The standards-industrial complex is a term used by Andrew Clearwater in his March 24, 2026 essay "Standards Are the New Legislation" for the interlocking ecosystem of formal standards bodies (ISO, IEC, IEEE, ANSI, NIST, CEN-CENELEC), trade associations, accreditation bodies, certification firms, and consulting companies that produce, propagate, and audit AI standards. Clearwater's argument is that the organizations writing AI standards "were never designed to function as quasi-legislative bodies" but are increasingly becoming so as statutes, courts, and procurement offices treat their output as the baseline for lawful conduct. The phrase is used both descriptively, to denote that the ecosystem exists and is consequential, and critically, to argue that the ecosystem produces governance whose accessibility favors incumbents. The critical reading appears where the cost of compliance with formal AI standards is identified as an entry barrier.
Origin
Clearwater introduces the term in a section of the essay headed "What Nobody Expected: The Standards-Industrial Complex." His claim is that voluntary frameworks such as the NIST AI RMF, ISO/IEC 42001, and the OECD AI Principles are acquiring the force of law through two channels running at once: state statutes that reward, require, or ask for disclosure of standards adoption (see Three-Lane Standards-Based AI Governance), and courts that use standards to define the standard of care (see Standards as Litigation Evidence) (Standards Are the New Legislation (Clearwater, March 2026)). As standards take on that weight, in his account, the bodies that write them take on a legislative role for which their processes were not built.
Clearwater's illustration is the European Union. The EU AI Act was to be backed by harmonized technical standards developed by CEN-CENELEC. He writes that only 15 of these had been published by late 2025, with roughly half projected to miss the August 2026 deadline. The standards bodies responded with a fast-track process that empowered smaller expert groups to push delayed standards through; some original drafters objected that bypassing the traditional consensus process undercut the legitimacy that makes standards worth following. The resulting uncertainty led the European Parliament to propose replacing the fixed August 2026 date for certain high-risk rules with a timeline conditional on the availability of harmonized standards (Standards Are the New Legislation (Clearwater, March 2026)). Clearwater describes this as "a governance crisis hiding inside a standards process."
Components
The ecosystem spans standards-setting organizations, national bodies, accreditation and certification layers, the auditors and consultancies that produce compliance reports, and the trade associations and civil-society groups that supply input to the process.
| Layer | Examples | Role |
|---|---|---|
| Standards-setting bodies | ISO/IEC JTC 1/SC 42 (AI), CEN-CENELEC JTC 21 (EU), IEEE 7000-series, NIST AI RMF, ANSI | Produce the formal text. |
| Standards-setting national bodies | NIST (US), BSI (UK), DIN (Germany), JISC (Japan), SCC (Canada) | National-level integration and national policy linkage. |
| Certification / accreditation bodies | UKAS, ANAB, A2LA, DAkkS | Certify auditors who certify deployers. |
| Auditors and consultancies | Big-4 (PwC, Deloitte, EY, KPMG); boutique AI-compliance firms (BABL AI, Holistic AI) | Produce the audit reports deployers pay for. |
| Trade associations | Partnership on AI, ITI, BSA, Chamber of Commerce, DIGITALEUROPE | Shape standards-body input from industry. |
| Civil-society participants | EFF, Access Now, AI Now Institute | Underrepresented relative to industry participation. |
At the international level, ISO/IEC Joint Technical Committee 1, Subcommittee 42 produces the ISO/IEC AI standards, including ISO/IEC 42001 and ISO/IEC 42005 (see International AI Standards). In the EU, the European standardisation organisations CEN and CENELEC lead drafting of the AI Act standards through their Joint Technical Committee 21, which held its first meeting in June 2021 in anticipation of a Commission standardisation request; the third European standardisation organisation, ETSI, is not leading this work (Source: artificialintelligenceact.eu). CEN-CENELEC flagged delays publicly on April 15, 2025, reporting that the work was likely to take up much of 2025 and, for some deliverables, part of 2026 (Source: artificialintelligenceact.eu).
Composition of standards committees
Empirical work on who sits on AI standards committees supports parts of the critical reading. In January 2025 Corporate Europe Observatory (CEO) published "Bias baked in," an analysis of the membership of CEN-CENELEC JTC 21. It identified 143 members, of whom 55% represented companies or consultancies (54 from companies and 24 from consultancies) and 9% civil-society organizations. Almost a quarter of the corporate representatives were from US companies, including four members each from Microsoft and IBM and two from Amazon, with others from Google, Intel, Oracle, Qualcomm and the Brussels-based lobby group DIGITALEUROPE. CEO reported that the German, UK and Irish national delegations to JTC 21 were regularly headed by Microsoft representatives, that Microsoft sponsored and hosted a 2024 JTC 21 plenary, and that the Chinese presence consisted entirely of four representatives linked to Huawei. In the national "mirror committees" it could examine, the share of experts representing corporate interests was 56% in France, 50% in the UK and 58% in the Netherlands (Source: corporateeurope.org).
CEO also stated that a vice president of Futurewei, the R&D arm of Huawei, chaired the ISO/IEC working group on AI standards (SC 42), and that large technology companies were promoting ISO/IEC international standards which, in its assessment, often conflict with the AI Act. Its researcher Bram Vranken argued that the Commission's decision "to delegate public policy-making on AI to a private body is deeply problematic," noting that the AI Act is the first time harmonised standards are used to implement requirements on fundamental rights, fairness and bias (Source: corporateeurope.org).
Debates and positions
Standards are described as valuable when they enable cross-border interoperability and reduce compliance cost, and as an entrenchment mechanism when the standards-setting process favors incumbent participants who can afford the participation cost. The same tension is framed as interoperability versus capture. Clearwater himself presents the interoperability side alongside his critique: he describes the crosswalk documents NIST published mapping the AI RMF to ISO/IEC 42001 and the OECD AI Principles as the beginning of "a global governance interoperability layer for AI," and predicts that ISO/IEC 42001 certification will become a baseline expectation for enterprise AI vendors by 2027 (Standards Are the New Legislation (Clearwater, March 2026)).
A distinct line of critique concerns democratic legitimacy rather than participation. Gillian Hadfield and Jack Clark argue that reliance on private standard-setting organizations produces a "democratic deficit": the fundamentally political task of reconciling trade-offs in AI design is delegated to actors not accountable to the public, and they state that making those bodies more open would not cure the problem (Regulatory Markets: The Future of AI Governance). They note that ISO standards are proprietary, recording that they paid approximately $2,500 for the fourteen AI standards ISO had produced as of summer 2022 under a licence forbidding copying or sharing, and that a March 2024 Court of Justice of the European Union decision (Case C-588/21 P, Public.Resources.Org and Right to Know v. Commission) held that standards referenced in EU law as a means of demonstrating compliance must be made freely available. On their account the main difference between the EU and the US/UK approaches is that the EU will require compliance with standard-setting-organization standards while the US and UK encourage it (Regulatory Markets: The Future of AI Governance).
AI standards vary in legal force. Most are voluntary in the US, such as the NIST AI RMF. Some are voluntary but incorporated by reference, such as ISO/IEC 42001 in the EU AI Act. Only a few are mandatory in any jurisdiction.
Adoption of a standard can also function as litigation evidence: it becomes a defensible "I followed best practice" position in tort liability. This relationship is developed in Standards as Litigation Evidence. In the frontier-AI setting, the argument that standards bodies can serve incumbent interests recurs in debates over proposed international frontier-model standards (see International AI Standards).
Relationships
- introduced-by: Standards Are the New Legislation (Clearwater, March 2026) (Andrew Clearwater).
- related: Three-Lane Standards-Based AI Governance, Standards as Litigation Evidence, International AI Standards, AI Governance (umbrella) (umbrella).
- related: National Institute of Standards and Technology (NIST), ISO/IEC 42001 — AI Management System, ISO/IEC 42005 — AI Impact Assessment, NIST AI Risk Management Framework 1.0, EU AI Act (Regulation 2024/1689), the
standards/folder index. - related: Regulatory Capture in AI Policy — the regulatory-capture reading.
- contradicted-by: Regulatory Markets: The Future of AI Governance — treats reliance on standard-setting organizations as generating a democratic deficit rather than resolving it.
Sources
- Standards Are the New Legislation (Clearwater, March 2026) — origin of the term.
- Regulatory Markets: The Future of AI Governance — democratic-deficit critique; ISO licensing costs; CJEU Case C-588/21 P.
- Corporate Europe Observatory, "Setting the rules of their own game: how Big Tech is shaping AI standards" (January 2025) (Source: corporateeurope.org).
- EU Artificial Intelligence Act, "Standard Setting" overview (Source: artificialintelligenceact.eu).