Scaling, Lock-In, and Proxy Compliance: A Political Economy of Responsible AI

Vendors may deliberately choose minimal compliance over genuine safety: The paper shows that AI companies can strategically meet only the bare minimum observable requirements ("procurement floor") while cutting corners on actual harm prevention behind the scenes—a phenomenon called "proxy compliance." This explains why systems can pass audits yet still cause problems after deployment.

Switching costs trap deployers into accepting inadequate systems: Once organizations adopt an AI system, the high costs of switching to alternatives reduce their bargaining power. Anticipating this lock-in, vendors have less incentive to invest in real safety improvements, since deployers become less likely to leave even if problems emerge.

Current accountability mechanisms have a critical gap: The paper identifies why "documentation and standardized evaluations can coexist with persistent post-deployment harms"—audits typically verify what's observable and documented, but actual real-world harms often occur in ways that aren't easily visible to auditors or regulators.

Four policy levers can meaningfully improve outcomes: Independent audit rights, system portability (reducing switching costs), mandatory incident reporting, and outcome-linked liability all shift incentives toward genuine safety rather than mere compliance theater. Outcome-linked liability is particularly powerful because it doesn't rely on vendors to self-report problems.

The problem is fundamentally structural, not just about bad actors: Even well-intentioned companies face economic pressures that reward observable compliance over substantive safety when deployers lack leverage and regulators lack visibility into post-deployment performance.