Commentary. The United States is approaching an avoidable choice on artificial-intelligence policy: accept fragmented state rules and voluntary corporate promises, or establish a clear national framework for the most powerful systems. Our view is that Congress should choose the latter—not to suppress innovation, but to make it accountable.
The political debate has moved faster in recent months. California and New York are advancing safeguards while federal lawmakers remain divided over testing, audits and enforcement. Bipartisan discussions have stalled, even as prominent technology executives have called for stronger protections after security incidents involving their own models. Congressional negotiations and state-level action show both the urgency and the cost of delay.
The case for national rules is straightforward. Frontier AI developers operate across state lines, and the consequences of a serious failure would not respect them. A model that facilitates a major cyberattack, exposes sensitive data or causes widespread economic damage cannot be regulated effectively through fifty separate standards. Companies also need predictable rules: a uniform baseline is easier to follow than a shifting map of state obligations.
There is already a plausible starting point. A bipartisan House proposal described by the Center for European Policy Analysis would create nationwide requirements for catastrophic-risk transparency, reporting and auditing. It would also establish independent evaluators and require developers to retain the ability to throttle or suspend a system if it threatened severe economic harm or loss of life. Those ideas deserve serious consideration, even if their thresholds and enforcement mechanisms require substantial refinement.
Opponents are right to warn against careless regulation. AI remains a rapidly changing technology, and rigid licensing systems could entrench the largest firms by making compliance too expensive for smaller competitors. Government agencies may also lack the technical expertise to judge every model, while premature rules could prevent beneficial applications in medicine, education and scientific research. Some lawmakers therefore favor company-led evaluations, arguing that flexibility is safer than a bureaucracy built around yesterday’s technology. Those concerns have shaped competing proposals, ranging from liability rules to pre-release approval.
But the choice is not between maximal government control and no rules at all. The better approach would target capability and demonstrable risk, not the mere use of AI. Small businesses deploying ordinary productivity tools should not face the same regime as laboratories building systems capable of autonomous cyber operations or large-scale manipulation. Requirements should be graduated, publicly explained and revised on a fixed schedule as evidence changes.
What responsible regulation would require
- Independent testing for the highest-risk systems, with confidential technical details protected where disclosure would create new dangers.
- Clear incident-reporting duties, including timelines and penalties for concealment.
- Auditable records showing how developers assessed model capabilities and mitigated known risks.
- Liability rules that prevent companies from treating foreseeable harm as nobody’s responsibility.
- Public funding for research, standards and technical capacity inside government.
Corporate self-policing can remain part of this system, but it cannot be the system. Companies face legitimate pressure to release products quickly, satisfy investors and protect trade secrets. Voluntary commitments may produce useful practices, yet they offer no durable guarantee when commercial incentives change. Independent oversight is not an accusation against every developer; it is a recognition that safety claims should be testable by someone other than the seller.
Nor should lawmakers confuse speed with wisdom. A rushed statute could lock in bad definitions, empower agencies without adequate safeguards or turn political anxiety into censorship. Any national law should include due-process protections, judicial review and sunset or review provisions. It should distinguish harmful conduct from unpopular ideas and preserve room for legitimate research.
Still, uncertainty is not neutrality. In the absence of federal standards, the public bears the risks while companies and states negotiate the rules piecemeal. The responsible compromise is neither a ban nor a blank check: it is enforceable oversight focused on the systems most capable of causing irreversible harm.
Congress should act before the next crisis supplies the political timetable. Innovation will be stronger—not weaker—when people can trust that the most powerful AI systems are tested, monitored and answerable to the public.