Commentary. Artificial intelligence regulation has entered its implementation phase, and that is where political ambition meets administrative reality. The European Union’s AI Act is now enforceable, while the European Commission is consulting on procedures for investigating and penalising certain providers. In the United States, states continue to legislate across employment, housing, finance, education and chatbot safety, even as Congress has yet to pass a comprehensive federal law. Our view is straightforward: governments should regulate AI firmly, but they should stop treating the number of new rules as a measure of public protection.
The case for regulation is not theoretical. Automated systems can influence whether someone gets a job, receives credit, finds housing or accesses education. Generative systems can also produce deceptive content at scale, while companion chatbots raise particular questions about children’s safety and emotional dependence. The EU framework takes a risk-based approach, applying tougher obligations to systems considered high-risk and prohibiting some uses outright. Separately, the EU’s proposed KIDS Act would introduce dedicated restrictions for AI chatbots and companion applications used by minors. Eurofound’s overview of the AI Act and a recent legal analysis of the proposed KIDS Act document that expanding agenda.
These measures reflect a sensible principle: people should not have to discover a system’s dangers only after suffering them. Transparency, human oversight, impact assessments and routes to challenge automated decisions are basic safeguards, not bureaucratic luxuries. The EU’s Platform Work Directive, due for national transposition by December 2026, is especially significant because it addresses algorithmic management, worker information and human oversight. Those protections acknowledge that workplace software is not merely a productivity tool; it can shape income, dignity and bargaining power.
Yet the opposing argument deserves more than a dismissive response. Businesses—particularly smaller firms—warn that overlapping obligations, uncertain definitions and expensive compliance could slow innovation or push investment elsewhere. Europe’s 2026 Digital Omnibus already seeks to simplify parts of the AI rulebook, expand testing opportunities and improve consistency with other legislation. That adjustment is not proof that regulation has failed. It is evidence that lawmakers are confronting the cost of rules written faster than institutions can apply them. Legal analysis of the Digital Omnibus describes that effort.
The American patchwork presents the opposite danger. State experimentation can reveal which protections work, and local lawmakers may respond faster than Washington. But conflicting duties for companies and unequal rights for citizens are poor foundations for a technology that operates across state lines. The Center for Democracy & Technology reports continued state action on consequential automated decisions, frontier-model risks, auditing and public-sector use, while no federal comprehensive AI bill had passed in the current session. A national baseline should not erase stronger state protections, but it should establish common minimum rights.
Our concern is therefore not that governments are regulating too much in the abstract. It is that they may regulate visibly rather than effectively. Disclosure labels are useful, but a label cannot repair a discriminatory hiring model. A risk assessment is valuable, but only if an affected person can challenge the outcome. An age gate may help protect children, but it cannot substitute for safer product design, meaningful parental controls and accountability when harm occurs.
The most credible policy would concentrate on three tests. First, can people understand when an AI system materially affects them? Second, can they obtain a human review and a remedy? Third, can regulators inspect evidence, impose penalties and make those penalties meaningful? Product-liability reforms under consideration in England and Wales point toward an important next step: treating certain AI systems as products for which responsibility must be traceable, rather than allowing every failure to disappear into technical complexity. The Law Commission consultation is summarised here.
Innovation and accountability are not natural enemies. Clear rules can give responsible developers confidence, help public institutions buy safer systems and prevent companies from competing by externalising risk. But clarity requires restraint: fewer overlapping demands, stronger enforcement and rights written in language ordinary people can use.
AI policy should ultimately be judged by the person denied a loan, the worker managed by an opaque score, the child targeted by a persuasive bot and the citizen trying to correct a false record. If regulation cannot help those people, its sophistication is beside the point. The next phase should be less about announcing another framework and more about proving that existing promises can be enforced.