Today, Hacken announces its contribution to Future-Responsive AI Regulation: Adaptive Governance Models for Rapidly Evolving AI Capabilities. The paper serves as a proposal for how the UAE could design AI regulation that will be effective today and can be flexible for future change.
The policy paper was coordinated by the ADGM Academy Research Centre, with authors from the ADGM Registration Authority, ADGM Information Security, Hacken and Abu Dhabi University.
TL;DR
The paper proposes a framework for regulating AI systems whose capabilities change faster than regulators can rewrite policies. It sets out how policymakers can detect change, trigger review, and update requirements while keeping primary law stable.
The paper also compares six governance models: the European Union, the United States, the United Kingdom, Singapore, China, and Canada. From that comparison, it designs an approach for the UAE that can be enforced without constraining innovation.
Is future-proof AI regulation possible?
According to the paper, no rule written today can anticipate every capability AI systems will have tomorrow, and frameworks that promise permanence tend to fail when the technology changes its capabilities and use cases. The paper proposes future-responsive regulation instead: the institutional capacity to detect change and respond to it in a controlled, lawful and proportionate way.
The challenge of policymaking for AI is that traditional regulation cycles cannot keep up with technological advancements. A rulemaking cycle can take well over a year, and by then the technology subject to regulation can change several times. At the same time, rules aimed at a specific technical feature quickly become obsolete, and prescriptive rules can’t address capabilities that haven’t appeared yet.
Regulators generally choose between two approaches, and both carry risks. Rigid oversight blocks beneficial applications and pushes investment toward more agile jurisdictions. Lagging oversight leaves room for systemic harm, which, in the case of AI, includes AI-powered disinformation, systemic bias, autonomous offensive cyber capabilities, and cascading failures in critical infrastructure such as energy and logistics.
Proposed AI regulation framework
The proposed framework keeps primary law stable and limits outright prohibitions to settled cases. It defines thresholds, risk classifications, guidance, and assurance in secondary instruments that regulators can update as evidence changes. It also proposes classifying AI systems into tiers by capability and potential impact, so scrutiny scales with risk.
Under the framework, revision follows a six-stage cycle: sensing, triggering, review and response, implementation, evaluation and institutional memory. Each stage has an owner, a procedure and a feedback path to keep the regulation current with technological capabilities.
The framework places high-impact and frontier AI systems under continuous assurance, which includes red teaming, threat modeling, bias audits, and integrated governance, risk and compliance controls. To make the rules enforceable, the paper also proposes an enforcement architecture, where every binding duty gets a named supervisor, graduated sanctions, and due process. Since rules can change between authorization and enforcement, operators are judged against the version of the rules in force at the relevant time, with published effective dates and transition periods.
Hacken contributed to the framework with a security perspective
Hacken contributed material on AI red teaming, threat vectors and offensive capabilities, threat modeling, ISO/IEC 42001, and AI governance, risk and compliance. Hacken also provided positions on continuous red teaming and coordinated vulnerability disclosure, illustrative attack scenarios for energy and logistics systems, and a review of the complete manuscript.
Security expertise matters here because adaptive regulation depends on evidence. A regulator can update a risk classification with confidence only when it knows how a system fails, and that knowledge comes from testing systems under adversarial conditions. The paper’s scenarios show what such failures can look like: a prompt injection hidden in a forwarded email that reroutes an autonomous truck fleet, or training data poisoned over several weeks until a power grid’s AI incorrectly predicts demand.
The paper builds this evidence into the framework. It treats red teaming as a continuous program, where re-tests are triggered by model updates, tool or permission changes, and new mandates. It also proposes that each red-team result state its coverage, the evaluator’s level of access, the model version tested, and the remaining risk, so regulators know exactly what a result proves. In addition, the paper outlines a proposed AI Red Team Handbook for ADGM. It positions ISO/IEC 42001 as the procedural backbone for these controls, paired with technical assurance of the AI systems themselves.
Why AI regulation needs to adapt now
The impact of an AI technology can’t be fully understood until it’s widely deployed, and once it’s widely deployed, its course is hard to change. Regulators therefore have to write AI rules before the evidence is complete, and some of those rules will be wrong. A framework that can’t correct itself cements these mistakes in the regulation.
Earlier technology waves show the cost of waiting. Social media and crypto were regulated only after disinformation and financial volatility had already caused damage.
AI moves faster than earlier technologies. ChatGPT reached 100 million users in two months, and agentic systems now make operational decisions on their own. On the security side, the July 2025 mass exploitation of Microsoft SharePoint servers (CVE-2025-53770) showed how quickly a disclosed weakness gets exploited at global scale. Requirements that take over a year to revise can’t keep up with threats that move this fast.
The paper sets its own test for success: a jurisdiction that adopts the design should show shorter, lawful, and better-evidenced revision cycles than the six models it compares.
Read the full paper: https://academy.adgm.com/publications/future-responsive-ai-regulation-adaptive-governance-models-for-rapidly-evolving-ai-capabilities
Research authors and contributors
Lead author: Dmitry Fedotov of the ADGM Registration Authority (Emerging Technologies).
Co-authors: Mohamed Al Ali (ADGM Information Security); Stephen Ajayi, Dmytro Yasmanovych and Dyma Budorin (Hacken); Prof. Charilaos Mertzanis and Prof. Hazem Marashdeh (Abu Dhabi University).
Coordinator: Peter Ware (ADGM Academy Research Centre).
About Hacken
Hacken is a security and assurance partner for financial institutions and the infrastructure they rely on: exchanges, ecosystems, custodians, banks, asset managers and tokenization platforms. Founded in 2017, Hacken has served more than 1,500 clients across industries, including the European Commission, ADGM, Ethereum Foundation, MetaMask, and Bybit.
About ADGM Academy
ADGM Academy, the knowledge arm of ADGM, Abu Dhabi’s international financial centre, develops future-ready talent across industries. Guided by the UAE leadership’s vision to build a resilient economy for sustainable growth, they deliver world class learning and professional programmes that set standards, build capabilities, and foster innovation. In collaboration with industry leaders and academic institutions, we empower professionals to drive transformation and shape the future workforce.
