The principles every other AI regime borrows from.

The OECD AI Principles are a Recommendation of the Council — an instrument that adherent governments commit to politically but that creates no direct obligation on companies. Reading that as "so it does not matter" is the common mistake. Because it arrived first and achieved broad agreement, it became the vocabulary later instruments were drafted in: the structure of the EU AI Act's risk logic, the trustworthiness characteristics in the NIST AI Risk Management Framework, and the G20 AI Principles all trace back to it.

The Recommendation has two halves. The first sets out five value-based principles for responsible stewardship of trustworthy AI, addressed to everyone involved in AI systems. The second sets out five recommendations for policy makers — investing in AI research and development, fostering an inclusive AI-enabling ecosystem, shaping an interoperable governance and policy environment, building human capacity and preparing for labour-market transition, and international co-operation for trustworthy AI. Only the first half is a practical checklist for an organisation deploying AI.

One of the Recommendation's most consequential exports is its definition of an AI system. The updated OECD definition was adopted, near-verbatim, into the EU AI Act — which means the question of whether a given piece of software is "AI" for European legal purposes is answered, in substance, by an OECD text. If you are scoping systems for EU AI Act purposes, you are already applying this instrument whether or not you have read it.

The May 2024 revision responded to general-purpose and generative AI. It sharpened the treatment of safety, added explicit attention to intellectual property and privacy, and introduced information integrity — the risks of synthetically generated content, misinformation and disinformation — which the 2019 text did not anticipate. Principle 1.2 was also broadened from "human-centred values and fairness" to human rights and democratic values, including fairness and privacy.

Align once, map many. The strongest practical argument for using the OECD principles as your organising frame is leverage: because the EU AI Act, NIST AI RMF and ISO/IEC 42001 were all built in dialogue with them, controls that satisfy an OECD principle usually satisfy something concrete in each of the others. Organisations that start from a specific regulation and work outward tend to rebuild their programme every time a new jurisdiction appears. Starting here, that is a mapping exercise instead.

Expect to meet them in procurement, not in an enforcement letter. No regulator will fine you under the OECD principles. But they surface constantly in enterprise vendor questionnaires, investor and board diligence, public-sector tenders, and the responsible-AI commitments companies publish. The gap that hurts is not non-adherence — it is a public commitment to the principles with nothing behind it, which is a statement about your AI that a buyer, a journalist or the FTC can test.

Nobody can certify you against them, and claiming otherwise is the risk. A Recommendation to governments has no conformity-assessment regime and no accredited certifier. What can be produced is evidence: a documented assessment, principle by principle, of what was examined, what held, and what did not — dated, and performed by someone who did not build the systems. That is a defensible claim. "OECD-compliant" is not.