Commentary. The argument over artificial-intelligence regulation is often framed as a choice between innovation and restraint. That is the wrong choice. The real question is whether societies will establish credible safeguards before the systems now entering workplaces, schools and public services become too embedded to govern effectively.
Our view is that governments should set a narrow, enforceable floor of protections—especially for high-impact decisions, children’s safety, transparency and independent testing—while leaving room for experimentation above it. The alternative is not freedom. It is a confusing patchwork in which protections depend on a person’s state, employer or access to legal resources.
The United States is already moving in that direction. The Center for Democracy & Technology says state lawmakers in 2026 have continued to address automated decisions in employment, housing, finance and education, while also considering frontier-model risks and third-party auditing. It counts 69 AI bills introduced across 26 states during the current session, with three enacted at the time of its September update.[1]
That activity reflects a legitimate democratic impulse: when federal action is slow, states respond to harms in their jurisdictions. Colorado’s replacement of an earlier automated-decision law, however, also illustrates the cost of regulatory volatility. The revised measure removed several developer duties, including risk-management and impact-assessment requirements, according to the CDT analysis.[1] Businesses may welcome clearer obligations, but people subjected to opaque systems may reasonably see the rollback as a loss of accountability.
The case for caution
Opponents of broad regulation are not simply defending recklessness. They argue that rules written before technology stabilizes can freeze immature assumptions, burden smaller companies and hand an advantage to the largest firms, which can afford compliance teams and lawyers. Those concerns deserve weight. A law that treats every chatbot like a medical device would be both impractical and counterproductive.
Industry pressure is also evolving. Politico reports that executives from Microsoft and Google have questioned whether the European Union’s 2024 AI Act remains fit for purpose after incidents involving autonomous AI agents. The same report describes unresolved questions about systems used internally rather than offered on the market.[2] Regulation that cannot clearly define what it covers will invite litigation, delay and strategic evasion.
But those objections support better rules, not no rules. The EU’s experience suggests that legislators should regulate concrete risks rather than chase every technical development. A system that screens job applicants, recommends housing decisions or interacts with minors warrants more scrutiny than a tool that drafts a meeting agenda. Requirements should scale with potential harm and be revised through transparent evidence, not private lobbying.
The minimum policymakers owe the public
First, people should know when they are dealing with an AI system and when it materially influences a consequential decision. Disclosure alone is insufficient, but secrecy makes every other safeguard weaker.
Second, high-impact systems should face independent testing, documentation and a meaningful route for human review. “Human oversight” cannot mean a busy employee rubber-stamping a machine’s output. It must include authority to correct errors and an explanation of who is responsible.
Third, children deserve stronger protections. The CDT identifies a large number of state proposals concerning chatbots, conversational AI and AI companions, including measures aimed at disclosure, personalization and advertising to minors.[1] Some proposals may be overbroad, but the underlying concern is sound: systems designed to maximize engagement should not be allowed to exploit immature users without clear limits.
Finally, policymakers should cooperate across borders where risks cross borders. A recent policy briefing noted that the United States rejected international coordination at the United Nations even as other governments pursue their own oversight approaches.[3] National standards will remain necessary, but incompatible rules will make enforcement harder and give the most powerful companies another reason to shop for the weakest jurisdiction.
Innovation will continue without permission from legislators. That is precisely why the public needs a baseline: not to decide which technologies may exist, but to ensure that speed does not erase responsibility. The sensible compromise is neither a regulatory freeze nor a blank cheque. It is a durable floor, regularly updated, beneath which no AI system used in consequential settings should be allowed to fall.