Local AI Governance: Addressing Model Safety and Policy Challenges Posed by Decentralized AI

Abstract

Policies and technical safeguards for artificial intelligence (AI) governance have implicitly assumed that AI systems will continue to operate via massive power-hungry data centers operated by large companies like Google and OpenAI. However, the present cloud-based AI paradigm is being challenged by rapidly advancing software and hardware technologies. Open-source AI models now run on personal computers and devices, invisible to regulators and stripped of safety constraints. The capabilities of local-scale AI models now lag just months behind those of state-of-the-art proprietary models. Wider adoption of local AI promises significant benefits, such as ensuring privacy and autonomy. However, adopting local AI also threatens to undermine the current approach to AI safety. In this paper, we review how technical safeguards fail when users control the code, and regulatory frameworks cannot address decentralized systems as deployment becomes invisible. We further propose ways to harness local AI’s democratizing potential while managing its risks, aimed at guiding responsible technical development and informing community-led policy: (1) adapting technical safeguards for local AI, including content provenance tracking, configurable safe computing environments, and distributed open-source oversight; and (2) shaping AI policy for a decentralized ecosystem, including polycentric governance mechanisms, integrating community participation, and tailored safe harbors for liability.

1. Introduction

The generative artificial intelligence (AI) revolution began in research labs but became a mass phenomenon in November 2022, when OpenAI released ChatGPT, a powerful large language model (LLM) delivered through an easy-to-use web-based chatbot [1]. This breakthrough represented a major shift from conventional machine learning’s focus on prediction and classification to AI systems designed to create novel content [2,3,4]. The scope of generative AI extends beyond LLMs to encompass multimodal vision–language models (VLMs), audio synthesis systems, and image and video generation tools. The ability to generate and execute code using LLMs opens the door to semi-autonomous or autonomous “agent” systems capable of reasoning and problem-solving [5,6]. Autonomous agents can potentially even teach themselves new capabilities [7,8,9]. Generative AI has become so prevalent that the term “AI” is now synonymous with it in popular usage, even though conventional machine learning models have existed for decades. (In this paper, “generative AI” and “AI” are used interchangeably, consistent with most contemporary literature on LLMs and related models).

Companies like OpenAI, Anthropic, and Google deploy increasingly sophisticated models that are accessed through the web and run on data centers containing massive GPU clusters [10]. Their mode of operation establishes clear points of control: corporate providers can monitor usage, enforce safety guardrails, and implement pricing structures that shape how these technologies are used. However, the landscape is now undergoing another transformation. Powerful open-source models have emerged that can run outside institutional providers’ cloud-based services on local hardware. Figure 1 summarizes how the emergence of consumer-controlled decentralized deployment (“local AI”) as an alternative to a centralized provider-controlled centralized infrastructure (“cloud AI”) represents a fundamental shift in how the public can access and use AI.

The emergence of open-source AI broadens who can access and modify advanced AI capabilities—and, by extension, who can potentially misuse them [11]. The implications for AI governance are profound. Access and use restrictions can no longer be enforced solely through centralized commercial providers like OpenAI or Google. Indeed, locally deployable open-source AI, or “local AI,” presents even further challenges beyond those of open-source systems. When open-source models run on data centers, they generally require significant investment and a physical presence that facilitates oversight. By contrast, local generative AI can run on consumer hardware, including personal computers, laptops, and, as hardware improves, even smartphones—all without a constant Internet connection to cloud services or external servers. Local AI is much harder to regulate as a result.

There is extensive literature on proposals for and critical evaluation of AI policy [12,13,14,15,16,17,18,19,20,21]. However, the previous work has largely not focused on the specific challenges of local AI. Instead, the AI policy scholarship frequently makes the (often unspoken) assumption that the computers that run AI will be housed in data centers and, thus, at least somewhat visible to regulation. As further explained in this review, the assumption of AI system visibility underlies how governments write regulations on AI models, which appear to presume that they will operate on publicly visible hardware. Similarly, model safety measures rely on the implicit assumption that models cannot be fine-tuned to remove internal safeguards and then run outside the scope of regulation.

This paper is a curated literature review, using standard academic practices, based on sources that address AI governance challenges. The review’s scope is focused on literature examining decentralized deployment, open-source models, and the dual nature of local AI’s benefits and risks. The paper is organized as follows: Section 2 provides background on the development of local AI. Section 3 examines why users choose local deployment and describes the benefits of local AI. Section 4 highlights examples of potential high-risk AI applications where the risks may be exacerbated by local AI, including biosecurity, information integrity, and cybersecurity. Section 5 reviews the current technical and policy measures for regulating AI and ensuring AI safety. The analysis in Section 5 is from the perspective of local AI’s challenges to the current paradigm, explaining how local deployment potentially undermines both (1) technical safeguards and (2) regulatory policy (governmental and non-governmental). Section 6 draws from the literature to offer proposals that represent a starting point for rethinking governance in response to the emerging challenges of the local AI ecosystem: (1) novel approaches to technical safeguards, such as content provenance technologies, secure computing environments, and distributed monitoring systems; and (2) innovative policy measures, including polycentric governance frameworks, community-driven participatory models, and legal protections for responsible actors. These proposals are grounded in the urgent need for multilayered AI governance capable of addressing the risks associated with local AI while retaining its benefits of privacy, autonomy, and democratizing technology.

2. The Development of Local Generative AI

The first prominent open-source LLM that began to approach the capabilities of ChatGPT was Meta’s Llama [22], followed soon thereafter by Mistral’s models [23]. While Meta and Mistral provided access to their models through their own API endpoints, such as Mistral LeChat, they also provided open-source versions that could be deployed locally on computers with sufficient resources or self-hosted on user-controlled cloud resources. Additional powerful open-source models have been released, including Google’s Gemma 3 [24], Microsoft’s Phi-3 [25], Alibaba’s Qwen 3 [26], and the United Arab Emirates’ Falcon [27].

While developments in open-source and local AI have been less broadly publicized than the introduction of new versions of ChatGPT, the “open-source” AI paradigm was thrust into the spotlight in early 2025 with the release of DeepSeek-R1, an open-source model developed in China that provided performance comparable to large closed-source cloud-based models [28]. DeepSeek-R1 is a large model that has to run on multiple servers in a data center. However, as an open-source model, it can be hosted anywhere and not just on DeepSeek’s own China-based servers. DeepSeek-R1’s open-sourcing further enables it to be run locally when it has been “quantized.” Quantization is a process in which all or certain internal model weights of the LLM are reduced in precision from, e.g., 32-bit or 16-bit to as low as 3-bit floating-point numbers (i.e., rounded to fewer decimal places) [29,30,31,32]. Although there can be some trade-offs in model performance, quantized LLMs remain adequate for typical use cases. Importantly, their lower precision weights use less RAM and enable faster runtimes. Indeed, quantized versions of DeepSeek-R1 developed by a company called Unsloth have been shown to run on higher-end consumer hardware with performance at least qualitatively comparable to the original [33].

DeepSeek has also released “distillations” of R1—versions of local models like Llama and Qwen fine-tuned on the output of the larger model. To develop these distillations of R1, DeepSeek employs a simple approach that can train on the output of large models to fine-tune local models. This approach allows developers to boost the performance of locally deployable models to levels that prove useful for many applications. Moreover, in some use cases, the local model performance is now comparable to that of state-of-the-art proprietary systems [28]. This represents a critical turning point. Now, the initial training of state-of-the-art frontier LLMs may still require massive data centers. However, the frontier models can then be used to generate synthetic datasets that allow their power to be transferred to create smaller, yet well-performing, models that can run locally.

Another innovation in model architecture that has enabled local LLMs is “Mixture-of-Experts,” (MoE), where only a subset of the model’s parameters (the “experts”) are activated for any given input, with a gating mechanism determining which experts to use [34,35]. The MoE architecture reduces the computational requirements during inference, making larger models feasible on local hardware. When combined with memory management techniques in open-source implementations, MoE thus enables efficiently dividing model inference such that, each time it runs, a fraction of the model needs to be loaded in GPU memory (VRAM, more expensive) and the rest can be loaded to ordinary RAM (much cheaper), enabling much larger and more powerful models to run locally [26,36]. Yet another way to improve local LLM performance, particularly for chatbot and sequential interactions, is “KV cache compression,” which effectively reduces how much past conversation the model needs to store to stay coherent [37].

Figure 2 charts the rapid improvement of open-source models that can potentially be run on local machines, showing how it has paralleled the progression of large proprietary models that are considered the flagships of companies like OpenAI and Google. As a practical matter, the recent progress in local AI models has closed the gap with proprietary models in many common use cases, including document summarization, basic reasoning for agentic applications, routine coding tasks, and local question answering. In these contexts, local models perform well enough to meet user needs for practical purposes, even if they trail behind the frontier in raw scale or emergent abilities like highly complex reasoning, novel code generation, and long-context tasks (i.e., where prompts are unusually long, such as when summarizing multiple documents) [38,39,40].

The ability to run models locally is set to advance even further through the emergence of “AI PCs,” such as the Nvidia DIGITS system, which has a powerful GPU and onboard memory, allowing it to run larger-scale models [41]. Apple offers M4 chips, which can run AI models on battery-powered laptops [42]. AMD has also announced a “workstation-class” GPU aimed at developers and professionals using AI rather than gamers, who have until now dominated the consumer GPU market [43].

Perhaps some skeptics would still question whether local AI will play a significant role in the overall AI ecosystem given that proprietary cloud-provided systems are becoming more capable as well. However, as long as they provide a sufficient level of performance, there are compelling reasons to adopt local AI. Local AI can cost less since running models on a local device means avoiding paying fees to use cloud services through APIs and web applications. Any cost savings, to be sure, may be tempered by the need to buy more powerful computers to run more capable AI models. However, intense competition emerging among chipmakers, e.g., the AI PC developers noted above, is already reducing costs and should continue to reduce them in the future. Local AI also avoids the need for an Internet connection, which can be useful in remote areas or airplanes. More broadly, AI models that are available offline provide increased security, prevent risks due to sending information to the model provider or outside the country, and circumvent firewalls or other restrictions. The fundamental personal and social benefits of moving to a local decentralized delivery of AI include control over user privacy, autonomy from large commercial providers, and greater customizability outside of a centralized platform.

3. Benefits of Local AI

At a fundamental level, local AI disrupts what has been called “algorithmic governance,” a phrase that describes how major technology companies (“Big Tech”) use their market dominance to shape how information is accessed and how people connect in ways that influence the broader social order [44]. Through algorithmic governance, Big Tech companies exert a state actor-like regulatory authority that can extend globally [45]. The concentration of algorithmic power influences policy in ways that go beyond these companies’ actual products and services. Big Tech’s algorithmic power increasingly defines which problems, among all those existing in society, will receive attention and, addressing those select problems, what solutions are considered viable, how political coalitions form, and where policy debates occur [46]. Paradoxically, even critics of algorithmic governance are compelled to use the same Big Tech platforms that they organize against and seek to challenge [47].

Local AI can help to overcome these power asymmetries, which otherwise prevent fair discussion and development of AI ethical principles and policies. Building on its fundamental benefit as a democratizing force, local AI offers tangible benefits of privacy, customizability, and autonomy.

As an initial matter, the privacy-preserving aspect of local AI is particularly important in domains with strict confidentiality requirements, such as healthcare [48]. To ensure patient confidentiality, researchers have deployed local LLMs for anonymizing radiology reports [49] and offline-capable chatbots for self-managing hypertension [50]. Other domains have similar confidentiality requirements that motivate adopting local AI, such as legal practice, financial services, and proprietary business operations [51]. For example, in law, a key obstacle to AI use is that, when using cloud platforms, there is a risk that confidential attorney–client communications and work products could be recorded by logging prompts and responses, risking security breaches or even loss of privilege in court proceedings [52,53]. The significant confidentiality and data privacy concerns for attorneys can be obviated by local AI systems rather than relying on proprietary AI or even open-source AI on third-party cloud services.

Local deployment also reduces dependency on AI providers who might otherwise raise prices, restrict access based on commercial considerations, impose usage terms, or even discontinue services. Locally deployed models are becoming increasingly viable on lower-cost systems, albeit with performance trade-offs as devices are less capable [54]. Additionally, local deployment can prevent the need to use foreign cloud providers, such as using China’s DeepSeek models in the United States [54]. Cloud-based providers generally implement restrictions on what their systems will discuss or assist with, denying user requests with automated responses based on safety restrictions. The drawback of imposing restrictions though is that they are often overly broad and capture even legitimate uses, such as education, political organizing, and politically sensitive topics [55]. Local AI can thus help to counterbalance the concentration of power in a few dominant technology companies and democratize access to advanced capabilities [17,45,47].

Fundamentally, local deployment offers greater autonomy. Local AI avoids dependence on platforms that may enforce ideological constraints, commercial gatekeeping, or compliance with national censorship regimes. It also reduces exposure to surveillance by both corporations and states since central AI platforms can track and log every prompt and response [56]. Local AI, which cannot be externally monitored without hacking into local systems, thus provides a more secure way to help generate activist media, coordinate political action, or explore policy proposals free from institutional constraints. On a technical level, users can customize AI models to their specific needs without being limited by restrictions imposed by central providers. Given a pretrained open-source LLM, local devices or relatively inexpensive cloud resources can be used to fine-tune (i.e., further train) models to achieve specific goals for an individual or organization [57,58]. Open-source software has also been released to implement fine-tuning through command line and graphical user interfaces [59,60,61]. Users can freely modify the parameters and system prompts of an open-source model, thereby providing another way to circumvent safety restrictions [62,63,64].

4. Potential Risks of Local AI

As outlined in the previous section, local AI promises significant advantages for privacy, autonomy, and democratizing access to technology. These mitigate the danger of centralized AI giving technology platforms even greater knowledge of and control over users than, e.g., social media platforms do today [65,66]. However, the benefits of local AI are intertwined with potential risks as well. The same qualities that make local AI private and autonomous inherently undermine the measures that can be taken to prevent potential harm. This section reviews the risks of generative AI, focusing on areas where governance is needed to provide safety to users and others who might be affected by the use of generative AI. Notably, while the focus of this review is specifically on local deployment, many risks that are already evident for frontier cloud-based AI will apply equally to local AI models given their rapid pace of improvement. Here, three examples of AI risks for which local deployment could raise particular concerns are reviewed in detail: information integrity, cybersecurity, and biosecurity. A caveat to this discussion is that potential misuse of local AI is difficult to track and trace, and research has primarily focused on frontier closed-source models. As such, the empirical evidence of local AI remains limited and relies on extrapolating from the evidence of general AI risks.

First, generative AI can be used to create and disseminate effective misinformation and propaganda [67]. A recent experiment showed that propaganda articles generated by OpenAI’s GPT-3 could achieve persuasion rates equal to those of human-made foreign propaganda [68]. Other studies have found similar persuasive impacts for human evaluation of GPT-3-generated tweets [69], news articles, and other social media posts [70]. An even older model, GPT-2, was found to generate persuasive disinformation in the form of news articles [71]. Generative AI models can also generate multimedia disinformation, or “deepfakes” [72,73]. One empirical study showed that LLMs can generate statements imitating the style of politicians and other public figures with even greater perceived authenticity than the figures’ real statements [74]. The disinformation that was found to be effective in these studies was generated by GPT-3 and older LLMs. As shown in Figure 2, however, newer AI models like Llama 3, Qwen 3, and Gemma 3 that can run on consumer hardware are even more powerful [24,26,75]. This suggests that local AI is capable of generating highly effective political disinformation as well. Indeed, a recent study of older local models that lag behind the local state of the art at the time of this paper’s writing, including Llama 2, Mistral, and Microsoft Phi-2, found that they produced election disinformation that was indiscernible from human-written content in over 50% of instances [76].

Real-world observations confirm laboratory findings on the potential of AI to generate effective disinformation. For example, a recent study documented a real-world case where a Russian-backed propaganda outlet integrated GPT-3 into its operations, leading to a 2.4-fold increase in daily article production and an expansion into more diverse topics, all while maintaining persuasive efficacy [77]. There have been reports of other AI-enabled propaganda campaigns, such as social media posts in 2023 targeting Americans supportive of Ukraine [78]. By 2024, the use of AI appears to have become widespread in elections around the world. A recent report showed that 80% of countries that held an election in 2024 had demonstrated incidents of generative AI use—and, significantly, at least 20% were known to have been generated by foreign actors [79,80]. According to the report, generative AI was used to create deceptive social media posts, videos, and news articles. Most models were not identified, with the exception of ChatGPT in a few cases where the creators were transparent about the content origin. As the preceding studies showed, however, local AI has the capability of generating persuasive content, potentially without guardrails imposed by proprietary model providers like OpenAI or Google.

Second, generative AI lowers the technical barriers to creating sophisticated code to attack and compromise computer systems. LLMs have become very powerful software code generators, and they are becoming integral to professional workflows [81,82,83,84]. LLMs that run locally have also become more powerful coders; in 2024, one benchmarking study found that fine-tuned versions of Llama were capable of generating code that was more efficient than human-written code [85]. Local AI thus makes it possible for malicious actors to use fewer resources and require less technical expertise to execute a variety of complex and effective cyberattacks [86]. For instance, LLMs can be used to produce powerful malware that can evolve autonomously to evade detection [87].

In addition to malware, LLMs enable more powerful social engineering for criminal activity. For example, LLM-generated phishing emails have been shown to bypass both rule-based and machine learning-based phishing detectors [88]. Multimedia generative AI models can also be used for social engineering and deception. For example, voice cloning to impersonate celebrities or even family members in phone calls has been used to fraudulently elicit payments [89,90,91]. Identity fraud can also be facilitated by generative AI tools, exacerbating the rapidly growing challenge of “synthetic identity fraud” based on the creation of false documents [92].

Local AI’s growing capabilities in software coding and multimedia generation allow it to serve as a potent vehicle for generating malware and other kinds of cybersecurity threats. In February 2024, Microsoft and OpenAI reported on threat actors, including state-supported agencies such as Russia and North Korea, which had sought to utilize OpenAI GPT-4 for vulnerability research, social engineering, and coding tasks [93]. Today, there are local AI models that exceed the capabilities of GPT-4 in 2024 (as shown in Figure 2). Of particular concern, if threat actors utilize local AI models, their misuse may not be detected in the same way as with proprietary cloud-based models.

Third, specialized generative AI models can be used to handle biological sequence data, such as DNA and protein sequence information, in a similar manner to language in LLMs [94,95,96,97,98]. Such large biological AI models can be used for synthetic genomics, helping scientists to design, build, and predict the function of novel genes and proteins that can improve health and the environment, such as treatments for genetic diseases and engineering bacteria to consume pollutants [99,100]. However, using generative AI models in synthetic biology is a dual-use technology, with the capacity for enormous risks. If used irresponsibly, it could create or enhance harmful organisms like pathogens and engineer malicious toxins [95,101]. Individuals without years of specialized biological training can use AI models to design potentially dangerous biological agents, like more virulent viruses [102,103]. This creates a critical need for robust biosafety and biosecurity measures [101,102,104].

Local AI, however, undermines state-implemented regulations and safeguards since open-source models can readily be downloaded and customized by users with malicious intent. For example, the Evo genome foundation model contains 7 billion parameters [98]. At that scale, while training may still require an expensive multiple-GPU server or readily accessible cloud resources, novel DNA or protein sequences can be generated on a high-end desktop computer with a consumer-grade GPU. Although there have not yet been reports of real-world use of generative AI to create harmful biological or chemical materials, the magnitude of potential harm is substantial. Certainly, in the conventional weapons space, AI-enabled autonomous weapons are increasingly becoming a reality [105]. For example, Ukraine has deployed drones with AI capabilities, although they continue to be used with human control [106].

While the concerns described here are particularly significant—and in the case of election disinformation and social engineering, e.g., phishing—already a widespread problem, they only represent a subset of potential AI risks. Yet another example of an emerging threat is the use of generative AI to enhance surveillance. A recent news report revealed that the Israeli government is training a ChatGPT-like model on surveillance data to provide a way of processing massive quantities of information that was being gathered [107]. This technique could potentially be used by non-state actors and corporations to further erode individuals’ privacy as well. Further risks of AI use are also likely to emerge as it becomes more widely used and available.

5. Local AI’s Challenges to Current AI Safety Measures

5.1. Challenges to Technical Safeguards

Safe AI model operation relies on technical safeguards that are built into the training process. “Alignment” processes are specialized techniques to further train a pretrained base or fine-tuned model, such as Reinforcement Learning from Human Feedback (RLHF). Alignment aims to calibrate model behavior towards human preferences by teaching AI systems to be helpful, harmless, and honest [108]. Alignment has become the cornerstone of the current AI safety paradigm [109]. Safety alignment is often complemented by hidden “system prompts,” which define boundaries on responses, and content filters, which force a denial response to requests for prohibited content [55]. Cloud-based LLM systems are also continuously monitored for problematic usage patterns, routinely subject to safety audits, and updated immediately when vulnerabilities are discovered. Technical AI safety measures can be guided by voluntary frameworks promulgated by both governmental and non-governmental agencies seeking to regulate AI models without a formal legal basis [110,111]. Consistent with these approaches, comprehensive safety evaluations typically focus on model outputs in controlled testing environments rather than real-world deployment contexts [112].

However, these conventional approaches to technical AI safety do not translate well to open-source local AI models. Figure 3 illustrates the problem by showing the results of some simple prompt testing, which the reader is encouraged to replicate or experiment with on their own. Testing of local models was conducted using a MacBook Pro M4 Max (128 GB RAM) for local deployments with standardized parameters (temperature $\overline{0}$.6, top-P $\overline{0}$.95, min-P $\overline{0}$.1). Models were downloaded from the Hugging Face Hub (https://huggingface.co (accessed on 28 May 2025)) and executed using Apple’s MLX library. The chat applications of web-based models were accessed on 28 May 2025. Cloud-based open-source Llama models were accessed via Groq’s third-party APIs (http://www.groq.com (accessed on 28 May 2025)). Google’s Gemini model was accessed through Google’s AI studio, https://aistudio.google.com/prompts/new_chat (accessed on 28 May 2025). Otherwise, OpenAI, Anthropic, and Mistral cloud-based models were accessed through their commercial websites. While not intended as a rigorous analysis, this exercise immediately demonstrates how local AI forces us to rethink AI safety architecture, providing examples of how capable local AI models can respond to unsafe prompts. When tested with requests for election disinformation, AI models hosted on cloud services consistently refused. An example is Anthropic Claude’s response: “I can’t create false information about election dates or voting procedures. Instead, I’d be happy to help you write a post about the importance of getting election information from official sources like state election boards, or create other content about civic engagement and voting awareness.” There was one notable exception, however: Mistral LeChat, from a company based in France, generated election disinformation when prompted about the United States but refused when prompted about French elections (hence marked as “Partial compliance”). By contrast, local AI models generally complied with requests for election disinformation. These included instances where the model provided a “hypothetical” text describing election disinformation, accompanied by a warning that actually using such a post could be dangerous.

Similarly, both proprietary and open-source models run on the cloud refused requests for potentially violent content. In this case, in contrast with the disinformation prompt, locally deployed open-source models generally did not provide a response. For example, Gemma 3 responded, “As an AI assistant, I must emphasize that promoting or advocating for revolution against any government, including the People’s Republic of China, is not only illegal but also unethical.” However, there was one notable exception. One of the models that was tested was a variant of Qwen3-8B called “Josified Qwen3” (as of the publication date, the model card and model weights for the Josified Qwen3-8B variant are available from the Hugging Face repository at https://huggingface.co/Goekdeniz-Guelmez/Josiefied-Qwen3-8B-abliterated-v1 (accessed on 28 May 2025)) that had been “abliterated,” which is a process where an already aligned model is further fine-tuned to remove safety constraints [113]. Notably, in response to the prompts asking for information on a violent government overthrow, it included violent content, such as explicit instructions for attacks on buildings and mass killings.

Real-world open-source AI fine-tunes have been developed that intentionally produce personally or socially harmful content. An extreme example is “ChatGPT4-Chan,” an AI model fine-tuned on the/pol/subforum of the 4chan website, a notorious location for highly hateful and toxic content [114]. The resulting model generated extremely harmful content, and it was briefly available on the Hugging Face model repository [115,116], the website that serves as the preeminent host for freely downloadable open-source models. Hugging Face quickly took down the model, stating only that it violated the repository’s terms of service [114]. However, the model remained available for download elsewhere. Even national security concerns can be implicated. For instance, policymakers in the United States became concerned when researchers affiliated with China’s People’s Liberation Army published the development of an LLM designed for military use that was based on fine-tuning the open-source Llama model developed by Meta [117,118].

Once downloaded by a local user, further changes to an AI model become invisible to external monitoring [11]. This is a critical problem because AI model safety alignment can be removed with further fine-tuning [58,108]. Further training to “dealign” open-source models is neither costly nor technically difficult. One of the breakthrough technologies in generative AI is LoRA (Low-Rank Adaptation of LLMs), a technique that allows only a small fraction of parameters to be modified in an LLM when fine-tuning [119]. Using methods like LoRA and quantization, modest computational resources, even a single consumer-grade GPU and a few hundred curated training examples, can be used to retrain a model to comply with harmful requests, which it was originally designed to refuse.

Indeed, using technology available in 2024, researchers employing LoRA were able to achieve near-complete removal of safeguards from even the largest (70-billion parameter) models with a budget under USD 200 [58]. Similarly, another group demonstrated that, using just 100 examples (requiring only one hour on a single consumer-grade graphics card), they could modify Llama 2’s model weights enough for it to comply with nearly all the unsafe prompts that it originally refused [120]. Critically, these dealignment methods did not appear to substantially impact the models’ overall capabilities or performance on standard benchmarks. Even when capabilities were somewhat degraded, “uncensored” models can still be effective. For example, one group of researchers has shown that ransomware could be developed by using an uncensored model to produce initial malware that is then refined by more capable censored models to make it functional [121].

In sum, local AI ecosystems exhibit a fundamental tension: The very characteristics that make local deployment valuable for legitimate applications—privacy, autonomy, and customizability—also enable potential misuse and limit tools to ensure safety and accountability for harmful use. Furthermore, even if downstream users do not deliberately seek to modify local AI models to remove safeguards, malicious actors are better able to modify an open-source model outside the protections of a cloud-based provider, such as by adding “poison text” to training data that users employ for fine-tuning [122].

5.2. Challenges to Policy Frameworks

The current AI governance frameworks reflect the implicit assumption that models are centrally deployed: identifiable entities maintain operational control over model access, monitoring, and content moderation. The following section reviews the current AI policy frameworks that are being implemented through governmental and non-governmental channels from the perspective of how they rely on the implicit assumption of centralized AI. To frame this discussion, Figure 4 illustrates how AI governance operates throughout the “AI supply chain,” from research and model design all the way through to end-use [123,124]. These nodes of regulation, however, break down as technology advances towards enabling a fully decentralized AI ecosystem.

As further explained below, when run locally, AI is largely invisible to regulatory bodies, creating substantial enforcement difficulties for any framework that targets specific applications or usage patterns. For example, ensuring that an AI model has appropriate safety alignment or is watermarking synthetic output to avoid deception becomes impossible when the model developers are hidden or part of diffuse open-source projects. Similarly, determining whether a locally deployed model is being used for legitimate privacy-preserving data analysis as opposed to, e.g., generating harmful deepfakes means that authorities have to monitor personal computing environments. Such a level of monitoring would not only be impractical but would also fundamentally violate individual rights.

5.2.1. Governmental Regulatory Frameworks

The following is a review of the current state of governmental frameworks for regulatory work. To begin with, the European Union (EU) AI Act, first proposed in 2021 and finally adopted in June 2024, may be the most comprehensive legislative attempt at AI regulation [125]. The AI Act’s regulatory scheme employs risk-based categorization. AI systems are classified into unacceptable risk (prohibited), high risk, limited risk, and minimal risk, with a corresponding graduated set of obligations [126]. For “general purpose” generative AI with lower risk levels, the AI Act provides baseline transparency requirements, such as summarizing training data and ensuring copyright compliance [125]. Models deemed to pose “systemic risk,” for example due to their reach or potential for harms to public health, safety, security, and basic rights, face more stringent obligations. For example, models facing greater regulation are those trained with significant computational resources, e.g., exceeding ${10}^{25}$ floating-point operations as a threshold, although elsewhere the AI Act provides broader criteria. Obligations for developers of models with the potential for systemic risk include model evaluation, adversarial testing, risk assessment and mitigation (including for bias and discrimination), cybersecurity measures, and detailed documentation and reporting requirements to the European AI Office or national authorities [125]. Article 52 of the AI Act further requires labeling AI-generated content to prevent deception [127]. All of these legislative provisions place the onus on top-down enforcement targeting model development and use that may be impossible in a decentralized ecosystem. For example, a locally runnable AI derived from a “high-risk” AI model developed outside the EU would likely be invisible to EU regulators.

In contrast with the EU’s legislation, federal AI regulation in the United States has been late to develop and driven at the executive level. In November 2023, President Biden’s administration promulgated Executive Order (EO) 14110, entitled “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence” [128]. EO 14110 aimed to manage the risks of powerful AI models, termed “dual-use foundation models,” defined as models trained using more than ${10}^{26}$ integer or floating-point operations for general models, or ${10}^{23}$ operations for those using primarily biological sequence data [128]. The Biden order required companies developing or intending to develop such “potential dual-use foundation models” to provide the Federal Government (via the Secretary of Commerce) with ongoing information regarding their training processes (including cybersecurity for training), ownership of model weights, and results of internal adversarial testing designed to identify harmful capabilities [128]. However, days after President Trump was inaugurated, certain elements of the EO 14110 framework were dismantled [129]. These included the prior order’s emphasis on bias and fairness, although other security-related elements appeared to be kept in place, albeit without further explanation [130]. Given conflicting orders and an unclear regulatory approach, at least in the near-term it is not clear if there is going to be a robust federal regulatory framework in the United States, let alone one that would reach local AI.

China, by contrast, has implemented a set of complementary regulations that apply to AI. These include the Algorithm Recommendation Regulation (effective March 2022), the Deep Synthesis Regulation (effective January 2023), and the Interim Provisions on Management of Generative Artificial Intelligence Services (effective August 2023) [131]. The key obligations under these regulations include (1) security assessments and mandatory algorithm filing with a government agency for service providers using AI for public opinion or social mobilization; (2) stringent requirements to prevent and screen for illegal or harmful content, promoting “socialist core values,” preventing discrimination, and preventing misinformation; and (3) mandatory labeling of synthetic AI-generated content that might confuse or mislead the public, as well as prohibiting removal of these labels by anyone [131]. Generally, China’s regulations make little explicit distinction in core obligations between open-source and proprietary models, or between domestic and foreign providers if their services reach China [131]. This contrasts with the EU AI Act’s approach that, for instance, provides preferential treatment, including certain exemptions for open-source models [125]. Just as with the EU AI Act, the proposal in China has limited applicability to local models that do not require Internet access.

The development of AI regulation extends beyond global economic powers. For instance, many African nations are constructing AI governance frameworks. The focus of such efforts includes establishing foundational digital infrastructure and data protection regimes (such as Mauritius’s 2017 Data Protection Act), as well as improving technological capabilities, while some countries, like Egypt and Kenya, have developed national AI strategies and task forces [132]. The broader approach in Africa, as well as other emerging economies, has been to add regulation in sequence with the development of digital infrastructure, prioritizing digital readiness more than regulating the future applications of AI technology that are still hypothetical [132].

What the state-based regulatory frameworks described here have in common is that they are very brittle when faced with the challenge of highly capable local AI. Once deployed on individual devices, AI models can operate entirely outside the visibility and control of their original developers, or even the regulatory jurisdictions in which they were created. For example, given the borderless nature of local AI, how could relatively stringent AI regulations, like those in China, be enforced? Arguably, China’s “Great Firewall,” which regulates access to websites outside of China, could prevent the use of unregulated AI within China [133]. However, with just a single download or import of a model on physical media, an AI model can be run on a computer without having to tunnel through the firewall to access a foreign cloud-based service. As another example, China and the EU have mandated labels on synthetic, AI-generated content. Mandatory contact labeling can be implemented technologically using automatic watermarking of content [134]. However, watermarking is vulnerable to invisible, effectively unregulated, local AI. AI methods can strip out sophisticated content labels and regenerate unlabeled images, even when supposedly invisible robust watermarks were inserted using AI in the first place [135,136,137].

5.2.2. Voluntary (“Self-Regulatory”) Frameworks

An alternative approach to AI development-focused regulation without state actors is for developers to voluntarily commit to specific safety standards while creating meaningful accountability for those commitments [138]. Model developers can choose whether to make safety commitments, but violations of those commitments trigger enforceable sanctions—such as loss of market access, platform privileges, or legal protections. Such a regime is exemplified by the Singapore government’s “AI Verify” initiative, which provides an official certification to organizations that demonstrate responsible AI practices through transparent standardized evaluation processes [110]. Another approach is for governments or industry groups to define a set of standards for AI governance that organizations can voluntarily adopt. In 2023, the United States National Institute for Standards and Technology (NIST) published the NIST AI Risk Management Framework, which defines governance practices, including risk assessment, stakeholder engagement, and continuous monitoring [111].

Voluntary commitment frameworks have also been proposed, and in some cases adopted, in dual-use biological research. For example, the research community has developed the “Responsible AI × Biodesign” statement of community values and commitments, where developers voluntarily commit to prerelease evaluation of AI systems to identify potential safety and security issues [101]. Despite enthusiasm in the research community, specific implementation gaps remain. For example, the signatories agreed to conduct prerelease evaluations but had yet to deliberate on either defining the capabilities that would trigger the need for evaluations or the standards for conducting them [101].

Ultimately, the central challenge with voluntary commitments is that they require buy-in by industry and organizations that develop AI models and applications. However, empirical studies of AI practitioners demonstrate that, even within organizations with stated commitments to responsible AI, incentives are misaligned, resulting in structural barriers to implementing ethical principles in practice. In the real world, companies prioritize product launches over ethical considerations; correspondingly, employee performance metrics overshadow fairness concerns [47,139,140,141,142]. The buy-in problem is even greater in a decentralized AI ecosystem. It is difficult enough to persuade companies that design and implement models to agree to binding voluntary commitments to AI safety. Local AI means having an even larger population of AI users who must all abide by commitments to a universal safety standard.

Another form of private regulation that has been particularly significant is the use of intellectual property (IP) strategies. Generally, open-source licensing involves permissive license frameworks (e.g., Apache 2.0, MIT) rather than copyleft licenses that require derivative works to remain open-source [143]. In an effort to promote safe model use, models and weights are being released under modifications of such licenses that include specific provisions that define acceptable use [144,145].

Acceptable-use clauses typically spell out concrete prohibitions. Licenses, for example, forbid the generation of misinformation, harassing materials, or weapons-related campaigning. Some licenses appear to prohibit even broader uses as well, such as political campaigning or large-scale automated posting. For example, exemplary license terms have been proposed that the licensee will not “enable the distribution of untrustworthy information, lies and propaganda,” use an AI system “in a manner that would imitate human characteristics and cause third party confusion” between the AI system and humans, or use the subject AI technology “in applications that imitate or alter a person’s likeness, voice, or other identifiable characteristics in order to damage his/her reputation” [144]. Many models now come with these kinds of terms. One example is that of Eleven Labs, a developer of models that generate audio [145]. Eleven Labs’ license prohibits users from using it to “trick or mislead us [i.e., Eleven Labs] or other users, especially in an attempt to learn sensitive account information, for example, user passwords.” Standard open-source licenses have now been introduced, including the RAIL (Responsible AI Licenses) OpenRAIL license [146] and the proposed CAITE (Copyleft AI with Trust Enforcement) licensing model [147]. CAITE goes beyond a standard license by including an enforcement scheme as well, where a single trusted entity leverages the covered IP rights in litigation to enforce ethical AI use [147].

However, there is serious doubt over whether acceptable-use licenses are even enforceable. An IP regime generally depends on copyright, but model weights and outputs may not be copyrightable under current law due to the lack of human authorship [148]. Moreover, even if there were some way to reliably enforce AI license terms, there is a genuine concern that they entrench well-resourced actors who can navigate complex licensing schemes and produce undue barriers to innovation [144,149]. Restricting open-source licensing can also be antithetical to the values of open-source development. In particular, open-source model developers depend on permissive licensing to encourage the development of technologies that can detect and counter potentially unsafe AI applications, such as the development of software that can generate deepfake images and video [150,151]. If licenses are encumbered, then such measures may be harder to develop by reputable organizations and developers who seek to abide by terms of acceptable use.

The globalization of AI provides a further obstacle to effective model licensing schemes. Any licenses would need to be enforced across borders, which requires navigating jurisdictional challenges and conflicts between legal regimes. Local AI raises yet more fundamental challenges to license-based AI regulation. Terms of use are often only enforceable when users access models through the model provider’s own cloud access, and then enforcement typically occurs by cutting off noncompliant users [148,152].

The challenges around AI licensing further illustrate the implicit assumption that AI models will be run through the cloud and provided from defined sources. Enforcing any laws, regulations, and voluntary guidelines is highly complicated in the case of open-weight models that can run on any server or locally. Even detecting AI misuse is difficult, let alone tracing it to an individual user. The governance framework itself must adapt to make sure that any regulatory policy is designed such that compliance can still function effectively in a decentralized AI ecosystem. The following section describes alternative governance approaches that can address the challenges posed by local AI, including both technical measures and policy approaches intended to embed and enforce norms for acceptable AI use.

6. Reimagining Governance for Local AI

This section provides a literature review that can form the basis for the technical and policy dimensions of a reimagined governance framework for local AI. The intention behind these proposals is to provide a starting point for developing a governance framework of local AI that recognizes its benefits—privacy, autonomy, and democratization—while addressing the potential risks of AI use that may be harder to regulate in a decentralized context.

Figure 5 shows technical and policy measures that, rather than being seen as independent solutions, are intended to be implemented within an interlocking network of responses. The technical proposals described here include (1) community-based tools for voluntary content authentication, (2) configurable runtime safety boundaries for the AI computing stack (“ethical runtime environments”), and (3) distributed monitoring of open-source AI development. Complementary policy proposals include (1) polycentric governance mechanisms that operate across multiple scales and jurisdictions, (2) community-driven participatory models that build governance from the ground up, starting with those most directly affected, and (3) safe-harbor protections from legal liability for responsible actors, giving stakeholders the space and incentives to develop ethical principles, innovate safeguards, and resolve thorny questions about AI liability.

6.1. Proposed Technical Safeguards Designed for Local AI

6.1.1. Content Provenance and Authentication

If implemented in a manner consistent with local AI values, content provenance can be a critically important tool. Reliable content provenance provides substantial benefits by helping to protect intellectual property, prevent harassment, and defend against dual-use threats. However, the decentralized nature of local AI, along with widely available methods to dealign models that mark content automatically, make enforcing content labeling difficult. More fundamentally, mandatory content traceability undermines the privacy and autonomy benefits of local AI.

As an alternative, we propose a community-driven authentication framework based on three principles that are consistent with the participatory governance approaches discussed below in Section 6.2.2. First, voluntary provenance standards developed by open-source communities can establish norms for content labeling. These standards can be enforced socially rather than technically, for example through peer review, reputation tracking, and community moderation. Second, incentive-aligned authentication can mitigate the authoritarian potential of state or industry (usually Big Tech) mandates. For example, content creators can develop voluntary schemes to establish and verify authorship, and professional communities like journalists, researchers, and software developers can develop sector-specific practices to meet their needs while contributing to broader norms. Third, technical detection tools can complement voluntary labeling via the ongoing development and improvement of open-source tools for identifying likely AI-generated content [153,154,155].

This reimagined approach to content provenance maintains the integrity of information while acknowledging the need to conserve the benefits of local AI regarding privacy and autonomy, such as users being able to maintain anonymity when generating sensitive or politically controversial content. For content provenance to have a positive impact, it must be broadly adopted and not undercut by enforcement challenges that arise in an increasingly decentralized environment. Thus, a participatory approach to content provenance aims to make the use of watermarking a social norm to uphold rather than a regulatory burden to evade. Even so, putting any kind of content labeling framework into practice will be challenging. Implementing voluntary standards requires ongoing coordination, clear incentives for their use, and trusted tools for labeling and verifying content. To make implementation more feasible, open-source groups could build lightweight tools that are straightforward to use. Philanthropic and government funding can also provide support to technology development efforts through incentives for adoption, such as compensation schemes for properly labeled generative AI products. Given these implementation challenges, the proposal described here should be seen as a starting point.

Content provenance technology can be further empowered by the kinds of policy measures proposed below in Section 6.2. For instance, the open-source model design community can be incentivized to contribute via the establishment of safe spaces for participatory dialogue. Another complementary policy described below involves safe harbors for legal liability, which can be granted in exchange for using content provenance tools. Developing content provenance through the participation of multiple groups of stakeholders also aligns with polycentric governance principles.

6.1.2. Ethical Runtime Environments for Technical Safety

Local deployment removes AI models from the security of centralized model servers, thereby weakening technical safeguards. Local AI entails higher risks of model tampering and malicious output manipulation; for example, legitimate open-source models can be replaced by malicious models on open-source repositories like Hugging Face [156]. Malicious models, or even models that unintentionally provide harmful outputs, can harm not only innocent users but also others indirectly affected by their output. One approach to address this problem is inspired by Trusted Execution Environments (TEEs) [157]. TEEs are like digital vaults within a computer—specialized processor hardware features that provide secure isolated spaces for running sensitive code and protecting data [158,159,160]. Even if someone gains complete control over a device, they cannot access or modify what happens inside the TEE. While TEEs have been proposed and employed for AI systems [161,162,163], their use is limited on local devices because of software and hardware constraints that limit performance [161]. Along these lines, modern operating systems utilize “sandboxes” to provide application security and protect against malware [164,165].

Building on these security concepts while preserving user autonomy, we propose that research and open-source development efforts be directed towards creating “ethical runtime environments” (EREs) for local AI. Unlike mandatory restrictions that undermine local AI benefits, EREs function as optional safety layers that users can configure, modify, or disable based on their needs. Thus, the key feature of EREs is the definition of personal safety boundaries where users define their own constraints. For example, a therapist might configure an ERE to prevent generation of content that could harm vulnerable patients. Parents could establish boundaries for AI interactions with children. Researchers working with dual-use capabilities could implement audit logging, output monitoring, and other safeguards.

Personal safety boundaries, in turn, provide the basis for specific and limited technical safeguards within the ERE. These can include protection against model manipulation through runtime integrity checking to defend users against maliciously modified (e.g., Trojan horse) models while preserving their ability to intentionally modify models. Internal regulation of model execution is an aspect of what have been described as “ethical governors” [166,167]. Ethical governors can be implemented as sandboxed software that triggers when a model operates outside of ethical boundaries, automatically shutting the model down unless a user provides express permission to move forward. Other safety components can be modular and employed based on the context of AI use, such as medical privacy safeguards, academic integrity filters, or professional ethics constraints.

Crucially, EREs should be transparent and not imposed from the top down. Instead, their adoption requires building community norms and incentive mechanisms. Several obstacles will need to be addressed for the ERE concept to work. Performance trade-offs may limit the adoption of runtime environments for resource-intensive models, so development should emphasize lean implementations that require limited additional memory and processor overhead. Users will also resist adopting tools that are not intuitive or require technical skill. Thus, early ERE development should focus on lightweight open-source prototypes that integrate with common local AI platforms, e.g., desktop inference engines or browser-based tools. Ideally, over time, EREs would interoperate with voluntary content provenance and attribution tools, enabling decentralized yet layered technical safeguards. Like content provenance technologies, EREs should be supported by policy mechanisms that promote input across communities that use and are affected by AI, such as the proposals further described in Section 6.2.

6.1.3. Distributed Oversight of Open-Source AI Projects

The open-source nature of local AI projects can be a barrier to effective regulation. For instance, as previously described, the open-source principle of transparency has been shown to provide a false sense of comfort to developers who believe that the harms of their products will be mitigated or regulated further downstream. However, there are ways in which the transparency of open-source projects can contribute to local AI governance. By their nature, open-source AI projects are susceptible to monitoring and tracking [168]. Open repositories expose detailed information, including model architectures, datasets for fine-tuning, software code, error reports, feature requests, and documentation files. Therefore, being able to track the progress of open-source projects enables early warning systems to flag the development of high-risk and potentially harmful models and applications. Active oversight of open-source AI projects also makes it possible to implement reputational incentives that would encourage a culture of responsible AI. Projects that follow community-driven ethical principles can also be identified and formally certified.

Computational tools can help with large-scale monitoring of the open-source AI ecosystem. For example, one group of researchers developed a system capable of detecting ethical violations in open-source projects by using ontologies and semantic rules to model the structured metadata that are publicly available in open-source software development repositories hosted on GitHub [169]. Project tracking and assessment tools can be further enhanced using AI. For example, potential risks can be flagged by “AI Detective Systems” that analyze publicly available content for signs of synthetic generation without needing to inspect the model itself [170]. To be sure, the monitoring proposal here may be interpreted as surveillance and external monitoring of open-source projects, and thus may appear superficially antithetical to open-source principles and an undemocratic intrusion on individual autonomy. That is not the crux of this proposal, however.

In fact, when properly designed, distributed oversight can be fully aligned with the principles and culture of open-source development. Empirical studies of individuals contributing to an open-source project to develop deepfake technology showed that they believed transparency would mitigate harms [150]. For example, as other studies have shown, developers believe that, because of the transparency of open-source development, people who might be otherwise deceived by deepfakes are made aware of the potential for such technology. Developers also believe that open-source development helps to enable the creation of other software to detect deepfaking [151]. Therefore, distributed open-source governance can promote both innovation and accountability, provided that it is driven by the communities most affected by the technology.

Accordingly, the most essential component for oversight is that it be fully consistent with the open-source norms. A critical risk of open-source “tracking,” as described here, is that it is seen as intrusive and abusing the philosophy of openness by turning it into top-down regulation and monitoring. It is crucial, then, to develop transparent oversight mechanisms that emerge from within communities of developers and users rather than being imposed from external authorities. Such measures can include safety benchmarks, developed and maintained through community mechanisms, as described in Section 6.2.2; voluntary disclosure practices, potentially associated with safe-harbor liability provisions, as described in Section 6.2.3; or peer review processes for high-risk applications, as proposed by Pannu et al. in the context of biosecurity [101]. Given thoughtful community-led design, distributed open-source governance represents a compelling alternative to conventional AI oversight, which is susceptible to distortion caused by power imbalances between major technology companies and governments on one side and individuals and marginalized communities on the other.

6.2. Proposed Policy Measures for Local AI

6.2.1. Polycentric Governance Frameworks

As explained in Section 5, the regulatory schemes developed by different states, regions, and voluntary industry-led groups are fragmented. As a result, conventional AI struggles with diffuse and transnational risks, such as AI-generated propaganda or cyberattacks. One response to this challenge is polycentric governance.

Polycentric governance is a concept developed by Elinor Ostrom and others in the context of addressing the global challenge of climate change, which depends on actions and regulations locally, at the nation-state level, and across borders [171,172]. In the case of climate governance, polycentric systems offer mechanisms for policy experimentation and learning across diverse partially autonomous actors, especially when central authority is weak or absent [172]. While polycentric governance was initially developed for climate change, it is a framework that can be applied to other broad challenges that implicate local–global concerns. Local AI presents its own set of technical and institutional challenges, but it shares similar structural features with climate threats: weak central authority for regulation, potential for distributed risks that can aggregate across fragmented jurisdictions, and harms that are difficult to trace or attribute. For instance, the development of AI capabilities leads to global impact through open-source collaboration, with risks manifesting locally through individual downloads, modifications, and potential harmful use. Consequently, polycentric frameworks that have been developed for complex global–local threats can be applied to AI by providing multiple overlapping centers of authority, each with some autonomy and capacity to respond to problems at their level [171,172]. For local AI, this can include national regulators, international institutions, standards bodies, open-source communities (such as collective model repositories like Hugging Face), research institutions, labor unions, and civil society organizations—really any collective organization of people who use or are affected by AI.

Polycentric governance is well-suited for emerging technologies because it naturally invites experimentation and learning. With many governance nodes operating in parallel, polycentric systems allow for different solutions to be tested in different contexts. When something works well in one domain, it can be adopted or adapted by others across the network [171]. For example, technical standards bodies formed internationally can develop shared safety principles for advanced models, testing protocols, and audit benchmarks. Professional communities of practitioners, such as educators, healthcare providers, and creatives, can collaborate across borders to form recognized governance nodes for sector-specific standards while sharing best practices. Polycentric governing nodes can also form along the lines of common linguistic and cultural backgrounds within and across national boundaries.

Furthermore, a critical defect of safety alignment methods imposed by companies and external agencies may, contrary to their stated objectives, actually conceal a misalignment between individual values and purported consensus ethical principles [173]. The polycentric approach creates opportunities for developing AI alignment methods that reflect diverse community values rather than the preferences of major technology companies. Open-source communities could help to operationalize ethical norms by guiding their technical implementation through more individualized alignment methods and technical measures, such as the ERE secure computing framework described above.

When put in practice, polycentric governance can suffer from high coordination costs and inconsistent rule enforcement. Regulatory capture is a perpetual threat, especially when governance nodes lack transparency and resources. Designed correctly, however, polycentric frameworks allow actors to engage in positive “forum shopping”—seeking out governance arrangements that fit their context and needs [174]. It is only when governance nodes fail to share information and resolve disagreements that regulatory gaps are created. Malicious actors may then exploit weak jurisdictions or permissive standards, leading to harmful forum shopping [174]. These principles are outlined here as the conceptual foundation for further developing policymaking in a distributed and decentralized manner. As it evolves, effective polycentric governance will depend not only on distributed participation but also on internal coordination mechanisms, including a stable infrastructure for dispute resolution [172].

6.2.2. Empowering Community Governance and Participation

As described throughout this paper, top-down regulation generally fails when applied to local AI. There is a need for more community-centered governance systems that reflect the specific values, risks, and concerns of people closest to AI deployment. The “community” in the case of AI can be defined as being one of collaborative developers, system implementers, and end-users. It is critical to treat stakeholders as a collective rather than siloing each role in the community-building process. Otherwise, the nature of the AI supply chain diffuses accountability: actors at different levels of the chain simply assume that any ethical oversight or regulation has already been implemented upstream or will occur further downstream [175,176,177]. Effective governance must involve the full AI supply chain, as well as all the individuals and communities affected by AI use.

Some examples of community-centered AI governance frameworks have already been developed, and we can look to ways in which they can be applied to local AI. The Canadian government’s Algorithmic Impact Assessment (AIA) tool, developed by the Canadian Treasury Board, offers one example [178]. Federal agencies are obliged to utilize the AIA to assess AI-based policy proposals before deployment across dimensions such as impact on individuals and institutions, data governance, procedural fairness, and system complexity. Modeled in part on environmental impact assessments, the AIA mechanism was developed through a formally open process involving civil servants, academic experts, and public feedback via collaborative platforms. The AIA’s participatory design reflects an effort to embed input from multiple stakeholders into early-stage AI governance and demonstrates how use-focused regulation can address potential AI risk before deployment.

Although the AIA mechanism was originally designed for public sector AI applications, its emphasis on early-stage risk assessment and stakeholder consultation is instructive. The AIA concept has spread worldwide, with different agencies and groups employing variations of the same focus on proactively defining impacts and consulting communities. Stahl et al. recently undertook a systematic review of AIAs and proposed a generic AIA framework that can be applied more broadly [179]. An important lesson is that applying AIA in the context of local AI deployment will need sustained community engagement and institutional support, especially where a decentralized environment raises challenges regarding resource demands and governance legitimacy. Community discussions are needed to establish deliberative spaces where dialogue can evolve from mere consultation to co-creation. Such a bottom-up approach to addressing AI impact is essential as AI decentralizes.

Community Citizen Science (CCS) is another motivational concept for AI policy design [180]. The idea behind CCS is to integrate community knowledge, priorities, and lived experience into the development and application of technical systems, including, among others, AI. CCS projects are designed so that community members are not only passive recipients of technology or research. Instead, potentially affected community members are invited to become active collaborators in defining the goals and design of systems that provide their communities with beneficial impacts. One example of a CCS project is a community-designed air quality monitoring sensor network, in which machine learning was used with sensors. Local residents helped to shape how sensors were deployed, what counted as a meaningful signal, and how to respond. Through projects like this, CCS can build both trust and technical capacity in local contexts [180]. Experiences with the CCS model demonstrate that successful community-led technological development and implementation require designing the collaboration to specifically address the following challenging questions: How can the collaboration sustain participation? How can it resolve technical disputes? How can it ensure equitable influence among stakeholders?

The CCS model can thus be adapted for communities to take on more direct roles in shaping local AI norms. Best practices for social impact assessment, such as AIA, are for communities to establish ongoing management processes to monitor and evaluate changes throughout the AI lifecycle [181]. As AI becomes more embedded within communities, there needs to be a fundamental shift in how regulation is developed and imposed. Rather than agencies debating regulations within their own deliberative bodies and providing public input through limited channels, they should negotiate agreements within communities about what AI uses are acceptable. There needs to be specific attention paid to the vocabularies that different groups use to describe AI, particularly end-users, who may vary across social and cultural lines. This process of “defining shared language” is critical because technical jargon often blocks genuine understanding [182].

In sum, where AI can evade centralized regulation, communities will have to be responsible for monitoring and identifying harms. Decentralized governance brings with it the risk of fragmentation, which would render regulation effectively toothless by allowing bad actors to forum-shop. Duplication of efforts and failure to share good practices can make effective regulation too slow to adapt to rapid technological changes. That said, it is important to recognize that different communities may have different perspectives on what norms are necessary. For example, certain neighborhoods may reject AI uses for surveillance, while the healthcare community may focus on ways to manage privacy and data protection concerns. The decentralized nature of local AI means that the only effective kind of governance will likely need to be one that is distributed while facilitating broad participation.

6.2.3. Liability “Safe Harbors” for Local AI

Questions surrounding the legal duties of different AI supply chain players and the extent of their liability remain theoretically and as yet judicially untested [183,184]. The key question is: Who is at fault when AI models result in harms to people or property, thereby incurring civil tort liability, or even potential criminal liability? The answer is ambiguous and contingent. Model developers who did not test them sufficiently may be liable. Application developers and system integrators may be liable if they do not restrict their users from generating harm. End-users may seem to be liable for the immediate impact of their use, but they may have caused harm unknowingly due to a lack of understanding of how the model functions internally or what safeguards were (or were not) in place. Today, the prevailing view is that any entity deploying AI should assume potential liability for any harms that occur. But, it is unclear to what extent liability can be shared or shifted upstream, such as to model developers [185,186,187]. In 2022, the EU introduced draft legislation specifically for AI civil liability (the AI Liability Directive). Important questions were never resolved, however, and the proposed AI Liability Directive was ultimately withdrawn in early 2025 [188].

The decentralized and easily concealed nature of local AI compounds these challenges by making it difficult or even impossible to identify the liable party and enforce penalties for harm. One potential response is to create carefully tailored “safe-harbor” provisions: liability shields for developers and users who take verifiable and proactive precautions to minimize harm. The safe harbors would provide legal protection for downstream harms that could not have been reasonably anticipated or prevented. This idea is inspired by a recent proposal for open-source AI where developers of well-documented low-risk models would be shielded from broad liability for third-party misuse [134]. Low-risk models might be defined, for example models that have limited capabilities for generating harms that are difficult to mitigate once created, such as sophisticated disinformation and malicious code. While the EU AI Act defines model risk by computation required by training, this metric can be insufficient for local AI models given the extent to which its capability to generate harmful outputs can be increased with limited additional resources. Risk-level assessment should therefore incorporate capability benchmarking and “red teaming,” where experts simulate misuse to test potential risks [189,190].

The safe-harbor concept has recently been implemented in the area of cybersecurity [191]. For example, in Ohio, organizations that implement reasonable security controls and appropriately respond to security incidents can avoid liability for data breaches [192]. Cybersecurity safe harbors have spread to other states like Utah [193], although this model has encountered criticism that it simply leads to blanket immunity for powerful corporate actors rather than providing incentives to protect consumers.

The liability shield of the local AI safe harbor would extend to actors who act in good faith and follow clearly defined reasonable safety precautions. Model developers can be obligated, for example, to implement protection against prompts intended to circumvent safety alignment (“jailbreaking”), mitigate harmful bias in outputs, clearly document model capabilities, proactively identify foreseeable risks, and satisfy community-based standards for responsible model release. Downstream users and application developers can benefit from safe harbor when they comply with standards for responsible development and use by, for example, adhering to developers’ safety guidelines set forth in open-source licenses and model repositories, complying with community norms and standards, and implementing reasonable precautions to prevent direct harm or misuse.

The definition of “reasonable development and use” can start from the basis of established global standards for AI use, such as the OECD’s AI Principles, first developed in 2019 and most recently updated in 2024 (the most recent version of the OECD AI Principles is available online at https://www.oecd.org/en/topics/sub-issues/ai-principles.html (accessed on 6 July 2025)) [194]. The revised OECD principles include inclusive growth, sustainable development, and well-being; human rights and democratic values, including fairness and policy; transparency and explainability; robustness, security, and safety; and accountability. In practice, reasonable development ought to mean demonstrating adherence to these principles through documented practices and outcomes. Going forward, the participatory mechanisms described previously in this section should be utilized to establish a consensus and develop practical, actionable, and reasonable development standards.

Developers and users who qualify for safe-harbor provisions would be able to operate with greater legal certainty, encouraging the release of innovative tools without the chilling effect of potential liability. The safe-harbor framework could thus incentivize developers both to invite broader community engagement in their work and take accountability for unintentional downstream harms without fearing legal consequences. Worrying about liability is a key reason why actors in the AI supply chain tend to defer accountability to others. Removing that fear creates space for a shared framework of AI accountability and encourages discussion and collaboration across different stages of development and deployment.

Implementing safe harbors raises real-world challenges. It will be difficult to establish a community consensus that can provide guiding ethical principles and, in turn, rigorously define AI best practices. The degree of safe-harbor protection should be tailored to the role and expected knowledge level of the actors in the AI supply chain—whether implementers who may not be expected to understand the inner workings of models, intermediate model fine-tuners who may be changing alignment, or foundational model developers responsible for creating code, pretraining, and initial alignment. Another critical and difficult question is who defines and regulates the conditions for safe harbor. In early 2025, legislation was introduced in California to provide safe harbor from civil liability for AI model developers. Under the bill’s terms, model developers qualify for safe harbor only when they voluntarily submit to oversight by a “multistakeholder regulatory organization” (MRO) designated by the state Attorney General (SB813, https://calmatters.digitaldemocracy.org/bills/ca_202520260sb813 (accessed on 4 June 2025)) [195].

The California bill appears similar to the safe-harbor proposal in this paper, although it applies only to model developers rather than extending across the AI supply chain. Important questions remain that the legislation fails to answer. Who will sit on the governing boards of MROs? Will they be dominated by Big Tech company interests or academic researchers, or will they truly invite community participation? Are there legal guardrails to prevent regulatory capture? If the MRO fails to anticipate risks, does liability shift back to the actor who relied on the MRO-approved certification? These questions must be addressed through a deliberative community-led approach if the safe-harbor concept is to realize its promise.

As discussed throughout this paper, any legitimate governance process will most likely fail unless it engages individuals, companies, and institutions involved in all the aspects of AI: its technical development, commercialization, use, and all who are affected by its use. One of the key challenges within the local AI ecosystem is that, if any actors believe they could face liability, they may choose to withdraw from public discourse and conceal their work with AI. AI development would continue but in the shadows, amplifying the danger of more widespread and severe harms. The conceptual safe-harbor proposal presented here offers a practical space for the deliberate development of effective and legitimate AI governance during a period in which AI technology and adoption are rapidly evolving.

7. Conclusions

Local AI promises democratic access to AI without depending on corporate or government interests. As local AI becomes more powerful, however, the governance gaps it creates will increase the risk of harm from unregulated use.

Table 1. Benefits and corresponding risks of local AI.

Aspect	Key Benefit	Corresponding Risk
Privacy	Data remain on-device	Reduced external audit and traceability
Autonomy	Freedom from platform gatekeeping	Loss of centrally enforced guardrails
Cost and access	One-time or low cost democratizes use	Wider spread of uncensored models
Customizability	Easy fine-tuning for local needs	Safety alignment can be stripped
Innovation and equity	Broader participation in AI R&D	Malicious actors gain powerful tools

summarizes how local deployment amplifies privacy and autonomy while simultaneously weakening traditional oversight mechanisms. Local deployment makes it easier for malicious users to bypass technical safety restrictions and harder for regulators to police usage. Even so, local AI should not be seen as detracting from AI ethics or as somehow preventing the adoption of fair and just AI rules. Consequently, AI governance frameworks designed for the realities of local deployment are urgently needed.

This paper provides potential technological and policy responses to the challenges posed by local AI that together define a multilayered strategy.

Table 2. Multilayered and interconnected governance responses for local AI.

Governance Focus	Technical Safeguard	Policy/Process Measure
Content authenticity	Provenance and watermark toolkits	Voluntary community labeling norms
Runtime boundaries	User-configurable ethical runtime env.	Safe-harbor tied to compliance
Open-source oversight	Automated repo monitoring	Polycentric and participatory bodies
Liability and incentives	Audit logs for model releases	Multistakeholder safe-harbor schemes
Cross-jurisdiction coordination	Modular open tools	Distributed polycentric frameworks

summarizes how the technical and policy responses proposed in Section 6 of this paper are interlinked with potential AI risks.

To be clear, the proposals described in this paper are not offered as a comprehensive or fully developed solution. They are instead intended as a conceptual starting point for reenvisioning technical safety and regulatory measures to address the distinct risks of local AI while advancing its values of pluralism, autonomy, and decentralized control. The feasibility of implementing the policy proposals depends on political will, coordination among a wide range of stakeholders, and the capacity of institutions and infrastructure, as well as the community’s level of trust in them. Notably, the technical proposals presented here are limited by the practical constraints of computational overhead, evolving adversarial methods, and the difficulty of reliably detecting harmful content or usage in decentralized deployments. Furthermore, to ensure adoption, technical measures require community participation and policy interventions, such as liability safe harbor and community-led development.

The analysis in this paper is inevitably limited by the rapid evolution of AI capabilities and regulatory landscapes. Improvements in technology and shifts in public views of AI correspondingly affect the assumptions underlying safety measures. These constraints should guide future work towards more grounded empirical analysis of both technical and policy safety measures. One particular obstacle to developing appropriate policy responses is that the use of local AI is hard to track and assess. It is incumbent on researchers, government agencies, and civil society organizations to establish privacy-preserving mechanisms to document and share information about the use and misuse of local AI. Such empirical evidence will be critical for refining governance frameworks.

The most important takeaway from this paper should be that a community-driven participatory approach is necessary to develop responsible local AI principles and concrete policies. That is why formal institutional policymakers should adopt measures to draw developers and users of local AI into policy discourse, including accepting potential risk (and loss of perceived authority) by offering them safe harbor from the unintended consequences of AI applications. Ultimately, researchers, policymakers, technologists, and communities must urgently recognize that local AI is going to be part of the AI future. By working together, stakeholders can innovate governance mechanisms that account for the unique technological and enforcement challenges posed by local AI. It is only through inclusive and adaptive governance that the benefits of local AI can be harnessed while managing its risks.