Le texte de l’ouvrage est en anglais, tel qu’il a été écrit ; seule l’interface du site est en français.

7. Institutions equipped with AI, governed by humans

Chapitre 7 sur 15 · ≈ 12 min de lecture · 26 paragraphes · 13ᵉ des 40 sections de lecture · rechercher dans l’ouvrage

Certifying a model attests to its technical compliance, not to the legitimacy of the decision it informs: the latter remains human, reasoned and contestable.

Certifying a model attests to its technical compliance, not to the legitimacy of the decision it informs: the latter remains human, reasoned and contestable. This distinction separates assurance of the sociotechnical system from mere algorithmic compliance.¶ 1

Each of the institutions examined in section 3 was designed before artificial intelligence; each today incorporates it after the fact, cautiously and unevenly. The architecture proposed here is, to my knowledge (subject to the priority-claim caveat stated in §7.4), among the first governance architectures natively designed for the AI era — which does not mean “with more technology”, but with a constitutional doctrine for it. That doctrine fits in a single sentence, and it appears in every pipeline of section 5: AI signals; an accountable human decides.¶ 2

One constitutional formula, three named expressions — the operational signature (a named analyst signs every rating, Section 5.3), the architectural doctrine (no system in the architecture takes a binding decision, present section), and parliamentary legitimation (elected representatives ratify the standards under which certification operates, Section 5.7). Three altitudes of a single rule, not three rules.¶ 3

What the architecture uses AI for. Five functions, in increasing order of sensitivity. Large-scale measurement: the continuous, entity-level coverage across the twenty families provided by the measurement body is not feasible manually without automated processing of declarations, of satellite and sensor data, and of text — it is this function that makes a permanent HuIB financially possible, whereas the IPCC’s five- to seven-year assessment rhythm marks the pre-AI frontier. Detection and alert: the rating authority’s linter flags anomalies and class jumps; the border mechanism screens declarations; the fund detects fraud and double financing; the digital authority’s watch observes deployed systems along six separately published dimensions. Systemic coherence: an inter-institutional linter audits the architecture’s own interfaces in search of contradictions — a practice which, applied adversarially from the design phase itself, brought to light the tensions recorded in Section 13. Assisted deliberation: consultations on model laws rely on a certified deliberative infrastructure in the lineage of vTaiwan, where preference-mapping algorithms help mass publics converge without deciding in their stead. Litigation assistance: the Court’s evidence engine — a contestable assistant, never a judge.¶ 4

What the architecture forbids AI to do. The negative list is constitutional, not technical. No system in the architecture may take a decision that binds a party: every rating carries the named signature of a human being, every allocation a committee decision, every adjustment a computation under human control, every judgment a judicial bench. No social scoring of individuals, anywhere, for any purpose whatsoever. No content censorship: the watch measures effects and issues alerts; it never orders a takedown. No recommendation of a vote or of a position to any deliberative body whatsoever. And no automatic execution of consequences: an alert signal issued by a machine opens a procedure; it never closes one.¶ 5

And one upstream risk is named rather than presumed: AI-driven measurement under-covers the least digitised populations — precisely the beneficiaries the architecture is aimed at. The representativeness test provided for by the data governance matrix (Section 7.4) is therefore a certification criterion, not a mere courtesy; provenance, legal basis, the cybersecurity of evidence vaults and retention rules apply upstream of every pipeline. A second upstream risk deserves to be named in the same way: trained on the world as it is, these systems lean towards precedent and recognise the novel case poorly — a status quo bias which, in bodies called upon to measure and to rate harms that are still poorly mapped, makes the human lock (“AI signals, the human decides”) decisive rather than formal. We are not in the age of super-intelligence, but in that of powerful and fallible tools; the automation indicators of Section 7.5 — foremost among them human-machine disagreement rates — exist precisely so that this lock remains an auditable fact, not a mere formality.¶ 6

Who certifies the certifiers. The architecture’s distinctive move is reflexive: the algorithms of its own institutions — the rating pipeline, the contribution scales, the allocation engine, the adjustment computations — are themselves subject to the digital authority’s three-level certification regime, from self-declaration through to external audit with judicial review at the highest level, where self-certification is quite simply prohibited. Methodologies and capping matrices are versioned, so that any historical result can be faithfully recomputed according to the method that produced it; every pipeline publishes its weightings; and every AI-assisted result is contestable by the party it affects, through the adversarial steps of Section 5 and, in the last resort, before the Court. An architecture that proposes to certify the world’s algorithms first submits its own to democratic certification — reflexivity is the proof of seriousness.¶ 7

The regress closes upon the certifier itself: the digital authority’s own pipelines — the watch and the model-law factory — are placed, by construction, in that highest level, certified by external audit and subject to review by the Court, never self-declared; and the authority’s budget is ring-fenced under the same non-circularity rule as those of the fund and of the Court (P6), so that the certifier does not self-certify and is not paid by those it certifies.¶ 8

How this extends beyond the architecture itself. Three consequences follow. First, cost: continuous global measurement, that historic impossibility which explains much of the dashboard landscape described in Section 3, becomes affordable — the budget of the measurement layer is counted in millions, whereas its option value is counted in trillions. Second, symmetry: AI lowers the analytical barrier to entry, so that a small treasury can query the same measurement layer as a large one — the architecture’s equity commitment applied to analytical capacity itself. Third, speed: nowcasting replaces retrospection, which allows a stability window to disburse in the face of a shock rather than in the face of its autopsy. Against these gains stands a dependency honestly acknowledged: the architecture’s pipelines rely on models built by a concentrated industry. The design responds with plurality (no dependency on a single model), full auditability, and a degraded mode specified at the level of each family (Section 7.5) — the measurement body falls back on annual sampling campaigns in its priority domains; the rating authority, on event-triggered reviews of its highest-impact entities; the operational institutions, on manual handling of declared cases according to published queues; the Court’s evidence engine, on a registry-type procedure — each institution continuing to function, more slowly and more narrowly, without its machine layer — but the dependency is real, and itself constitutes an externality of the kind that the taxonomy of Section 2.2 classifies under technology-mediated concentration.¶ 9

The direction a technology takes is in no way automatic: it depends on who controls it, and it can concentrate power just as readily as it can share it (Acemoglu et Johnson, 2023). Artificial intelligence is no exception — it can deepen the asymmetry between those who deploy it and those who are subjected to it, or it can serve their accountability. That is the point of the digital authority and of democratic certification (§5.7): not to slow technology down, but to make its direction an object of collective choice rather than a fait accompli — algorithms submitting to peoples, and not the reverse.¶ 10

7.1 Assurance, cost and degraded operation

The claim that continuous measurement can be operated for millions rather than billions is a hypothesis to be costed. The cost model must include licences and data access, cloud and secure-computing infrastructure, model development, human review, translation, redress, cybersecurity, archival reproducibility, independent audits and support for low-capacity users. It should publish low, central and high scenarios, and identify which functions survive at minimum viable scale.¶ 11

7.2 Threat model and non-propagation controls

Télécharger ce tableau (CSV)

7.3 Authority matrix: beyond the “human in the loop”

Algorithmic authority is classified by verb: search, summarise, measure, rank, recommend, flag, compute, block and execute. Search and summarisation require traceable citations; measurement requires validation and quantified uncertainty; ranking and recommendation require bias and sensitivity tests; flags may open but never close a procedure; computations require formal verification and reproducibility; blocking and execution are prohibited without an authorised human decision and without an accessible emergency avenue of redress. Every signatory records the time spent, the evidence examined, the override decisions and their reasons. Human oversight is thus a demonstrated capability, not a signature ritual (NIST, 2023; ISO/IEC, 2023).¶ 12

7.4 Data governance matrix

Télécharger ce tableau (CSV)

The degraded mode is not mere manual continuity. For each pipeline, it must specify the trigger for model suspension, the last reliable version, human capacity, the reduced service level, queue prioritisation, the resumption authority and public notice. No result produced in degraded mode should silently inherit the confidence level of normal operation.¶ 13

PRIORITY-CLAIM DISCIPLINE. “Natively designed for the AI era” describes the architecture’s intention. It is not a claim of world priority unless supported by a systematic review of comparable institutional proposals.¶ 14

The contrast with the current global response to AI completes the argument. At the universal level, the institutional response to artificial intelligence remains primarily scientific and deliberative — an advisory scientific panel and voluntary principles. The landscape is not, for all that, devoid of binding rules: the European Union has adopted an AI regulation, and the Council of Europe has opened for signature the first legally binding international treaty in this field. But these frameworks, regional and sectoral, do not close the chain: what is missing, at global scale, is an arrangement linking impact measurement, democratic certification, consequence and redress — diagnosis and language, once again, without a chain of consequence. This architecture proposes the reverse: not a new debating chamber on AI, but operational institutions whose every use of AI is certified, versioned, contestable and justiciable. The way to govern a technology, in the light of all the precedents cited in this document, is not to admire the problem; it is to build institutions that use it under discipline. No AI system can produce a moral, legal or religious qualification having binding force: it organises the evidence, detects inconsistencies and simulates consequences; normative authority remains human, pluralist and contestable.¶ 15

7.5 Building the seven institutions with AI — and the safeguards above the build

The preceding sub-sections state what the architecture’s AI may and may not do. This one states how the seven institutions are actually built — for the claim that they are “AI-native” is not prospective: it describes a build method already in use.¶ 16

The method has been tested on the architecture itself. Every component of the design in this document has passed through an AI-assisted build under human decision: build-ready specifications for each institution’s platform (modules, workflows, data contracts); an inter-institutional coherence linter which audits mandates and interfaces against the canon and flags contradictions (it brought to light several of the tensions recorded in Section 13); a full-scale adversarial simulation exercise in which independently briefed teams played each institution against realistic cases; a thirteen-angle adversarial audit of the quantitative corpus over two cycles (Box 2); and a multi-perspective expert review covering economics, law, governance, methodology and editorial work. The forthcoming methodological document sets out this process; its outcome is already visible in the register of tensions and in the evidence pack of this text.¶ 17

The same method is now unfolding, institution by institution, in four stages: specification (a build-ready set of requirements per institution — all seven exist); prototype (an internal reference implementation of the complete measure→rate→price→adjust→finance→certify→adjudicate chain has been developed under human decision and runs under several hundred internal automated tests, with the doctrinal rules — severity caps, non-compensable exclusions, anti-double-jeopardy register — enforced in the code; these results constitute internal validation, not yet published or independently replicated, and will be documented in a dedicated technical companion); sectoral pilot (the minimum viable pilot of Section 12.4, on volunteer jurisdictions and public data); and hardening with a view to entry into operation. The honest status marker of Section 5 therefore remains valid, with one refinement: specified, internally prototyped and pilot-ready — not yet in operation, nor independently validated.¶ 18

What each institution’s build actually contains — and where the human lock sits — is summarised below.¶ 19

Télécharger ce tableau (CSV)

The safeguards sit above the build, not alongside it. Every system in the table operates under the constitutional envelope of the present section: the negative list, upstream as well as downstream; the verb-level authority matrix (Section 7.3); the data governance matrix (Section 7.4); three-tier reflexive certification, closed upon the certifier itself; family-level degraded mode; and a named human signature at every binding lock. And the build adds a discipline that constitutional text alone cannot provide: published automation indicators — human-machine disagreement rates, minimum review times, false-positive and challenge volumes, by institution and by quarter — so that “a human decides” remains an auditable fact about the system rather than a legal fiction about it. An institution whose analysts never disagree with their machines is not assisted; it is replaced — and the indicators are designed to detect precisely that.¶ 20

These indicators constitute a standing obligation, not a discretionary courtesy. An institution unable to publish them quite simply fails to meet the condition required to operate an automated lock: in the absence of disagreement rates, review times and challenge volumes, “a human decides” is an assertion rather than a demonstrated fact, and the automation it describes is, by construction, unaudited. Publication is therefore treated as constitutive of the safeguard, and not as a mere report about it.¶ 21

“An architecture’s worth lies not in the elegance of its design, but in what it preserves, corrects and allows to be contested when a real case passes through it.”¶ 22

PART III — PUTTING THE CHAIN TO THE TEST¶ 23

This part puts the chain to the test on four successive terrains — an integrated demonstrator, monetary spillovers, development finance, then preventive peace and crisis resilience — in order to verify that it holds otherwise than in principle.¶ 24

Differentiated status of the applications. The four applications that follow have neither the same object nor the same level of proof. They do not add up to produce an overall validation of the chain. The data centre tests the internal coherence of the interfaces; the monetary case constitutes the principal empirical and methodological programme, still awaiting full causal estimation; Sevilla is an operational application intended to test the actionability of a portfolio; preventive peace is an exploratory extension grounded in a theory of change. Success in one domain does not automatically validate the others.¶ 25

Scope rule. The framework must be applied where the effect crosses jurisdictions or generations, where several distinct transformations separate knowledge from response, where responsibilities are dispersed and where a right of challenge can be organised. It is not necessary where an existing mechanism already covers evidence, decision, enforcement and redress at lower cost, nor where uncertainty is such that no contestable attribution can be constructed.¶ 26

@incollection{yaiche_hc_chapitre_7,
  author    = {Yaïche, Nizar},
  title     = {7. Institutions equipped with AI, governed by humans},
  booktitle = {The Humanity Compact},
  year      = {2026},
  version   = {2.3},
  doi       = {10.5281/zenodo.22746533},
  publisher = {Zenodo},
  url       = {https://humanitycompact.org/ouvrage/chapitre-7/}
}

Ouvrage de Nizar Yaïche, ancien ministre des Finances de la République tunisienne. Qui est l’auteur ?