The EU’s AI law tells companies what to achieve. A small committee of experts, most of them employed by companies, is writing how. This dialogue asks who sits on the committees that turn AI rules into everyday practice, who pays for the seat, and what happens to everyone who can’t afford one.
If you have ever been told that an AI system you use is “compliant”, here is the uncomfortable follow-up question: compliant with what, written by whom? For most of the world’s high-risk AI rules, the honest answer will soon be a technical standard you have never read, drafted in meetings you could not attend, by people whose employers have a direct interest in what it says. That is not a scandal. It is how standardisation has always worked for toasters and cables. The question for this dialogue is whether it is good enough for systems that decide who gets a loan, a job interview or a second look from the police.
Where the law ends and the standard begins
Start with the machinery, because it is less boring than it sounds. The EU AI Act sets out what high-risk systems must achieve on risk management, data quality, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity. It does not say exactly how. That job has been handed to the European standards bodies CEN and CENELEC, which the European Commission has asked to produce standards in ten areas, from risk management to conformity assessment; a company that follows a harmonised standard once it is published in the Official Journal gets a legal presumption that it complies (European Commission, n.d.). In practice, that makes the standard the place where an abstract obligation such as “appropriate human oversight” becomes a checklist that an auditor will actually test.
The work sits in a Joint Technical Committee, JTC 21, set up in June 2021, which CEN-CENELEC describes as bringing together “over 300 experts from more than 20 countries” across five working groups (CEN-CENELEC, n.d.). It has been slow, for understandable reasons and some less understandable ones. According to the Commission, the first harmonised standard for AI, prEN 18286 on quality management systems, entered public enquiry only on 30 October 2025, and the Commission’s page still lists no AI Act harmonised standard as published in the Official Journal (European Commission, n.d.). The delay has had legal consequences. The Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744 and published in the Official Journal in July 2026, moved the application of the high-risk rules to 2 December 2027 for the systems listed in Annex III and to 2 August 2028 for AI built into products covered by Annex I, and its recitals name the delayed availability of standards as one of the reasons (Regulation (EU) 2026/1744, 2026).
Who is in the room
The most detailed public count of who drafts these standards comes from Corporate Europe Observatory, a Brussels-based watchdog. In January 2025 it identified 143 members of JTC 21 and found that 54 represented corporations and 24 represented consultancies, together 55 per cent of those identified, while academia and think tanks accounted for 16 per cent and civil-society organisations for 9 per cent (Corporate Europe Observatory, 2025). Among the companies it named were Microsoft, IBM, Amazon, Google, Intel, Oracle, Qualcomm and Huawei. The report quotes the committee’s own chair, Sebastian Hallensleben, acknowledging that “large corporations typically have a resource advantage over non-profit stakeholders, even when the latter mobilise everything they can” (Corporate Europe Observatory, 2025). It also quotes Natalia Giorgi of the European Trade Union Confederation: “Standardisation is market-driven, profit-led, where industry develops technical specifications.”
That is one vantage point: a watchdog with a clear position. The technical vantage point is subtler and worth taking seriously. Standards committees are built on consensus among people who know how systems are made, and companies send engineers because engineers know things regulators don’t. The Ada Lovelace Institute’s research on JTC 21, based on interviews with people involved, found that the committee deliberately avoids interpreting the ambiguous, rights-related requirements in the Act, on the view that those political choices belong to legislators, not to technical bodies (Galvagna, 2023). You can read that as modesty or as a gap. One interviewee put the dilemma neatly: “No answer is not good enough for a computer programme; they need to have an answer” (Galvagna, 2023). Somebody ends up deciding what “sufficiently accurate” means. The question is who.
The same research explains why civil society struggles to be that somebody. Developing a standard typically takes two to five years, with participants spending two to ten hours a month; fewer than a quarter of the civil-society groups surveyed met the eligibility criteria for formal liaison status; and while company experts usually hold voting rights through their national delegations, many civil-society representatives do not (Galvagna, 2023). The report’s conclusion is the sentence I would put on the wall of every ministry that relies on standards: “If policymakers wish to implement public policy through standards while relying on civil society to represent the public interest, then civil society participation must be funded adequately” (Galvagna, 2023).
Zoom out: the global table
Europe’s committee is at least visible. The global picture is harder to see and more lopsided. The main international committee for AI standards, ISO/IEC JTC 1/SC 42, was created in 2018 and has its secretariat at the American National Standards Institute. The committee’s own business plan, circulated to its parent committee in September 2025, reports 49 participating and 26 observing national bodies and says that about a third of its member countries are developing nations (ISO/IEC JTC 1/SC 42, 2025). That is real growth. It also means that most of ISO’s national members take no part in the committee at all. Participation in international standards is through national standards bodies, which means a country without the budget to send experts to plenaries on several continents a year is, in effect, a country that receives standards rather than writes them.
The United Nations noticed. Its High-level Advisory Body on AI counted a rapid proliferation of AI-related standards from ITU, ISO/IEC and IEEE, and warned that terms such as fairness, safety and transparency still lack agreed definitions, that there are “few agreed standards concerning energy consumption and AI,” and that “a lack of integration of human rights considerations into standard-setting processes is another gap to be bridged” (United Nations High-level Advisory Body on Artificial Intelligence, 2024). It also recorded something that is easy to miss: small and medium-sized businesses in the developing world told consultations that fragmented governance and inconsistent standards raise their costs. Its proposed remedy was an AI standards exchange that would bring standards bodies, companies, civil society and scientists together to keep a register of definitions, debate how standards are made, and identify gaps.
Here is the operational vantage point, which rarely gets airtime. If you run compliance at a twenty-person company in Nairobi, São Paulo or Kuala Lumpur that sells into Europe, you will be measured against standards you had no hand in, priced in a currency you don’t earn, and often sold to you as paid documents. A large incumbent will have helped write them and will have tooling ready the day they are published. That asymmetry is not malicious, but it is real, and it compounds.
What this means for you
What follows is FairByDesign analysis. When a law delegates its hardest questions to a standard, power moves from the place where the public can see it to a place where it mostly can’t. The people who benefit first are those already in the room: large firms that can staff committees for years, consultancies that sell the resulting certifications, and countries whose national bodies hold secretariats. The people who carry the cost are those who will be judged by the standard without having shaped it: smaller companies, public-interest groups, and whole regions whose languages, data conditions and legal traditions were never on the agenda. And the cost to you, as someone on the receiving end of an AI decision, is that “it met the standard” can become the end of the conversation rather than the start of it.
There are open questions I genuinely cannot answer yet, and they are why this is a dialogue. Would funding civil-society and Global South participation change the content of standards, or only who signs off on them? Is a consensus process built for interoperability capable of settling questions about acceptable risk to people’s rights, or should those go back to legislators? And if China, the United States and Europe each push their own standards ecosystems, what happens to countries that must sell into all three?
Disclosure: this article was researched, written and reviewed by FairByDesign. Claude, an AI model made by Anthropic, a company active in the debates discussed here, was used for editing. FairByDesign is solely responsible for its content. FairByDesign accepts no funding from any AI developer named here.
Join the dialogue
We want to hear from the people who actually do this work and the people it is done to. If you sit on JTC 21, SC 42, an IEEE working group or a national mirror committee, tell us what the process looks like from inside, including where this piece is unfair to it. We particularly want standards engineers and policy staff from national standards bodies in Africa, Asia, Latin America and the Pacific; civil-society liaisons and trade unionists who have tried to take part; compliance leads at small companies who live with the results; and human-rights lawyers who think standards are, or are not, the right place for these choices.
Send evidence, corrections or a serious disagreement to info@fairbydesign.org with “Who Benefits” in the subject line; for sensitive material, see how we handle sources. With your permission, responses may be quoted in a follow-up or become a recorded conversation. You can also help without money: share this, suggest a lead, or introduce us to someone who has been in those meetings.
Support the dialogue. Nobody pays a reporter to sit through standards documents and count who drafted them; that is precisely why it needs independent support. Give once ($5, $10, $25, $50 or any amount), give monthly ($10 or $25), or become a patron at fairbydesign.org/patrons-2. Support never buys editorial control.
References
CEN-CENELEC. (n.d.). Artificial intelligence. Retrieved October 7, 2026, from https://www.cencenelec.eu/areas-of-work/cen-cenelec-topics/artificial-intelligence/
Corporate Europe Observatory. (2025, January 9). Bias baked in: How Big Tech sets its own AI standards. https://corporateeurope.org/en/2025/01/bias-baked
European Commission. (n.d.). Standardisation of the AI Act. Retrieved October 7, 2026, from https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation
Galvagna, C. (2023). Inclusive AI governance: Civil society participation in standards development. Ada Lovelace Institute. https://www.adalovelaceinstitute.org/report/inclusive-ai-governance/
ISO/IEC JTC 1/SC 42. (2025). SC 42 business plan 2025 (ISO/IEC JTC 1 N 17692). ISO/IEC JTC 1. https://jtc1info.org/wp-content/uploads/2026/03/SC-42-Business-Plan-2025.pdf
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI). (2026). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
United Nations High-level Advisory Body on Artificial Intelligence. (2024). Governing AI for humanity: Final report. United Nations. https://www.un.org/sites/un2.un.org/files/governing_ai_for_humanity_final_report_en.pdf
Leave a Reply
You must be logged in to post a comment.