Do current AI governance frameworks capture shifting stakeholder roles?

A scoping review of LLM assistants that extend beyond a single user argues that current AI-governance frameworks, while they already "provide foundations for considering people beyond the immediate user," stop short of the finer-grained relationships multi-party assistant risk actually turns on. The review credits the OECD Framework with distinguishing users from "directly and indirectly impacted stakeholders," the NIST AI Risk Management Framework with emphasizing "context, affected stakeholders, organizational responsibilities, monitoring, and feedback throughout the AI lifecycle," and the EU AI Act with translating these concerns into "requirements for specified systems, including risk management, transparency, record-keeping, human oversight, and post-market monitoring," plus a fundamental rights impact assessment for high-risk deployments that considers "categories of people and groups likely to be affected in the context of use."

Against that backdrop, the review's own findings describe risks that "often depend on whose information is accessed or reused, whose preference is represented, whose instruction carries authority, whose resource is acted upon, and who is exposed to the resulting output." It argues these relationships "may coexist or change within the same interaction" — a bystander's speech may be captured, then a co-user's instruction acted on, then the primary user exposed to the result, all inside one exchange — "and are less explicitly captured by broader categories such as user, affected stakeholder, deployer, or provider." The conclusion drawn is that multi-party governance needs to represent these shifting relationships at the point where "information, state, and action are handled," not only classify people into fixed roles set in advance.

This sits on top of the review's own pathway-and-risk taxonomy, recorded in How do single-user AI assistants actually involve multiple people?, as the policy argument built from that empirical mapping: the pathways and risks are exactly what the fixed stakeholder categories miss. It also bears on Can AI systems delegate tasks back to humans?, since a delegation relationship reversed between an AI artifact and a human is the kind of shifting authority the review says stakeholder categories do not track. Where How well do AI assistants actually support human agency? measures whether an assistant supports one user's agency, this review's governance argument asks a different and prior question: whose agency and authority a given moment of operation is even supposed to represent.

The review does not propose or test a revised framework, and does not say which specific provision of the OECD Framework, NIST AI RMF or EU AI Act would need to change; it states only that current categories are coarser than the relationships its own pathway findings describe. It also does not say whether any governance body has acted on this gap since the review's September 2026 search cutoff. The claim is a critique of category granularity in existing frameworks, not a proposal, a legal analysis, or evidence that the gap has caused a specific documented harm.