Commentary. Artificial intelligence regulation is entering a more consequential phase. The debate is no longer limited to whether governments should act; it is increasingly about who will set the rules, how those rules will be enforced and who will bear the cost when automated systems cause harm.
Our view is straightforward: voluntary commitments have a role, but they cannot be the foundation of public protection. AI systems are becoming embedded in finance, employment, public services and online life. The institutions deploying them should face clear duties, meaningful oversight and accessible routes to compensation when things go wrong.
Recent developments point in that direction. The European Commission has opened a consultation on procedures for investigating and penalising certain AI providers under the EU AI Act, while England and Wales’ Law Commission has proposed extending product-liability principles to AI systems. Singapore’s financial regulator has also issued risk-management guidelines covering generative AI and AI agents, with implementation scheduled in stages from 2027.[1]
These measures matter because accountability cannot end with the sentence that an algorithm made the decision. A customer denied a financial service, a worker screened out of a job or a patient affected by an automated recommendation still needs to know what happened and what remedy is available. Regulation should make responsibility traceable across the chain: model developers, deployers, vendors and senior executives should not be able to pass blame indefinitely.
The case against heavy-handed rules
The counterargument deserves serious attention. AI development is moving rapidly, and badly designed regulation could entrench the largest companies, raise compliance costs for smaller firms and delay beneficial applications in medicine, education and scientific research. Businesses also need room to test systems before every uncertainty becomes a legal violation.
That concern is not theoretical. The EU’s regulatory system is already complex, and uncertainty over standards, liability and enforcement can discourage investment. A rule that treats a low-risk administrative tool like a high-impact system used in policing or credit assessment would be both expensive and irrational.
Regulators should therefore avoid trying to approve every model in advance. Risk-based rules are preferable: strict obligations for systems that affect fundamental rights or essential services, lighter requirements for low-risk uses, and rapid review when evidence shows that a supposedly safe application is producing serious harm.
Why self-regulation is not enough
Still, the answer cannot be to leave safeguards to corporate discretion. In the United States, federal lawmakers have struggled to reach agreement while states pursue their own protections; meanwhile, banks have reportedly restricted some third-party AI agents after concerns that they could access accounts or act beyond users’ instructions.[2] A patchwork can be inefficient, but the absence of enforceable standards is worse.
Industry commitments can help establish technical norms and encourage information-sharing. They are useful when they supplement law, not when they substitute for it. Companies face commercial incentives to release capable systems quickly, and those incentives do not always align with the public interest. Independent audits, incident reporting and regulator access are needed precisely because promises made by interested parties are not the same as accountability.
International coordination is equally important. AI providers operate across borders, while national regulators often investigate the same risks separately. European lawmakers have called for stronger international action, including discussion of binding global rules, but any treaty will take time.[3] Governments should pursue common definitions and reporting standards now, without waiting for a perfect global settlement.
The standard that should guide policy
The best test for an AI rule is not whether it sounds tough or friendly to innovation. It is whether an ordinary person can understand who made a consequential decision, challenge it promptly and obtain a remedy when the system was wrong.
That standard would require transparency proportionate to risk, human review where automated decisions can materially affect lives, protection for whistleblowers and penalties large enough to deter corner-cutting. It would also require regulators to publish enforcement decisions so that compliance becomes a shared learning process rather than a private negotiation.
Climate policy offers a warning about delay. Recent assessments say global emissions may have plateaued, yet current policies still put the world on course for substantially more than the Paris Agreement’s temperature goals.[4] AI governance should not repeat the pattern of waiting for undeniable damage before building institutions capable of responding.
Innovation and accountability are not opposing values. Durable innovation depends on public trust, and trust is earned when people know that powerful systems can be questioned and corrected. Governments should regulate AI firmly, proportionately and transparently—not to stop progress, but to ensure progress remains answerable to the public.