Your AI is “compliant.” Your visitors don’t care. What museums teach about legitimacy.

In January 2026, the British Museum posted promotional images featuring AI-generated “models” examining artwork in their galleries. Within hours, prominent archaeologists and historians demanded the post’s removal. The museum complied, then announced it was developing institutional AI guidelines—reactive governance that came only after reputational damage. The museum broke no laws; instead, it faced a legitimacy crisis.

In various AI startups where I have led marketing over the last decade, governance is often a race to mitigate risk while maintaining velocity. However, I also serve on boards for cultural institutions. This dual perspective has revealed a critical gap in current policy frameworks: the distinction between compliance governance and legitimacy governance.

This gap is where cultural institutions have been operating for decades. AI governance frameworks haven’t caught up to their reality. Current approaches prioritize technical benchmarks (bias metrics, transparency reports, impact assessments) while ignoring the trust-building processes that determine whether a deployment survives first contact with affected communities.

Cultural institutions feel it keenly, because their authority rests entirely on legitimacy. A museum can’t compel attendance. A festival can’t mandate participation. If trust truly erodes, the institution loses its core function. This makes cultural organizations essential laboratories for understanding what effective AI governance actually requires.

Compliance solves legal problems. Legitimacy is a different problem entirely

In March 2025, Christie’s held its first AI art auction. The sale was positioned as “an extension of human creativity” and featured works by Refik Anadol, Claire Silver, and other AI pioneers. Legally, the auction was unimpeachable. Operationally, it met industry standards. But over 6,000 artists signed a petition demanding its cancellation, characterizing AI-generated art as “mass theft.”

The auction proceeded. Sales exceeded expectations, attracting younger collectors to the market. And yet the legitimacy question remains unresolved. No amount of compliance documentation addressed the community’s fundamental objection: that the models powering these works were trained on artists’ labor without consent or compensation.

Institutions regularly face decisions where legal compliance and community trust diverge. A technically compliant AI deployment can still trigger backlash that compliance frameworks don’t predict or prevent. This is the structural problem cultural institutions expose: law is the floor, but institutional integrity is the ceiling.

Legitimacy isn’t granted by legal departments. It’s granted by communities, artists, audiences, funders, and the broader public. It’s maintained through consistent alignment between an institution’s actions and its stated values.

Curators and staff are caught between inclusive representation of all contemporary practices and the threat of boycotts and reputational damage. They’re being asked to navigate between showing what exists in the cultural landscape and what the institution can ethically defend. Their stakeholders do not share a single definition of what “responsible” or “ethical” AI use should look like.

Governance in this context isn’t about finding a single correct answer. It’s about maintaining a fragile equilibrium between competing and sometimes incompatible expectations. This is what distinguishes legitimacy governance from compliance governance.

Four dimensions of AI ethics in cultural contexts

Cultural institutions confront AI’s ethical complexity along four distinct axes, each requiring different governance approaches.

1. Environmental externalities

In 2019, researchers estimated that developing one large AI model produced roughly five times the lifetime emissions of an average car (Strubell et al., 2019). By 2024, Meta reported that training its largest Llama 3.1 model drew on more than 30 million hours of GPU computing and produced an estimated 8,930 tonnes of CO2-equivalent, more than 150 car lifetimes by the same measure (Meta, 2024). Data centers powering AI systems require massive water resources for cooling—consumption that compounds existing scarcity in drought-affected regions (Mytton, 2021). For cultural institutions with environmental commitments, these externalities create governance contradictions that technical compliance doesn’t resolve.

2. Political entanglement

AI systems increasingly function as surveillance infrastructure. Georgetown University’s American Dragnet project documents how law enforcement agencies use AI-powered tools for mass surveillance, often without public oversight or consent (Georgetown Law Center, 2022). Cultural institutions that deploy AI for visitor analytics or security face questions about complicity in broader surveillance ecosystems.

3. Platforming risk

The act of “platforming” is viewed by the public as institutional endorsement. When an institution exhibits work created with generative AI, backlash frequently targets the institution as well as the creator. The public assumes the board has vetted not just the art, but the ethical provenance of the model used to create it. This forces boards into a role they’re often unequipped for: becoming de facto regulators of the AI supply chain for the work they show.

4. The provenance paradox

As Gabriel Menotti argues in “The model is the museum: generative AI and the expropriation of cultural heritage,” neural networks function as institutional archives, accumulating and remixing cultural materials at scale, much like museums historically did through colonial extraction (Menotti, 2025). Even when institutions use AI models trained on licensed data or systems that honor opt-out requests, audiences can’t verify these claims.

The British Museum incident (critics called it “AI slop”—AI-generated promotional “models” replacing paid labor) demonstrates that trust doesn’t restore through technical assurances. Whether the AI used was “ethical” became irrelevant. The public sees institutional endorsement of a contested technology.

The EU AI Act, implemented in stages from 2024-2027, attempts to address provenance through transparency requirements and copyright protections (European Parliament, 2024). But as Bertin Martens notes, these provisions create new tensions: full application of copyright law would endanger EU access to competitive AI models, while looser enforcement leaves creators without meaningful recourse (Martens, 2025). Audiences don’t trust the distinction between “learning from” and “copying” artwork when the underlying process remains opaque and the economic benefits accrue to tech companies rather than original creators.

The missing infrastructure

Current AI governance frameworks assume institutions have three things that most don’t:

Capacity to evaluate technical claims. When a vendor promises “bias-free” or “privacy-preserving” AI, cultural institutions rarely have in-house expertise to verify these assertions. Unlike tech companies with dedicated AI ethics teams, most nonprofits operate on minimal technical infrastructure. In “Beyond the IT Office,” published in 2025 in the American Alliance of Museums’ Exhibition journal, Chang and MacDonald document how institutions are expected to make high-stakes AI decisions without the resources to properly evaluate them.

Processes for stakeholder engagement. Compliance frameworks rarely specify how to gather community input or when in the development cycle that input should shape decisions. This procedural void leaves institutions improvising, and often defaulting to post-deployment damage control rather than pre-deployment dialogue.

Mechanisms to assess governance debt. Every technical decision creates future obligations. Deploying a visitor analytics system today means committing to data security, privacy protection, and eventual decommissioning tomorrow. Cultural institutions lack tools to calculate this governance debt before making procurement decisions.

The Council of Europe recognized these gaps in March 2025, publishing guidelines specifically for cultural heritage and AI. The recommendations call for dedicated financial resources, enhanced professional capacity, and a European AI innovation hub for cultural institutions, acknowledging that current infrastructure is inadequate (Council of Europe, 2025).

An alternative governance process

Effective AI governance in cultural contexts requires building four ongoing practices; what amounts to an integrated integrity loop. These practices happen continuously, in parallel, informing each other throughout the life of any AI deployment:

Scenario Mapping. Before deploying any AI system, institutions should identify specific futures where the deployment erodes legitimacy. Not abstract risks, but concrete scenarios: What happens when a community discovers their cultural materials are in the training data? What happens when the system produces outputs that contradict curatorial expertise? What happens when the vendor’s business model shifts?

Stakeholder Dialogue. Engagement must happen before deployment, not after. This means identifying affected communities (artists, cultural practitioners, visitors, staff), creating structured opportunities for input, and documenting how that input shaped the final decision. The process itself builds legitimacy, even when stakeholders disagree with the outcome.

Values Stress-Testing. Every AI deployment should be evaluated against the institution’s stated values. Can you justify this decision beyond “it’s technically compliant”? Does this deployment advance your mission or just solve an operational problem? If your community asked why you did this, what would you say?

Governance Debt Assessment. Before procurement, calculate the long-term costs: ongoing maintenance, staff training, data security, eventual replacement. If you can’t resource these obligations, you can’t afford the system, regardless of upfront costs.

This approach ensures AI deployment decisions survive first contact with community scrutiny.

What policymakers and framework creators need to know

Cultural institutions expose three systematic gaps in current AI governance approaches:

Missing Legitimacy Infrastructure. Frameworks prioritize technical benchmarks over trust-building processes. Solution: Mandate pre-deployment stakeholder engagement, require documentation of community input, create accountability mechanisms for governance debt.

Missing Internal Capacity Resources. Small and mid-sized institutions can’t hire AI ethicists or legal teams. Solution: Fund open-source governance toolkits, shared-service models, and case study libraries. Create decision trees that help under-resourced institutions evaluate vendor claims and assess ethical implications without specialized expertise.

Missing Cultural Externalities in Risk Taxonomies. Current risk frameworks focus on technical failures, privacy violations, and discriminatory outcomes. They ignore cultural impacts: erosion of meaning, homogenization of creative expression, loss of cultural diversity. Solution: Expand risk taxonomies to include cultural externalities, create review mechanisms that center cultural practitioners’ expertise, fund research on AI’s long-term cultural impacts.

Ethical AI companies should want these infrastructures too. If you’re building tools that cultural institutions can actually trust, you need governance processes that go beyond compliance theater. The alternative is a market shaped by backlash cycles, where every deployment risks reputational damage because no one has the infrastructure to do this well.

Where this leads

The British Museum’s February 2026 incident followed a predictable pattern: deploy first, develop guidelines later, apologize when the community objects. This is reactive governance masquerading as risk management.

Cultural institutions have operated in legitimacy-dependent ecosystems for decades. They’ve developed practices for navigating community trust, managing stakeholder relationships, and calculating reputational costs. AI governance frameworks would be stronger if they learned from these practices.

References