Policy Significance Statement
The implications of the study for policymakers are as follows:
-
1. On the one hand, companies that follow this framework can shorten the time for technology release and application, which helps to avoid profit loss caused by long review periods. On the other hand, governments can use this framework to address the potential delay and static nature of traditional governance schemes.
-
2. Using Bayesian networks for risk assessment allows regulators to make targeted interventions and improve regulatory efficiency. At the same time, applying Bayesian networks to AI governance together with regulatory sandboxes and full-cycle human oversight provides triple protection for AI governance.
-
3. It assists in supporting responsible prediction and decision-making processes.
-
4. The explainable and adaptive AI governance approach has three important meanings for AI governance. First, it can provide an inclusive governance path. Second, it can supplement static governance strategies. Third, it can automatically generate explainable value alignment schemes.
1. Introduction
At present, artificial intelligence is widely applied in important areas such as healthcare, manufacturing, education, and finance. It has become a key factor in improving national strength and driving economic development. At the same time, it has also raised many discussions on topics such as transparency and trustworthiness, safety and reliability, bias, fairness, responsibility, and privacy. In light of this, it is important to maintain a balance between AI innovation and AI governance.
In recent years, the European Union, the United States, China, Germany, and Singapore have introduced policies on AI governance and made some progress. China has clearly stated the need to balance AI governance and innovation. In July 2023, China’s Cyberspace Administration, National Development and Reform Commission, Ministry of Education, Ministry of Science and Technology, Ministry of Industry and Information Technology, Ministry of Public Security, and National Radio and Television Administration issued the Interim Measures for the Administration of Generative AI Services (https://www.gov.cn/zhengce/zhengceku/202307/content_6891752.htm). It clearly stated that “the country adheres to the principle of giving equal importance to development and security and combining the promotion of innovation with governance according to law. Effective measures will be taken to encourage the innovative development of generative AI. Generative AI services will be supervised in an inclusive, prudent, and classified manner.”
In December 2024, the China Academy of Information and Communications Technology published the Blue Book of AI Governance (https://www.caict.ac.cn/kxyj/qwfb/bps/202412/P020241227660032159191.pdf). In the fourth part, “Deepening the Implementation of Collaborative and Agile AI Governance Models,” it clearly requires “to coordinate development and security. Agile governance should be used to balance multiple goals. Past growth that sacrificed security should be avoided, and strict regulation that suppresses innovation should also be avoided. Relevant institutions are supported to collaborate in basic innovation, data sharing, application empowerment, and risk prevention.”
Although balancing AI innovation and AI governance has received wide attention, how can AI innovation and AI governance be balanced? What are the ways to achieve this balance? What difficulties do existing solutions face? How can these difficulties be resolved? These questions still need further examination.
At present, some solutions have been proposed to balance AI governance and AI innovation. These solutions may achieve multiple forms of collaboration. For example, flexible international organisations can be established to improve adaptability and quick response. Existing ethical laws can also be applied to technology (Ricciardi, Reference Ricciardi2023). There are also specific ethical governance applications, such as health technology assessment (Carapinha et al., Reference Carapinha, Botes and Carapinha2024). In addition, the European Union has transformed AI-related ethical principles into a design tool in the form of a checklist. This tool can dynamically evaluate whether AI projects are compatible with ethical principles (Ricciardi, Reference Ricciardi2023).
In fact, whether based on principle-based solutions or practical solutions, balancing AI governance and AI innovation still faces challenges. For example, there is a lack of clear digital definitions for AI ethical principles. Some scholars have made attempts, such as applying digital principles to different digital technologies (Liu et al., Reference Liu, Zheng and Su2024). Based on a review of the current balance solutions, this study proposes a new approach. It uses causal models to enhance decision explainability and to speed up the governance process.
The research reported in this study differs from previous similar work in that it improves the explainability of automated governance and advocates a human-led, machine-assisted governance model. Essentially, it generates risk probabilities and governance recommendations by introducing a risk management framework and existing experience-based solutions.
However, people may be concerned that this automated approach could have negative effects on the labour market, creating new ethical issues. In fact, the approach proposed in this study is designed to support rather than replace human governance staff. It aims to establish an intelligent assessment system that is complementary to humans and does not compete with them.
The paper is organised as follows. The first part introduces the background. The second part reviews existing AI governance and AI innovation approaches and their limitations. The third part proposes an explainable automated review approach. Using a Bayesian network as an example, it discusses a human-assisted AI risk governance framework based on the Bayesian network and explains its rationale and significance. The conclusion summarises the paper and states that the main purpose of the automated assisted governance framework is to improve transparency and accelerate the governance process.
2. Solutions for balancing AI innovation and AI governance and their issues
The relationship between innovation and regulation often shows tension. However, it is crucial to maintain a balance between technological innovation and governance. Too little supervision can lead to the accumulation of risks, while too much supervision may stifle innovation. Therefore, it is necessary to develop a regulatory framework that adapts to technological innovation.
Overall, current solutions on this topic can be mainly divided into two types: principle-based solutions and practical solutions.
2.1. Principle-based solutions: adapting governance to practice
Principle-based solutions for balancing AI governance and AI innovation refer to guidance that includes policies, laws, technical standards (Cantero and Marsden, Reference Cantero and Marsden2024; Segate, Reference Segate2024), corporate plans, technical manuals, and academic research programmes. These principle-based solutions generally follow the idea that governance should adapt to practical development. They mainly include two types of adaptation principles: process-based adaptation and top-down adaptation.
2.1.1. Process-based adaptation principle
The process-based adaptation principle refers to consciously adapting AI ethics during the technology design process. This mainly involves the development stage of technical staff. It requires technical staff to balance technology and ethics consciously, and also requires external regulation and incentives for them. External regulation of technical staff in the process mainly includes educational standards, reward and punishment mechanisms, and public accountability.
First is the educational standards. Some scholars suggest embedding ethics into AI teaching to help students reflect on the possible social impacts of AI and to improve moral awareness (Horton et al., Reference Horton, McIlraith, Wang, Majedi, McClure and Wald2022; Williams et al., Reference Williams, Ali, Devasia, DiPaola, Hong, Kaputsos and Breazeal2023; Reference Zhang, Lee, Ali, DiPaola, Cheng and BreazealZhang et al., Reference Zhang, Lee, Ali, DiPaola, Cheng and Breazeal2023). These practices mean that engineers can be taught ethical principles during learning or practical application to prevent them from unknowingly violating basic human rights.
In addition, process-based balance solutions also include rewards and punishments for technical staff. To prevent these regulations from overly restricting technological innovation, the government can introduce bonus incentive policies for companies that prioritise ethics, transparency, and safety. For example, some scholars advocate that government policies for responsible artificial intelligence innovation should include ethical incentives for technical staff, mechanisms to reward whistleblowers, and adaptive incentive programmes (Baldassarre et al., Reference Baldassarre, Caivano, Nieto and Ragone2025).
Finally, there is public accountability (Loi and Spielkamp, Reference Loi and Spielkamp2021), which reflects democratic governance. Therefore, implementing public accountability can also serve as an external regulation method for technical staff.
It is reasonable to provide internal and external regulation for technical staff because, from their perspective, the importance of balancing innovation and governance is proportional to the level of public reliance on AI. In addition, according to Lawrence Lessig, the Internet creates a form of privilege and makes this privilege possible (Dávila et al., Reference Dávila, De, Lessig and Perrone2023). Some studies also show that algorithmic bias comes from limited data sets and biased algorithm designers (Chen, Reference Chen2023). Therefore, given that technical staff have the privilege to set network rules and can produce significant impacts, it is necessary to regulate this privilege during the AI design process.
2.1.2. Top-down adaptation principle
The top-down adaptation principle mainly comes from government regulatory proposals. Its balanced approach is that regulatory mechanisms are updated as technology evolves. This adaptability is expressed in two forms: specific regulation and uniform regulation. Specific regulation is based on the analysis of each situation. It is targeted and includes risk-proportionate regulation (Akinsuru and Iseoluwa, Reference Akinsuru and Iseoluwa2025), targeted regulation (Ghimire and Edwards, Reference Ghimire and Edwards2024), and interdisciplinary regulation (Bringas et al., Reference Bringas, Nannini, Rieger, Scott, Zhao, Patro and Kinder2022; Pfeiffer et al., Reference Pfeiffer, Gutschow, Haas, Möslein, Maspfuhl, Borgers and Alpsancar2023; Patel et al., Reference Patel, Gu, Esper, Maeser and Maeser2024).
Uniform regulation has compatibility. First, it involves active participation in global and cross-field dialogue. For example, regulatory agencies continuously reflect, adapt, and improve while cooperating to develop AI guidelines (Akinrinola et al., Reference Akinrinola, Okoye, Ofodile and Ugochukwu2024). This can be considered a complex governance situation or establish a collaborative network that combines government authority with industry expertise, creating highly adaptive and responsive dynamic laws (Walter, Reference Walter2024). Second, it provides unified or sustainable solutions. For example, it may suggest achieving uniform international AI regulations, emphasising public participation and international cooperation (Kashefi et al., Reference Kashefi, Kashefi and Ghafouri2024), building sustainable AI regulations (Hacker, Reference Hacker2024), or adopting a joint AI governance approach that places bioethical principles at the core of AI rules (Fessenko and Jasperse, Reference Fessenko and Jasperse2025).
Although these principles highlight the key issue that AI governance should be flexible and adaptive, the characteristics of such technology governance and AI supervision solutions are mainly based on traditional human governance. They may still face problems such as long governance cycles, neglect of key issues, delays, and a lack of dynamic tracking. This is determined by the long governance cycles and the uncertainty of risks brought by emerging technologies.
2.2. Practical solutions: Ethically engineered balance solutions
Balance solutions for governance and innovation to achieve a shift from principles to tools. Unlike principle-based solutions for balancing AI innovation and AI governance, ethically engineered solutions use technical means to balance AI innovation and AI governance. They are also called computational ethics (Poszler et al., Reference Poszler, Portmann and Lütge2025) and emphasise incorporating ethical principles into the engineering design process.
Ethically engineered solutions have experienced a shift from the “need for ethical engineering” to the “application of ethical engineering.” For example, the Belmont Report, proposed in the late 1970s, promoted the development of medical ethics. In recent years, to maintain a balance between innovation and moral responsibility, a hybrid technical solution has been proposed in the medical field. It provides additional protective technologies, including blockchain, federated learning, homomorphic encryption, and differential privacy. Differential privacy was originally introduced by Reza Shokri and Vitaly Shmatikov (Yanamala et al., Reference Yanamala, Suryadevara and Kalli2024). Similar research has also been applied in other fields with related ethical requirements.
The role of ethically engineered balance solutions is to address ethical issues from the source. Engineers who lack ethical consideration may face damage to their own interests and social condemnation. Historical cases show that ignoring engineering ethics can lead to scandals. For example, the tragedy of the Boeing 737 MAX crashes revealed the impact of a culture that prioritises profit over safety (Chary, Reference Chary2024). Since ethical governance issues can be traced back to engineering design, it is crucial for engineers to predict the ethical impacts of emerging technologies because this can serve as an effective preventive measure. Scholars such as Janna van Grunsven have suggested that responsible anticipation should be cultivated in engineering ethics education. Furthermore, some scholars argue that engineering ethics must involve the field of empirical moral psychology (Clancy and Gammon, Reference Clancy and Gammon2021). In addition, some countries and institutions have gradually attached importance to engineering ethics. For example, the American Society of Civil Engineers, the American Society of Mechanical Engineers, and the National Society of Professional Engineers all place the moral principle of serving the public first. Engineers themselves also called for the protection of public safety, health, and welfare (Smith et al., Reference Smith, Zhu, Smith and Mitcham2021) after World War II. Engineers Canada has also proposed Professional Engineering Codes of Ethics (Randall and Strong, Reference Randall and Strong2021).
Based on current practical solutions for ethically engineered approaches, they mainly include embedded ethics (McLennan et al., Reference McLennan, Fiske, Tigard, Müller, Haddadin and Buyx2022) and responsible design (Lu et al., Reference Lu, Zhu, Xu, Whittle and Xing2022).
Embedded ethics refers to integrating ethics into a specific area of AI development, focusing on ethical technical research. For example, it involves integrating technical strategies in fields such as healthcare (Tahir et al., Reference Tahir, Rashid, Hadi, Ahmad, Cao, Alshara and Javed2024), finance (Joseph, Reference Joseph2024), and communication, including fairness-aware algorithms (Radanliev, Reference Radanliev2025). Currently, there are methods addressing privacy, fairness, and transparency. For example, Bohdan Kovalevskyi proposed a synthetic alignment method to maintain core moral principles, allowing AI to remain flexible across different cultural and application contexts (Kovalevskyi, Reference Kovalevskyi2024).
Responsible design refers to implementing ethical safeguards at all stages of a project life cycle. It focuses on ethical planning throughout the entire engineering design process. Its key point is to strengthen systems of auditability, traceability, and reviewability, and it emphasises supervision, accountability, and transparency (Burr and Leslie, Reference Burr and Leslie2023). It includes correcting algorithmic bias. For example, the AI design ethics method (EbD-AI) adopted by the European Commission as part of its ethical review procedures specifies recommended processes and actions for different stages of AI development (Brey and Dainow, Reference Brey and Dainow2024).
Although ethically engineered approaches have achieved initial results, the practice of engineering ethics is considered inflexible, highly moral-focused, complex, and slow to implement. In addition, this implementation approach currently faces the following challenges.
2.2.1. The conflict between abstract principle requirements and specific practical applications
This mainly appears in two aspects. First, there are difficulties in converting abstract principles into specific applications in terms of completeness, translatability, and explainability. One, embedded ethics is practice-oriented rather than normative and may have some incompleteness (Bleher and Braun, Reference Bleher and Braun2023). Two, it is questioned whether morality can be applied in programming. Three, governance principles and technical practices lack a communication bridge, which leads to few ethical explanations of technology or inaccurate translation of abstract principles into specific practice. Therefore, training interdisciplinary communicators as translation bridges for ethical engineering may help resolve this conflict.
Second, there is no unified standard for guiding principles in ethical engineering practice. On the one hand, this is because moral concepts themselves are uncertain. As Irina Shklovski stated, ethical methods cannot be finalised. Efforts in AI ethics do not end with a clear checklist or a set of principles. They must continuously address new concerns as part of the challenging task of cultivating certainty (Shklovski and Némethy, Reference Shklovski and Némethy2023). This means that ethical concepts are still changing. On the other hand, many ethical concepts are vague, contradictory, and yet similar in meaning. For example, respecting “openness” may conflict with respecting “privacy” (Kazim and Koshiyama, Reference Kazim and Koshiyama2021). The meaning of “explainability” and how to implement it is also unclear (Prem, Reference Prem2025). These uncertainties increase the difficulty of converting principles into practice.
Therefore, it is necessary to ease the conflict between principles and practice. This is a prerequisite for guiding practice. In this regard, governments should further develop clear communication channels and decision-making protocols to propose appropriate ways to mitigate this conflict.
2.2.2. Increased technical costs
Even if the conflict between the principles and technical practices is resolved, there may still be an issue of higher technical costs (Akash et al., Reference Akash, Lessard, Reza and Islam2024). This is because additional technical work is needed. This will increase both the time and financial costs of implementing the technology. For example, the costs of updating and maintaining tools, testing for vulnerabilities by external auditors, salaries, benefits, and training for technical staff, fixing vulnerabilities, upgrading and improving systems, and managing risks (Das et al., Reference Das, Banerjee, Chatterjee and Ghosh2023).
2.2.3. Reduced technical efficiency
For example, consider differential privacy technology. Differential privacy technology also faces some technical problems. This technology usually needs to balance utility and privacy. Generally, the two are inversely related. If accuracy increases, privacy protection decreases, and the opposite is also true. Although it helps prevent linkage attacks and protect privacy, it lacks effective sensitivity values and may affect the reliability of results (Husnoo et al., Reference Husnoo, Anwar, Chakrabortty, Doss and Ryan2021).
It can be seen that although embedding governance principles in the engineering design process is necessary and helps to address the possible delay of principle-based schemes, the ethical engineering approach still faces a fundamental challenge. This challenge is how to balance improving efficiency with embedding AI governance values and principles. Therefore, a neutral approach between technology developers and government officials is needed. This approach needs to address: (1) the delay of AI governance principle schemes, and (2) the efficiency loss caused by considering AI governance in the engineering field.
3. Explainable automated review scheme
Overall, the limitations of principle-based and practice-based schemes are mainly reflected in three key words: time, speed, and cost. Focusing on time can also help improve governance speed and reduce the cost of innovation and governance. Therefore, this article attempts to propose a governance approach that shortens the time cycle to balance AI innovation and AI governance. Using automated tools is an important way to reduce the time cycle. In August 2024, the State Council of China issued the Opinions on Deepening the Implementation of the “Artificial Intelligence Plus” Action (https://www.gov.cn/zhengce/zhengceku/202508/content_7037862.htm). It clearly proposed the concept of “AI+ governance capability.” In Part Two, Article Five, and Part Three, Article Fourteen, it stated: “Create a new vision of human-machine symbiosis in social governance.” “Build a new model of government services that can accurately identify needs, plan services proactively, and manage the whole process intelligently.” “Create a new pattern of safe governance with multiple stakeholders.” “Promote a public safety governance system for natural persons, digital humans, intelligent robots, and other entities.” “Enhance AI-driven monitoring, prediction, simulation, and problem-solving capabilities, and promote intelligent collaborative and precise governance.” “Strengthen government guidance and industry self-discipline, insist on inclusiveness and caution, classify and grade governance, and accelerate the formation of a dynamic, agile, and multi-stakeholder AI governance system.”
The automated governance scheme is called a technical governance system. Automated governance tools are currently in the development stage. They are considered useful political tools because they can improve efficiency, save costs, and identify bias (Ajunwa, Reference Ajunwa2022).
Currently proposed automated governance schemes include ethics-based auditing (EBA) (Mökander et al., Reference Mökander, Morley, Taddeo and Floridi2021) and the use of reinforcement learning to dynamically learn moral rules (Liu et al., Reference Liu, Zheng and Su2024). These automated governance models create conditions for human-machine collaborative governance. However, the black-box problem of artificial neural networks has become a widely recognised technical issue. This raises questions of responsibility in governance. The moral guidelines for artificial intelligence require specificity, clarity, and transparency. This creates the need for an explainable intelligent framework.
This article focuses on using causal models. It explains where they can be applied in governance and what specific processes their implementation will include. It not only describes the connection between principles and automated tools. Here, the emphasis is on using causal models to support regulation, and they can be applied together with other automated models.
First, this is proposed on the premise of acknowledging the limitations of ethical engineering practices. It does not ignore or fully solve these problems. However, shortening the risk review cycle can partly ease the difficulties. Unlike the principle and practice schemes mentioned above, this approach embeds technical models in the governance process. Here, a causal model, the Bayesian network, is used as an example. AI governance laws and regulations are embedded in it to achieve dynamic supervision. Here, the causal model serves as an auxiliary tool for AI governance.
3.1. Considering Bayesian networks as a tool for AI regulation
A Bayesian network is a belief model that can infer the probability of unknown events based on known information. It can also adjust or update its structure according to new data. By building conditional or causal probability relationships between existing variables, it can reason, predict, and help decide the best options. Bayesian networks can model classification, prediction, decision-making, and data completion. In particular, dynamic Bayesian networks can represent time series data, which means they can make timely and dynamic updates.
In recent years, Bayesian networks have been widely used for risk assessment in different industries (Khan et al., Reference Khan, Yin, Mustafa and Anning2021; Wang et al., Reference Wang, Hu and Pang2025), such as healthcare (Dritsas and Trigka, Reference Dritsas and Trigka2022, climate (Zhang et al., Reference Zhang, Cui, Yao, Guida, Yeboah, Zhou and Liu2025), energy and finance (Wei et al., Reference Wei, Yu and Li2023), and reliability prediction in aircraft operations (Küçüker and Yet, Reference Küçüker and Yet2023). They generally use mathematical models and expert evaluations to identify the influencing factors. They are considered effective in extracting the relationships between risk factors, identifying different risk levels, and achieving higher accuracy (You et al., Reference You, Pan and Zhu2025).
There are two main reasons why it can be used for AI governance. First, there are existing laws and regulations that classify AI risks. Second, there is some governance experience. These factors create conditions for applying Bayesian networks to AI governance. In addition, Bayesian networks are suitable for AI governance because they are explainable, dynamic, and can be automated. They can trace responsibility and perform causal reasoning according to risk levels in laws and regulations. They can also adjust probability estimates and update decision recommendations based on new factors, showing dynamic adaptability. More importantly, they can speed up the governance cycle. From a time perspective, these three features of Bayesian networks meet three current needs in AI governance: (1) governance needs a solid basis; (2) governance needs to adjust dynamically with technological innovation; and (3) governance needs to speed up the cycle to address potential delays.
In general, applying Bayesian networks to AI governance has four advantages: (1) Bayesian networks have causal traceability, and their predictions are reliable; (2) probability assessments help support decision-making by regulators; (3) Bayesian networks can update dynamically to meet the requirements of adaptability and dynamism in governance; and (4) using existing AI laws and regulations as input makes the approach compliant.
However, it is acknowledged that some parts cannot be explained by machines and that there is regulatory uncertainty. As experts improve AI governance principles and quantify evaluation details, the automated governance model will also improve.
3.2. Where to use: The preceding stage of applying Bayesian networks in AI governance
Given the reasoning and prediction functions of Bayesian networks, they can serve as a buffer in this context.
They are used in the stage before the regulatory sandbox. Their main role is to provide risk probability assessment, real-time screening, and decision recommendations. This helps in handling risks in a targeted way.
Its specific practical scheme is shown in Figure 1.
Automated supervision framework based on Bayesian networks.

Figure 1. Long description
The flowchart begins on the far left with five input sources represented by robot icons: ChatGPT, Qwen, Cursor, Claude, and Others. Arrows from these sources point into a large vertical pill-shaped node labeled Bayesian Network.
From the Bayesian Network, two primary paths emerge:
1. A Positive path leads to a node labeled Regulatory Sandbox. This node branches into two outcomes: a True Positive arrow pointing to Technical Rectification (outlined in blue) and a False Positive arrow pointing to Bayesian Network Model Optimization (outlined in green). These two outcomes are grouped under the heading Feedback Process.
2. A Negative path leads to a node labeled Deploy and Social Observation. This node has a single arrow labeled False Negative pointing to a group of three green-outlined boxes: Add New Test Case, Recall Problem Model, and Bayesian Network Model Optimization. These are grouped under the heading Regulatory Process.
Feedback loops are indicated by arrows returning to the start:
- An arrow from Technical Rectification and Bayesian Network Model Optimization (Feedback Process) loops back to the top of the Bayesian Network node.
- An arrow from the Regulatory Process group loops back to the bottom of the Bayesian Network node.
- A separate arrow from the Regulatory Process group also loops back into the Regulatory Sandbox node.
Figure 1 shows the basic process of automated supervision based on Bayesian networks. It specifically includes the following steps:
The Bayesian network estimates the probability of risks in emerging technologies based on prior knowledge. On the one hand, if the assessment result is positive, it indicates that the model is considered risky according to the Bayesian network. After expressing the specific risk level externally, the tested model is transferred to the regulatory sandbox. In the sandbox, the model undergoes a second risk verification using a series of known risk detection methods configured by the government and relevant regulatory agencies. If the sandbox assessment shows a true positive, it means the technology has a risk, and the sandbox result matches the Bayesian network prediction, so corrective measures are needed. If the sandbox assessment shows a false positive, it means the technology currently has no risk. This also indicates that the Bayesian network has a high false positive rate, and the tested model sample should be used as a special noise example to help optimise the Bayesian network.
On the other hand, if the Bayesian network assesses the risk of an emerging artificial intelligence technology as negative, it means the model passes the buffer evaluation and can temporarily enter social use. This requires the Bayesian network to be highly accurate. However, if the tested model is deployed in society and produces feedback indicating a risk, it means the model is a false negative, and the Bayesian network’s previous buffer evaluation was inaccurate. If the model’s stability is guaranteed, this may be caused by an unknown new risk type that is not included in the prior knowledge of the Bayesian network. In this case, the new risk definition must be added to the Bayesian network to optimise the model. The problem model should be recalled from the social environment for technical correction, and probability conditions should be updated based on new experience. At the same time, regulatory authorities and other agencies need to coordinate with the model provider to carry out the technical correction and update the Bayesian network’s prior knowledge according to the new risk type. The new unknown risk type should also be shared with regulatory authorities and included in sandbox test cases to prepare for other models that may be identified as positive by the Bayesian network in the future. These measures help improve the precision and recall of the entire processing chain.
For the government, using the Bayesian network for risk assessment allows regulators to carry out targeted interventions and improve regulatory efficiency. At the same time, applying the Bayesian network in AI governance together with the regulatory sandbox and full-cycle staff oversight provides a triple guarantee for AI governance. For companies, quickly identifying problems and managing them helps new technologies enter the market faster. This also partially offsets the cost losses caused by ethical engineering and long regulatory cycles.
3.3. How to use: Automated risk assessment and decision recommendation with Bayesian networks
In practical use, the regulatory approach of Bayesian networks is as follows. The “qualitative risk levels” in regulations, such as unacceptable risk, high risk, limited risk, and lowest risk, are converted into nodes. The “experience thresholds” accumulated by regulatory authorities during inspections, such as pass rates, are quantified. These two factors are used as the basis for probability distributions to infer the overall risk level of AI.
The use of Bayesian networks to assist AI governance includes, but is not limited to, the following steps:
-
(1) Collect legal and regulatory bases for AI governance and extract qualitative criteria for risk assessment.
-
(2) Convert the regulatory authority’s experience, such as pass rates and violation frequencies, into probability tables.
-
(3) Reflect the legal rules and the experience thresholds from step 2 in the causal relationships of the Bayesian network nodes.
-
(4) Use the Bayesian network to perform probability inference and risk assessment. For example, given a probability value, infer which risk level the AI belongs to and provide corresponding decision suggestions based on the input laws and regulations.
Overall, this model consists of three steps: identification, evaluation, and decision.
First, in the identification stage, in recent years, some scholars have proposed quantitative schemes for ethical governance. For example, Ming Yang combined the EU Artificial Intelligence Act to propose a risk quantification method based on a risk identification matrix. This method can support risk quantification and governance for generative AI (Yang et al., Reference Yang, Wang, Zhang, Jiang and Gao2025). Xiongliang Zeng and others (https://aiig.tsinghua.edu.cn/__local/4/D1/C8/34D4B0D9D06200E10A0BD14D2BE_F4066969_B4F47.pdf) described a formula for risk level calculation: Risk Level (R) = Risk Probability (P) * Risk Severity (L). They proposed a method to measure risk probability, which involves parameters from historical data, the completeness of safety measures, and the quality of datasets. Risk severity relates to factors such as user scale, amount of property loss, and the scope of social impact. Novelli et al. (Reference Novelli, Casolari, Rotolo, Taddeo and Floridi2024) proposed a semi-quantitative method under the framework of the Artificial Intelligence Act (AIA) and international security agreements, based on risk scenarios and proportional quantitative assessment. The progress in risk-based quantitative evaluation provides important criteria for AI risk identification and also improves the transparency of the assessment.
Second, in the assessment stage, reference can be made to the EU Artificial Intelligence Act. This Act divides AI systems into four risk levels: (1) minimal risk; (2) limited risk; (3) high risk; and (4) unacceptable risk. This classification can avoid a one-size-fits-all approach to management.
The minimum risk has no obligation restrictions, such as spam and filtering. Limited risk is related to manipulation and deception. High risk is related to the health, safety, and fundamental rights of natural persons and to environmental impacts. Unacceptable risk is related to human fundamental rights, and its use must be prohibited.
Finally, in the decision stage, some scholars have given decision recommendations for different risks. Szadeczky and Bederna (Reference Szadeczky and Bederna2025) determined different risk management strategies for AI systems, ranging from minimal to high risk based on legal classifications. For minimal risk, general principles, such as human supervision, non-discrimination, and fairness, should be followed. For limited risk, transparency requirements and the provision of necessary labels should be applied. Unacceptable risks should be prohibited. High risks should follow the EU Artificial Intelligence Act, which sets obligations for high-risk systems, including risk identification, testing, and risk mitigation measures. During model training, data governance and management practices should be applied, technical documents drafted and updated, and automated logs maintained (Act EAI, 2024). These measures provide a basis or reference for machine decisions.
For risks that cannot be measured and rely heavily on subjective judgement, the standards for risk assessment can be jointly developed by legal, ethical, and technical experts.
For example, AI that manipulates people using age or the vulnerability of disabled persons is considered an unacceptable risk and must be banned from the market and fined. For high-risk medical diagnostic systems, recommendations include system verification, testing, human review, professional certification, and record keeping. AI, when judged as limited risk, such as AI-generated content, must provide the necessary source information. For example, a game recommendation system can be considered low risk and may be freely used under the Data Protection Act.
For example, if a causal model identifies age discrimination in a company’s use of AI for recruitment, the system will assign a high-risk level and provide corresponding governance advice. This advice may include recommendations based on laws, such as the Employment Age Discrimination Act, or on existing experience, including fines.
3.4. Framework construction and validation
3.4.1. Defining risk variables based on the EU AI Act
The table is shown in Table 1.
Computable variables and regulatory measures mapping table

Table 1. Long description
The table consists of four columns and seventeen rows of data.
* Row 1: Manipulation; Whether the system influences behaviour by using cognitive bias; Art. 5; Ban on release or removal from the market, fines, mandatory correction.
* Row 2: Vulnerability exploitation; Whether the system targets children or disabled groups; Art. 5; Prohibition, compliance review.
* Row 3: Severe rights impact; Whether the system directly harms equality rights or personal rights; Art. 5; Prohibition, legal responsibility.
* Row 4: Health and safety impact; Accident rate, misdiagnosis rate, failure rate; Art. 15; Safety testing, robustness assessment, fail safe protection.
* Row 5: Rights impact; Employment or credit discrimination impact, complaint rate; Art. 9; Risk assessment, rights impact assessment.
* Row 6: System risk; Failure rate, success rate of adversarial attacks; Art. 15; Security strengthening, red team testing.
* Row 7: Scale; Number of affected people normalised; Annex I I I (indirect); Graded deployment, staged release.
* Row 8: Severity; Possible property or rights loss; Art. 9; Preventive control, emergency plan.
* Row 9: Data bias; Fairness difference, suitability, completeness, equality; Art. 10; Bias reduction, reweighting, fairness constraints.
* Row 10: Data quality; Relevance, originality, availability; Art. 10; Data cleaning, label review.
* Row 11: Representativeness; Insufficient coverage index; Art. 10; Expanded sampling, stratified sampling.
* Row 12: Transparency; Disclosure coverage, including whether A I involvement and use limits are explained; Art. 13; Additional instructions for use, mechanism description.
* Row 13: Explainability; Ratio of explainable outputs or explanation success rate; Art. 13; Explanation interface, reports.
* Row 14: Human oversight; Ratio of human review or ability to stop the system; Art. 14; Threshold-based review, one-click stop.
* Row 15: Logging; Coverage rate of key event records; Art. 12; Full logging, audit interface.
* Row 16: Documentation; Completeness rate of documents; Art. 11 forward slash Annex I V; Technical documents, update records.
* Row 17: Risk management; Risk assessment frequency or completion rate; Art. 9; Establish a continuous risk management system.
3.4.2. Taking an intelligent recruitment screening system as an example
This example strictly follows the compliance requirements of the EU AI Act. It presents the full process from legal rule analysis and numerical risk reasoning to the automatic generation of governance suggestions. Relevant calculation steps are also provided to ensure that the results can be reproduced and verified.
First, it is necessary to determine the basic condition for starting the whole risk assessment process. According to Annex III of the EU AI Act, AI systems used for recruitment, staff screening, and promotion are clearly defined as high-risk systems. Therefore, the risk assessment needs to consider risks related to discrimination, non-discrimination, and fairness. More specifically, requirements need to be set for the quality of training, validation, and test datasets. This includes checking historical bias, ensuring data representativeness, adding suitable human review procedures, and taking necessary corrective measures.
Second, the Bayesian network nodes and their parameters used in this example are given in Table 2.
Bayesian network nodes and their parameters

Table 2. Long description
The table consists of four columns and five data rows.
* Row 1: Risk node is Historical data bias (H B). State definition is High or Low. A I A legal rule is Art. 10: Check historical data bias. Prior probability is P(H B equals High) equals 0.60.
* Row 2: Risk node is Data representativeness (D R). State definition is Poor or Good. A I A legal rule is Art. 10: Data should represent the target group. Prior probability is P(D R equals Poor) equals 0.70.
* Row 3: Risk node is Bias mitigation effectiveness (B M). State definition is Ineffective or Effective. A I A legal rule is Art. 10: Appropriate bias mitigation measures should be taken. Prior probability is P(B M equals Ineffective) equals 0.50.
* Row 4: Risk node is Discriminatory outcome (D O). State definition is Likely or Unlikely. A I A legal rule is Art. 9: Risk assessment should consider discrimination risk. Prior probability is Defined by C P T.
* Row 5: Risk node is High-risk determination (H R). State definition is Yes or No. A I A legal rule is Art. 6 and Annex III: High-risk system determination standard. Prior probability is Defined by C P T.
Among these nodes,
$ HB $
,
$ DR $
, and
$ BM $
are root nodes. Their prior probabilities are set based on common bias problems in the industry.
$ DO $
and
$ HR $
are non-root nodes. Their probabilities are determined by their parent nodes and are quantified through conditional probability tables (CPTs). For example, the CPT of the intermediate node “Discriminatory Outcome” is set as follows. When
$ HB= High $
,
$ DR= Poor $
, and
$ BM= Ineffective $
, the probability of a discriminatory outcome is the highest and is set at 0.95. When all three conditions are in ideal states, the probability is the lowest and is set at 0.10. This setting reflects the real situation in which multiple factors together can sharply increase risk.
Finally, conduct a prior risk assessment. Under the default condition, it is necessary to assess the possibility that this intelligent recruitment system may contain potential risks. The state of
$ HR $
is determined only by
$ DO $
. Therefore, the prior probability of the intermediate node “Discriminatory Outcome,” namely
$ P\left( DO= Likely\right) $
, is first calculated. Then,
$ P\left( HR= Yes\right) $
is calculated based on this result.
Since
$ DO $
has three parent nodes, namely
$ HB $
,
$ DR $
, and
$ BM $
, and each node has two states, there are
$ {2}^3=8 $
possible combinations. It is necessary to examine all combinations, calculate the probability of each combination, and calculate the conditional probability that
$ DO $
is Likely under each combination. After that, all results are added together. The calculation process is as Table 3.
The calculation process of the prior probability that the intelligent recruitment screening system produces discriminatory results

Table 3. Long description
The table consists of seven columns: Combo I D, H B, D R, B M, P (Combo), P (D O = Likely | Combo), and Contribution.
* Row 1: Combo 1, H B High, D R Poor, B M Ineffective, P (Combo) 0.6 times 0.7 times 0.5 = 0.21, P (D O = Likely | Combo) 0.95, Contribution 0.21 times 0.95 = 0.1995.
* Row 2: Combo 2, H B High, D R Poor, B M Effective, P (Combo) 0.6 times 0.7 times 0.5 = 0.21, P (D O = Likely | Combo) 0.70, Contribution 0.21 times 0.70 = 0.1470.
* Row 3: Combo 3, H B High, D R Good, B M Ineffective, P (Combo) 0.6 times 0.3 times 0.5 = 0.09, P (D O = Likely | Combo) 0.60, Contribution 0.09 times 0.60 = 0.0540.
* Row 4: Combo 4, H B High, D R Good, B M Effective, P (Combo) 0.6 times 0.3 times 0.5 = 0.09, P (D O = Likely | Combo) 0.40, Contribution 0.09 times 0.40 = 0.0360.
* Row 5: Combo 5, H B Low, D R Poor, B M Ineffective, P (Combo) 0.4 times 0.7 times 0.5 = 0.14, P (D O = Likely | Combo) 0.50, Contribution 0.14 times 0.50 = 0.0700.
* Row 6: Combo 6, H B Low, D R Poor, B M Effective, P (Combo) 0.4 times 0.7 times 0.5 = 0.14, P (D O = Likely | Combo) 0.30, Contribution 0.14 times 0.30 = 0.0420.
* Row 7: Combo 7, H B Low, D R Good, B M Ineffective, P (Combo) 0.4 times 0.3 times 0.5 = 0.06, P (D O = Likely | Combo) 0.30, Contribution 0.06 times 0.30 = 0.0180.
* Row 8: Combo 8, H B Low, D R Good, B M Effective, P (Combo) 0.4 times 0.3 times 0.5 = 0.06, P (D O = Likely | Combo) 0.10, Contribution 0.06 times 0.10 = 0.0060.
* Total Row: P (Combo) sum is 1.00, Contribution Sigma equals 0.5725.
Thus, we obtain the prior probability that the system produces a discriminatory outcome without additional information as:
Therefore, in the initial state, the recruitment system has a 57.25% probability of producing a discriminatory outcome.
Next, we calculate the prior probability of the top level node, which is the high-risk decision P(HR = Yes). The same law of total probability is used:
Substituting the known values, where
$ P\left( HR= Yes| DO= Likely\right)=0.90 $
,
$ P\left( HR= Yes| DO= Unlikely\right)=0.10 $
, and
$ P\left( DO= Unlikely\right)=1-P\left( DO= Likely\right)=1-0.5725=0.4275 $
, we have:
From this result, we obtain that without any additional evidence, the prior probability that the system is classified as “high risk” is 55.8%. This value is already higher than most internal control thresholds in companies, for example, 50%. It shows that the system has a clear compliance risk even before deployment.
3.4.3. Dynamic update of risk probability
The following section demonstrates how to use dynamic evidence to drive Bayesian updating in the model and then carry out risk attribution analysis on this basis.
(1) Assume that a third-party organisation conducts a bias audit on the recruitment system and finds serious issues. The specific evidence E is that the four-fifths rule is not satisfied. The hiring rate for female candidates compared with male candidates is 61.5%. This is below the legal threshold of 80%. This value is the key input that drives the model update.
(2) The likelihood function is set. It describes the probability of observing the evidence under different states of “Discriminatory Outcome” as
$ P\left(E| DO= Likely\right)=0.92 $
. If the system does have a discriminatory outcome, then the audit has a 92% chance to detect this bias:
$ P\left(E| DO= Unlikely\right)=0.15 $
. If the system does not have a discriminatory outcome, the audit still has a 15% chance of giving a false positive or reporting bias. This non-zero probability takes into account possible sampling errors or other limits in the audit process.
(3) Bayesian update. We calculate the posterior probability
$ P\left( DO= Likely|E\right) $
. We use Bayes’ theorem to compute the posterior probability of “Discriminatory Outcome” given the observed audit failure evidence
$ E $
. The formula of Bayes’ theorem is as follows:
In this equation, the denominator
$ P(E) $
is the total probability of observing the evidence
$ E $
. It can be calculated using the law of total probability:
Substituting the values:
The posterior probability is:
After the impact of this single piece of evidence from the audit failure, the prior probability of 57.25% for a discriminatory outcome is significantly increased to a posterior probability of 89.15%.
3.4.4.
Reverse inference: Identifying key risk sources
$ P\left( HB= High|E\right) $
We conduct a reverse inference to calculate the posterior probability that the root node “Historical Data Bias” is in the state High under the evidence of audit failure. This is written as
$ P\left( HB= High|E\right) $
. This step is used for risk attribution.
Here, we calculate the contribution weight of key combinations. For example,
$ {Combo}_1\left( HB= High, DR= Poor, BM= Ineffective\right) $
contributes to the explanation of evidence
$ E $
as follows:
The weight of this combination in the total probability of evidence
$ P(E) $
is:
Using the same method, we calculate the weights of all combinations where
$ HB= High $
, which include
$ {Combo}_1 $
,
$ {Combo}_2 $
,
$ {Combo}_3 $
, and
$ {Combo}_4 $
. We then sum these values. The total contribution of
$ HB= High $
is about 69.5%. This value is much higher than its prior probability of 60%.
Attribution conclusion: under the audit failure evidence, historical data bias is the main cause of the current high risk state.
The probability of high-risk classification increases from 55.8% to 81.32%. This clearly triggers the mandatory requirement in Article 16 of the EU AI Act that corrective measures must be taken for high-risk systems.
3.4.5. Generation of automated governance recommendations
We can build a simple rule engine. This engine maps the numerical outputs of the model directly to specific governance actions and related legal provisions. The process is shown in Table 4.
Automated governance recommendations

Table 4. Long description
The table consists of three columns: Trigger condition, Corresponding A I A article, and Governance recommendation.
* Row 1: Trigger condition is P (H R equals Yes given E) greater than 80 percent. Corresponding A I A article is Art. 16. Governance recommendation is to immediately stop the automatic decision function of the system in the production environment until the correction work is completed.
* Row 2: Trigger condition is P (H B equals High given E) greater than 65 percent. Corresponding A I A article is Art. 10. Governance recommendation is to launch a special audit on bias in historical data, focusing on differences in hiring rates across dimensions such as gender and age.
* Row 3: Trigger condition is P (B M equals Ineffective given E) greater than 50 percent. Corresponding A I A article is Art. 10. Governance recommendation is to redesign the bias mitigation plan and introduce adversarial debiasing techniques.
* Row 4: Trigger condition is P (D O equals Likely given E) greater than 85 percent. Corresponding A I A article is Art. 14. Governance recommendation is to enable a mandatory human review routing system where all low confidence predictions must be manually checked by the human resources department.
3.4.6. Explanation output
Table 5 is an example of a compliance risk summary designed for regulators.
Example of a compliance risk summary

Table 5. Long description
The table consists of two columns titled Item and Content, with four rows of data.
* Row 1: Item is Risk level. Content is High risk with a confidence of 81.3 percent.
* Row 2: Item is Main cause. Content is Historical data bias with a contribution of 69.5 percent.
* Row 3: Item is Evidence support. Content states that a third-party audit found that the four-fifths rule is not satisfied. The female hiring rate is 61.5 percent, which is below the 80 percent threshold.
* Row 4: Item is Legal link. Content specifies a violation of data governance requirements under Art. 10(2)(g) of the E U A I Act.
Recommended actions: (1) Immediately suspend the automatic screening function (based on Art. 16). (2) Submit a bias root cause analysis report within 72 hours (based on Art. 17). (3) Retraining must pass review by an independent ethics committee before it starts (based on Art. 9).
3.4.7. Continuous iteration and governance
The results of governance actions can be used as new evidence. This feedback is sent back into the network and drives model iteration and development. For example, if the company adopts the recommendation and takes the following actions:
-
(1) Data resampling is completed. This means that the situation of historical data bias and data representativeness is improved. We update $ P\left( DR= Good\right) $
from
$ 0.3 $
to
$ 0.7 $
. -
(2) An adversarial debiasing algorithm is deployed. This improves the effectiveness of bias mitigation measures. We update $ P\left( BM= Effective\right) $
from
$ 0.5 $
to
$ 0.8 $
.
Next, we input the updated prior probabilities into the network and run the inference process again. The new calculation will show whether
$ P\left( HR= Yes\right) $
has fallen to an acceptable level, for example below 30%. If the risk is reduced, it shows that the governance measures are effective. If the risk is still high, it is necessary to find new evidence, such as new monitoring logs, and apply deeper governance actions. This forms a spiral and continuous risk management loop. This mechanism ensures that compliance of the AI system is not static. It is a dynamic ability that can adapt to changes in internal and external environments.
Therefore, the Bayesian network, together with dynamic evidence-based probability updates and an automatic rule engine, can convert the abstract legal requirements of the EU AI Act into a risk governance framework for an intelligent recruitment system. This framework is quantifiable, explainable, and executable.
3.5. The significance of an interpretable and adaptive AI governance framework
The interpretable and adaptive AI governance framework based on Bayesian network technology has more advantages than principle-based and practical schemes in shortening the cycle of AI innovation and AI governance. It also performs better in interpretability than other automated governance approaches. In addition, the balanced significance of the interpretable and adaptive AI governance framework is reflected in several aspects. First, the Bayesian network model has general applicability, which helps provide an inclusive governance path. Second, the automatic updating ability of the Bayesian network helps to compensate for current static governance strategies and supports a combination of dynamic and static governance. Third, the Bayesian network can perform reverse reasoning, which helps to automatically generate value alignment schemes.
3.5.1. The interpretable and adaptive AI governance framework helps to provide an inclusive governance path
At present, there is a global competition in artificial intelligence regulation (Neuwirth, Reference Neuwirth2024). However, balancing AI governance and AI innovation is a common challenge faced worldwide. The interpretable and adaptive AI governance framework has general applicability.
First, the interpretable and adaptive AI governance framework is scalable and can be applied in different countries. Different national risk quantification schemes can be entered into causal models, such as Bayesian models, making it possible to promote their use across countries. Second, the interpretable and adaptive AI governance framework can balance AI innovation and AI governance. On one hand, companies that follow this framework can shorten the time for technology release and application, which helps to avoid profit loss caused by long review periods. On the other hand, governments can use this framework to address the potential delay and static nature of traditional governance schemes.
This requires:
(1) active dialogue between countries to discuss and establish reasonable quantitative standards for artificial intelligence risk assessment; (2) regulators and experts providing quantitative standards for ethical and compliance judgements to technical personnel; and (3) technical personnel actively understanding the relevant quantitative standards and embedding them into causal models.
In conclusion, this depends on cross-disciplinary cooperation, mainly involving technical staff, evaluators (experts), and other stakeholders. The purpose is to promote the optimisation of relevant causal models, especially in dealing with new ethical situations. A well-trained causal model can infer potential or similar ethical causes based on risk assessment results. This can reduce potential ethical problems that may arise from AI innovation.
Therefore, the explainable adaptive AI governance framework has the advantage of universality and can serve as an inclusive governance approach.
3.5.2. The explainable adaptive AI governance framework can serve as a supplement to static governance strategies
AI dynamic governance and static governance can complement each other. Because technology changes quickly, dynamic governance is necessary. Since regulatory uncertainty and ethical rules are hard to formalise, governance should combine static and dynamic strategies for the long term. Expert assessment should be the main approach, supported by machines.
This requires: (1) regulators to develop multiple dynamic governance plans, for example, combining stage-based supervision with full-cycle supervision; (2) technical staff to develop reliable assessment and decision tools for different purposes; and (3) companies to conduct self-inspections according to laws and regulations.
3.5.3. The explainable adaptive AI governance scheme helps to automatically generate value alignment strategies
The explainable adaptive AI governance scheme produces risk probability values and risk types that can generate appropriate value-based decision suggestions. For example, when the causal model shows that a technology has a high risk of opacity, it will suggest increasing transparency and seeking decision suggestions from the decision database that align with values. For this, it is essential to input complete value strategies into the causal model to provide correct suggestions. In addition, when new technologies may cause ethical issues that go beyond the existing decision database, experts are needed to assess and analyse the new ethical problems, provide new decision suggestions, and input them into the causal model.
This requires: (1) experts to continuously predict and publish potential ethical issues in AI development; (2) technical staff to update the causal model structure in time according to expert suggestions; and (3) regulators to act as a bridge by classifying existing ethical decisions and promptly communicating new ethical decisions to companies.
4. Conclusion
Through the work in this article, we provide an overall view of current approaches to balancing AI governance and AI innovation.
First, the principle-based approach to balancing AI governance and AI innovation proposes flexibility and adaptability in the regulatory framework, but it may have potential delays. Second, the practice-based approach can embed ethical requirements into the technology development process, but it may come at the cost of harming the interests of enterprises. This article presents an explainable and adaptive AI governance approach, which aims to improve governance transparency and shorten the governance cycle. It reflects both technical rationality and value rationality. Its main features are explainability and adaptability. The significance of the explainable and adaptive AI governance approach is as follows. First, it helps provide an inclusive governance path. Second, it helps compensate for static governance strategies. Third, it helps automatically generate value-aligned plans. It can be seen that this approach is an automated prediction and reasoning framework that supports risk pre-assessment in governance. However, this approach still has some limitations. First, some ethical judgements are hard to quantify or have regulatory uncertainty. Second, optimising the causal model effectively requires time and cost. Given these limitations, the approach should be seen as a tool for AI governance rather than a replacement. It should be noted that this article only takes a step towards a human-machine collaborative governance method. The practical framework of the explainable and adaptive AI governance approach is gradually improving. The causal model is not the only solution, but serves as a supplement to current approaches. Coordinated governance using multiple approaches can better ensure a balance between innovation and governance. The issue of balancing AI innovation and AI governance is a topic that deserves long-term attention.
Data availability statement
This article does not cover data and code.
Author contributions
Y.W.: conceptualisation, data curation, formal analysis, methodology, investigation, validation, visualisation, writing – original draft, writing – review and editing, project administration, resources, supervision.
Funding statement
This research received no specific grant from any funding agency, commercial, or not-for-profit sectors.
Competing interests
During the preparation of this work, the author used ChatGPT for translation and Grammarly for grammar checking. After using these tools, the author carefully reviewed and edited the content as needed to ensure accuracy and clarity.
Provenance
This article was submitted for consideration for the 2025 Data for Policy Conference to be published in Data and Policy on the strength of the Conference review process.



Comments
No Comments have been published for this article.