# Internal Deployment Gaps in AI Regulation

arXiv: https://arxiv.org/abs/2601.08005 · HTML: https://mlsanity.com/paper/2601.08005/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 30 references that are in the map.
- First posted on arXiv 12 Jan 2026.

## Builds on (most cited first, 6 of 6)

- [Structured access: an emerging paradigm for safe AI deployment](https://mlsanity.com/paper/2201.05159/) (2022)
- [Pitfalls of Evidence-Based AI Policy](https://mlsanity.com/paper/2502.09618/) (2025)
- [Verification methods for international AI agreements](https://mlsanity.com/paper/2408.16074/) (2024)
- [AI Behind Closed Doors: a Primer on The Governance of Internal Deployment](https://mlsanity.com/paper/2504.12170/) (2025)
- [Advancing Science- and Evidence-based AI Policy](https://mlsanity.com/paper/2508.02748/) (2025)
- [Red Teaming AI Policy: A Taxonomy of Avoision and the EU AI Act](https://mlsanity.com/paper/2506.01931/) (2025)

## Built on by (most cited first, 2 of 2)

- [What if automating AI R&D triggers an intelligence explosion?](https://mlsanity.com/paper/2609.36054/) (2026)
- [Risk Reporting for Developers' Internal AI Model Use](https://mlsanity.com/paper/2604.24966/) (2026)

## Abstract (arXiv)

Frontier AI regulations primarily focus on systems deployed to external users, where deployment is more visible and subject to outside scrutiny. However, high-stakes applications can occur internally when companies deploy highly capable systems within their own organizations, such as for automating R&D, accelerating critical business processes, and handling sensitive proprietary data. This paper examines how frontier AI regulations in the United States and European Union in 2025 handle internal deployment. We identify three gaps that could cause internally-deployed systems to evade intended oversight: (1) scope ambiguity that allows internal systems to evade regulatory obligations, (2) point-in-time compliance assessments that fail to capture the continuous evolution of internal systems, and (3) information asymmetries that subvert regulatory awareness and oversight. We then analyze why these gaps persist, examining tensions around measurability, incentives, and information access. Finally, we map potential approaches to address them and their associated tradeoffs. By understanding these patterns, we hope that policy choices around internally deployed AI systems can be made deliberately rather than incidentally.