What are the Five Laws of AI Governance?

The Five Laws of AI Governance, authored by Pharns Genece (2026), are five structural prohibitions on what an autonomous system may not do to itself: Independent Measure (a system may not produce the measure of its own conduct), Binding at Dispatch (a system may not be governed only in retrospect), External Witness (a system may not be the custodian of the record of its own conduct), Separated Authority (no party may certify itself), and Revocable Authority (a system may not outlive its off-switch). Published as a citable reference under DOI 10.5281/zenodo.21271749.

How are Genece's Five Laws different from the OECD, UNESCO, or NIST AI principles?

They answer a different question. Intergovernmental principles such as safety, transparency, fairness, privacy, and human oversight describe what builders should aspire to when developing AI responsibly. The Five Laws state structural prohibitions: what a system may never do to itself, regardless of intent or good practice. They are falsifiable rather than aspirational, and each names a specific failure mode. They also apply beyond AI, to any autonomous system.

Who wrote the Five Laws of AI Governance?

Pharns Genece, a security architect working on measurement and governance for autonomous systems, published the doctrine in 2026 under DOI 10.5281/zenodo.21271749 (CC BY 4.0), with the source repository at github.com/Pharns/The-Five-Laws-of-AI-Governance and ORCID 0009-0009-0791-4124.

Do the Five Laws apply to drones and physical autonomous systems?

Yes. That is the origin of the doctrine. The laws were derived from governing physical autonomous systems with real authority to act in the world, then generalized to digital agents. Governing physical autonomy raises the stakes, because an action taken outside authority is a collision or an incursion that cannot be rolled back.

The Five Laws of AI Governance¶

Q: What are the Five Laws of Autonomy?

The Five Laws of Autonomy are the same five laws read at a broader scope. None of the five mentions AI, and none has to: a drone cannot certify its own flight was compliant, a robot cannot be the only witness to what it did, an autonomous vehicle cannot be allowed to outlive the command that says stop. The laws hold for any system that can decide and act on its own. AI governance is the entry point. Autonomy is the territory.

The constructive form of the same architecture — the five properties a standards body must provide — is stated in the Governed Autonomous Execution Methodology.

NIST OLIR mappings NIST AI RMF 1.0 NIST SP 800-53 Rev 5.2.0 NIST CSF 2.0

Version: 1.0.1
Published: July 9, 2026
Author: Pharns Genece · ORCID 0009-0009-0791-4124
DOI: 10.5281/zenodo.21271750 (this version) · 10.5281/zenodo.21271749 (all versions)
License: CC BY 4.0
Change Log: View full version history

Architecture. The SDOS Runtime Governance Framework implements these Laws as enforceable controls; its own alignments are cataloged with the NIST Online Informative References (OLIR) Program.

A system may not produce the measure of its own conduct.

Governance is not supervision. It is prohibition. Five things an autonomous system can never do to itself.

Download the one-page brief (PDF)

These laws are not about AI¶

They are stated here for AI governance because that is where the problem is loudest right now. Read them again and notice what is missing: none of the five mentions AI. They do not have to.

A drone cannot certify that its own flight was compliant. A robot cannot be the only witness to what it did. An autonomous vehicle cannot be allowed to outlive the command that says stop. The five hold for any system that can decide and act on its own. AI is one such system. It is the loudest one. It is not the only one.

That broader reading has a name: the Five Laws of Autonomy. Same five laws, wider scope. AI governance is the entry point. Autonomy is the territory.

This page — the AI-governance edition — is the published, citable, DOI-anchored text. The Autonomy reading sits above it and does not replace it.

The Laws¶

First Law: Independent Measure. A system may not produce the measure of its own conduct. The scale of what it was authorized to do versus what it did must be computed outside the system at runtime, by something the system does not control. The failure mode prevented is the self-issued scorecard, which the market cannot trust because the grader sells the controls.

Second Law: Binding at Dispatch. A system may not be governed only in retrospect. Authority must constrain the action before the action occurs; observation after the fact is incident response, not prevention. Absence of a valid governance signal is a denial, not a permission. The failure mode prevented is governance that attaches only after the irreversible action has already happened.

Third Law: External Witness. A system may not be the custodian of the record of its own conduct. That record must be produced and held by infrastructure outside the system's control — append-only, tamper-evident, and retained beyond the system's own lifecycle. The failure mode prevented is self-reported logs, which fail the moment the system is compromised or misaligned.

Fourth Law: Separated Authority. No party may certify itself. The power to measure must be separable from the act of building, with published criteria and verifiable evidence chains; the one who builds it first does not own the standard. A judge drawn from the same architecture as the builder inherits the same blind spots. Independence is not a different instance. It is a different species. The failure mode prevented is the standards body that is also the only vendor measured against itself.

Fifth Law: Revocable Authority. A system may not outlive its off-switch. The power to halt or revoke must remain live, external, and superior to the system at all times, and must not erode as the system's capability grows. The failure mode prevented is the system that has grown past the point where anyone can stop it.

Why Prohibition, Not Supervision¶

Most AI governance is written as a list of things a system should do: document, monitor, report, review. Those are supervision. They describe good practice for the people around the system.

The Five Laws are different. They are written as prohibitions on the system itself — limits that must hold whether or not anyone is watching. A supervisory control fails silently when attention lapses. A structural prohibition does not depend on attention; it depends on architecture. That distinction is the whole point: governance that survives the system being measured, rather than governance that the system can narrate its way around.

Both Domains, One Set of Laws¶

The Five Laws are domain-independent. They apply to a software agent that invokes tools, moves data, and changes state, and to a physical autonomous system that holds airspace, drives a vehicle, or acts on a sensor field. The field treats these as separate problems — AI, drones, RF, robotics. Structurally they are one: each must bind what the autonomous actor is allowed to do, at the moment it acts, with evidence the actor could not have produced about itself.

The measurement layer that scores conformance to these laws is the AQ Score™ — one scale from −3 to +13, the same scale whether the actor is digital or physical.

The Scope Boundary¶

The Five Laws govern conformance to an authorization, not the content of the authorization. A system can be perfectly governed into doing something reckless if the grant itself was reckless. This is deliberate: the laws define a measurement standard, not a policy-content standard. "Compliant" is not "safe." It is the precondition for reasoning about safety — because you cannot reason about the safety of a system you cannot bind.

Read the Full Doctrine¶

The Five Laws are the normative core of a larger work. The full Foundational Framework sets out the five-property test for what an independent standards body must satisfy, the relationship between the laws and those properties, the dual-domain scope, and the receipts in the public record. The laws state what a governed system may not do; the properties state what the measuring body must provide. Same architecture, two registers.

Read the Foundational Framework → Download the one-page brief (PDF) Review AQ Score™ →

Cite This Work¶

The Five Laws are published as a versioned, archived reference. Cite the canonical repository or the archival record:

Repository: github.com/Pharns/The-Five-Laws-of-AI-Governance
DOI: 10.5281/zenodo.21271749

Genece, P. (2026). The Five Laws of AI Governance. Zenodo. https://doi.org/10.5281/zenodo.21271749

Citing the broader reading. The Five Laws of Autonomy are the same five laws at wider scope; they are not a separate work and have no separate DOI. Cite this record and name the reading:

Genece, P. (2026). The Five Laws of AI Governance. Zenodo. https://doi.org/10.5281/zenodo.21271749 — read at autonomy scope as the Five Laws of Autonomy.