforcement capacity. Institutional oversight bodies should assess whether this architecture creates accountability gaps that no existing enforcement mechanism can close.

The evidence does not support a simple prescription that binding rules are superior. The ESRB’s findings caution against that conclusion. What the evidence does support is that regulatory architectures without credible enforcement — whether they rely on non-binding regulatory guidance or prescriptive rules — produce predictable compliance failures.

Those failures concentrate among the regulated entities that pose the highest institutional risk.

---

About VeritasJPS

VeritasJPS provides evidence-based research and advisory at the intersection of regulatory governance, institutional design, and [LINK: behavioural compliance science → /behavioural-compliance-science or equivalent cornerstone]. Our work supports institutional decision-makers — judges, policymakers, and compliance leaders — with rigorous analysis grounded in empirical evidence and legal scholarship.

Learn more: