Mapping U.S. Federal AI Governance Against Sector Vulnerability
Ho Ting Hung, Angelica Chowdhury, James Teague, Simon Mylius, Spencer Michaels, Peter Slattery, Alexander Saeri, Neil Thompson
cs.CY · cs.AI
Quick verdict
Maps 684 US federal AI docs' sector/risk coverage vs 272-expert vulnerability ratings; careful descriptive gap-mapping, LLM coding validated on six documents.
Summary
The paper asks whether U.S. federal AI governance documents concentrate attention where experts judge AI risk most severe. Drawing on CSET's AGORA corpus, the authors filter to 684 U.S. federal documents with major activity between January 2020 and January 20, 2026, each scored 1–3 by the MIT AI Governance Mapping project (using Claude Sonnet 4.5) for coverage of 24 risk subdomains and 14 NAICS-based sectors. Breadth is the share of documents mentioning an item; depth is the share of mentioning documents reaching 'good coverage'. These are compared with vulnerability ratings (1–5) from a three-round Delphi study of 272 experts, aggregated into composite Attention Divergence and Integrated Governance Divergence scores via RMS. Results: finance and insurance, rated extremely vulnerable in 17 of 24 subdomains, is mentioned in under 30% of documents in any risk domain and shows the largest divergence; health care ranks similarly on the integrated score; public administration and national security dominate coverage; most mentions stay superficial (no subdomain exceeds 50% good coverage; AI welfare is never mentioned). Robustness checks vary the depth floor and drop subdomain 7.5. Main limitations: the AI-specific corpus excludes generally applicable laws, LLM classification was validated on only six documents in a pilot, expert ratings are perceptions, and all documents are weighted equally.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Coverage across 684 U.S. federal AI governance documents is uneven: robustness, system security and governance risks receive far more attention than socioeconomic, environmental and emerging risks including multi-agent risks.
- Finance and insurance, rated extremely vulnerable (median 5/5) in 17 of 24 risk subdomains by 272 Delphi experts, is mentioned in under 30% of documents addressing any risk domain, yielding the largest vulnerability–coverage divergence of any sector.
- Public administration (392 mentions, 68.6% depth) and national security (415 mentions, 68.0% depth) dominate both breadth and depth of coverage despite only moderate expert vulnerability ratings.
- Depth of coverage is thin nearly everywhere: no risk subdomain exceeds 50% good coverage among mentioning documents, subdomain 7.5 (AI welfare) is never mentioned, and 6.3 (devaluation of human effort) never reaches good coverage.
Strengths
Novel two-dataset triangulation with fully specified metrics
Combining the Governance Mapping corpus (684 federal AGORA documents, 1–3 coverage scores) with a 272-expert Delphi vulnerability panel is a genuinely new descriptive lens; breadth, sector share, AD and IGD formulas are written out explicitly (§2.2), making the counting logic auditable.
Depth analysis adds real information beyond mention counts
Table 2 and appendices A.1/A.2 expose raw counts (e.g., 6.3 Economic devaluation: 0 good of 16 mentions; 7.6 Multi-agent: 1 of 9; 7.5 AI welfare: 0 of 684; sector 08: 0 of 36), supporting the 'thin coverage' claim independently of the composite indices.
Unusual interpretive candor
Robustness checks actually performed
Weaknesses
Single-LLM classification validated on six documents
No uncertainty quantification anywhere
Composite index is ad hoc and positive by construction
Small-denominator instability feeds headline claims
Equal document weighting distorts 'attention'
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper asks whether documentary attention in U.S. federal AI governance matches expert-rated sector vulnerability. The corpus is 684 U.S. federal documents from CSET's AGORA archive (major activity Jan 2020–Jan 20, 2026), each scored 1–3 on 24 risk subdomains (MIT AI Risk Taxonomy) and 14 NAICS sectors by Claude Sonnet 4.5 under the MIT Governance Mapping project; the comparator is a three-round Delphi panel of 272 experts rating sector vulnerability 1–5. Four headline claims are made: (i) coverage concentrates on robustness, system security and governance risks (only four subdomains exceed 30% breadth: 2.2 with 332 mentions, 6.5 with 267, 7.3 with 261, 6.4 with 251); (ii) finance/insurance shows the largest divergence — extremely vulnerable in 17/24 subdomains yet mentioned in under 30% of documents in any domain (93/684 overall; 20% for subdomain 4.2 per §3.1.1); (iii) public administration (392 mentions, 68.6% depth) and national security (415, 68.0%) dominate; (iv) depth is thin — no subdomain exceeds 50% good coverage (max 44.7%, subdomain 1.2, 17/38).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What did the study find about finance and healthcare AI governance?
Experts rated finance/insurance extremely vulnerable (median 5 on a 5-point scale) in 17 of 24 AI risk subdomains, yet only about 14% of the 684 federal AI governance documents mention the sector at all (93 documents), giving it the largest gap between expert-rated vulnerability and documentary coverage; healthcare and social assistance shows a similarly large gap once depth of coverage is included. The authors caution this does not prove under-regulation, since the corpus only includes documents that directly address AI and excludes generally applicable sector laws.
How were the 684 documents analyzed?
The documents are U.S. federal, AI-specific items from CSET's AGORA archive with major activity between January 2020 and January 20, 2026. The MIT AI Governance Mapping project scored each on a 1–3 scale (none / minimal / good coverage) for 24 AI risk subdomains and 14 NAICS-based sectors using the LLM Claude Sonnet 4.5, which was selected after a pilot comparison on six documents. Breadth is the share of documents mentioning an item; depth is the share of mentioning documents that give detailed governance measures.
Which AI risks get the most and least attention in U.S. federal documents?
Most mentioned: AI system security vulnerabilities and attacks (332 of 684 documents), governance failure (267), lack of capability or robustness (261), and competitive dynamics (251). Least mentioned: AI welfare and rights (0 documents), multi-agent risks (9), economic and cultural devaluation of human effort (16), and power centralization (21). Even among documents that mention a risk, fewer than half give detailed treatment for every subdomain — the highest depth share is 44.7%.
Does low coverage mean AI is unregulated in those sectors?
No. The paper is explicit that its corpus covers only documents that directly address AI. Generally applicable laws (e.g., financial and health regulation), state and local measures, and private standards may already mitigate the risks and were excluded by design. Low AI-specific coverage flags sectors and risks worth further investigation, not demonstrated governance failure.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 2–4, B.1, C.1 and D.1–D.2 are images; dumbbell rankings and heatmap values could not be verified from the extracted text — subdomain-level sector-share claims (e.g., 44% for 3.1/national security, 20% for 4.2/finance) are taken as reported.
- In Table A.1 the descriptive texts of subdomains 4.2 and 4.3 appear interchanged; treated here as a table labeling error, but subdomain-level reading of those rows warrants care.
- No statement about release of the derived coverage-score matrix or analysis code was found in the extracted text; availability is unverified.
- Minor formatting may be lost in extraction, but the main body, Table 2 and appendices A.1/A.2 extracted consistently, and cited percentages were internally cross-checked.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.