Comprehensive AI governance requires addressing non-model gains

A research paper argues that current AI governance frameworks focus too narrowly on model-level controls, missing capability gains from inference optimization, post-training systems, and external assets. The authors propose a broader governance taxonomy encompassing system, entity, agent, and cloud-level oversight, alongside societal resilience measures, to address risks that traditional pre-deployment evaluation cannot capture.

The paper identifies a critical gap in frontier AI governance: the assumption that a model's capabilities depend primarily on training compute and data. As AI systems mature, capability improvements increasingly come from sources outside the base model itself. Inference gains from test-time compute scaling, systems gains from post-training scaffolding and retrieval augmentation, and asset gains from connecting models to external tools or databases all expand capabilities beyond what the training-phase model possesses. This matters because governance regimes built around pre-deployment evaluation and mitigation become less effective when the most impactful capability gains occur after deployment.

Historically, AI safety frameworks emphasized controlling the training process and evaluating models before release. However, this approach assumes a closed system where the model's power is fixed at deployment. The paper challenges this assumption by documenting multiple vectors through which deployed systems gain capabilities independently of the base model. Future developments—embodied AI systems, continual learning, and rapid AI diffusion across organizations—will intensify this problem.

For the AI industry and policymakers, this requires rethinking governance architecture. Rather than focusing exclusively on what individual models can do, oversight must extend to how models integrate with infrastructure, data pipelines, and organizational systems. The authors advocate for layered governance spanning systems design, organizational controls, agent behavior monitoring, and cloud infrastructure oversight. Crucially, they emphasize that technical governance alone cannot manage risks from widely deployed AI systems; societal resilience—institutional adaptation, workforce readiness, and regulatory agility—becomes a necessary complement to any governance framework.

• →Current AI governance focuses on model-level controls that miss capability gains from inference scaling, post-training enhancements, and external assets
• →Non-model gains—improvements independent from base model advances—undermine traditional pre-deployment evaluation strategies
• →Governance must extend beyond individual models to address system, entity, agent, and cloud-level architectures
• →Embodied AI, continual learning, and rapid AI diffusion will further complicate model-centric governance approaches
• →Societal resilience and institutional adaptation are essential complements to technical governance frameworks