Commentary. The latest wave of artificial-intelligence regulation is encouraging—but not yet reassuring. Governments are finally treating AI as infrastructure with public consequences rather than merely another consumer product. Yet the proliferation of consultations, guidelines and voluntary frameworks risks creating the appearance of control without guaranteeing that anyone can be held responsible when systems fail.
That distinction matters. In October, the European Commission opened a consultation on procedures for investigating and penalising providers of certain AI systems under the EU AI Act. The initiative is an essential step toward enforcement, but rules are only as credible as the institutions able to apply them consistently and quickly. A regulation that arrives after a harmful system has scaled across millions of users is a warning label, not protection.
The United Kingdom’s Law Commission has likewise proposed extending product-liability law to AI systems. That approach deserves serious support because it moves the debate away from abstract “trust” and toward a familiar principle: companies that profit from products should bear meaningful responsibility for foreseeable harm. Consumers should not have to prove the inner workings of an opaque model before seeking redress.
Still, liability alone cannot solve the problem. Litigation is slow, expensive and unevenly accessible. It may compensate some victims while leaving dangerous business practices intact. Regulators need powers to inspect systems before deployment, demand records, suspend unsafe uses and impose penalties large enough to outweigh the commercial benefits of cutting corners.
Financial regulators appear to understand this better than many general-purpose policymakers. Singapore’s monetary authority has issued AI-risk-management guidelines for financial institutions, covering governance, inventories, materiality assessments, lifecycle controls and third-party systems. The phased timetable gives firms time to prepare, but it also illustrates the central weakness of gradualism: a system can be operational long before the strongest safeguards become mandatory.
There is a legitimate counterargument. Excessively prescriptive rules could entrench the largest technology companies, which can afford compliance departments, audits and legal advice while smaller firms cannot. Regulators could also freeze useful experimentation in medicine, education and public services. The European Union’s consultation-based approach, and Singapore’s risk-proportionate model, reflect a reasonable attempt to avoid imposing identical obligations on a low-risk translation tool and an autonomous system making consequential decisions.
But flexibility should not become a loophole. The relevant question is not whether a model is labelled “general purpose,” “agentic” or “experimental.” It is what the system can do, whom it affects and how difficult the harm would be to reverse. An AI agent that can access financial accounts, approve benefits or alter medical records deserves stricter controls than a chatbot drafting a birthday invitation—regardless of the marketing language surrounding it.
The public also needs transparency. Regulators should publish incident registers, enforcement decisions and clear explanations of which uses are prohibited, restricted or permitted. Companies should disclose significant failures and preserve logs that allow independent investigators to reconstruct what happened. Without that evidence, citizens are asked to trust both the technology and the institutions supervising it.
Industry will argue, correctly, that regulation must be internationally coherent. Fragmented national rules can raise costs and make compliance confusing. Cross-border coordination is therefore valuable. But harmonisation should not mean settling on the weakest common denominator. Countries can align definitions and reporting standards while retaining the right to impose tougher safeguards where local risks demand them.
The European Commission’s work, Britain’s liability proposal and Singapore’s financial-sector guidelines point toward a more mature debate. The task now is to convert principles into consequences. That means independent oversight, enforceable duties, accessible remedies and public records of failure—not another cycle of polished commitments.
Our view is simple: AI innovation should continue, but accountability must scale with capability. The test of regulation is not how confidently officials describe responsible innovation. It is whether an ordinary person harmed by an automated decision can find out what happened, challenge it and obtain a remedy. Until that is true, the world has more AI policy than AI accountability.