AI治理需关注合法性，而非仅追求对齐目标。

AI systems already govern. They rank speech and allocate attention, filter applicants and triage claims. The dominant frame for AI governance, alignment, asks whether such systems pursue the right objectives safely. It cannot answer a prior question: by what right are those objectives set and enforced? This Article argues that legitimacy is an autonomous regulatory objective, distinct from alignment and not secured by it. Legitimacy here is sociological: the belief among those subject to power that it is exercised rightfully. Performance does not produce that belief. We already have the proof of concept. Social media and search delivered enormous gains on every familiar metric and still triggered a legitimacy crisis, because publics questioned who authorized a handful of firms to set the rules of speech, visibility, and knowledge. It is possible to build a benevolent AI and still face a political crisis over its authority. The Article maps three sites where AI legitimacy falters: opacity, which blocks audiences from forming justified beliefs; private power, where firms exercise public-facing authority without recognizable authorization; and administrative automation, which strains reason-giving, participation, and review inside the state. It then asks what law can contribute. Thin legality (publicity, stability, consistent application) signals non-arbitrariness and buys real recognition, but invites legitimacy-washing when form drifts from practice. Thick legality supplies what form cannot: public authorship of the rules that bind. Three portable principles follow. Integration seats consequential AI rule-setting in venues a polity already treats as authoritative. Familiarity presents rules and reasons in locally credible forms. Contestation guarantees a credible second look with real remedies.