分析真实AI事故，揭示监管问责存在巨大缺口，提出全周期合规框架。
Post-Deployment Accountability in AI Governance: A Cross-Regulatory Empirical Analysis of AI Incidents
- 基于多法规对比分析真实事故数据，识别监管执行漏洞。
- 77.1%事故无市场后监控证据，99.6%缺数据保护影响评估记录。
- 内部监测事故合规率远高于外部发现，凸显监测能力建设重要性。
部署后问责已成为人工智能治理的核心议题，但现有实证研究未能揭示监控、事件报告与影响评估义务在系统失效时的实际可见性。本研究分析了2020至2026年来自AI事故数据库的真实案例，并依据欧盟《人工智能法案》、NIST人工智能风险管理框架及GDPR中的九项部署后条款进行编码。结果显示：77.1%的事故缺乏欧盟《人工智能法案》要求的市场后监控证据；99.6%未提供数据保护影响评估（DPIA）文档。治理缺口具有系统性特征，9.8%的事故同时违反两项或以上监管框架。通过内部渠道发现的事故在欧盟《人工智能法案》下合规率达87.5%，而外部发现仅5.3%；在NIST框架下分别为95.8%与58.1%。这表明监测能力是有效治理的关键前提。基于上述发现，本文提出主动型人工智能治理合规框架（PAGCF），涵盖事前评估、持续监控、事件应对准备与跨框架验证四个阶段。
原文摘要 · Abstract (English)
Post-deployment accountability has become central to AI governance, yet little empirical evidence shows whether monitoring, incident reporting, and impact assessment obligations are visible when AI systems fail. This study analyzes real-world AI incidents from the AI Incident Database (2020-2026) and codes them against nine post-deployment provisions from the EU AI Act, the NIST AI Risk Management Framework, and the GDPR. The findings show substantial accountability gaps: 77.1% of incidents lack evidence of EU AI Act post-market monitoring, and 99.6% lack documented Data-Protection Impact Assessment evidence. Governance gaps are also systemic, with 9.8% of incidents simultaneously non-compliant under two or more regimes. Incidents detected through internal monitoring show much higher compliance than externally detected incidents (87.5% vs. 5.3% under the EU AI Act; 95.8% vs. 58.1% under NIST), suggesting that monitoring capacity is a key condition for effective post-deployment governance. Building on these findings, the paper proposes the Proactive AI Governance Compliance Framework (PAGCF), a four-phase lifecycle for pre-deployment assessment, continuous monitoring, incident preparedness, and cross-framework verification.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。