Commentary. Artificial intelligence is no longer waiting for lawmakers to decide what it is. It is already being used in hiring, education, finance, public services and intimate conversations. The question is not whether governments should regulate it, but whether their rules will be strong enough to matter.
Our view is straightforward: voluntary safeguards can be useful, but they cannot be the foundation of public protection. Companies should be free to innovate, yet the most consequential systems should face mandatory disclosure, independent testing and meaningful penalties when preventable harm occurs.
A fragmented response
The regulatory landscape is moving in several directions at once. The European Union has adopted a risk-based AI Act, with stricter obligations for systems considered more dangerous. The United States remains more dependent on executive action, voluntary commitments and state-level legislation, while China is developing a state-directed framework of its own.[1]
In the United States, the result is an uneven patchwork. The Center for Democracy and Technology reports that states are addressing automated decisions in employment, housing, finance and education, while Congress has not passed comprehensive federal AI legislation in the current session.[2] That approach may allow experimentation, but it also leaves citizens with different protections depending on where they live.
Industry has not ignored the issue. A recent US accord with major technology companies calls for internal controls, external auditing and board-level review, while leaving open the possibility of future legislation.[3] Such commitments are better than silence. They can also help establish technical standards faster than formal law.
Why promises are insufficient
The problem is accountability. A company that voluntarily reports its own safety failures is being asked to judge its commercial interests against the public interest. That is an unstable bargain, especially when releasing a more powerful model can bring enormous financial and competitive rewards.
Independent audits would not eliminate risk. Auditors can miss problems, and regulators may lack the expertise to evaluate rapidly changing systems. But transparent, recurring assessments would create a record that researchers, workers and affected individuals could challenge. They would also make it harder for companies to treat safety language as public relations.
The stakes are clearest where automated decisions can alter a person’s livelihood. State lawmakers are considering rules for high-impact uses, and Connecticut is moving toward requiring certain employers to disclose whether AI contributed to mass layoffs.[4] Disclosure does not guarantee justice, but secrecy makes justice nearly impossible.
The case against overregulation
There are legitimate objections. Heavy compliance costs could favor the largest technology firms, making it harder for smaller companies, universities and public-interest developers to compete. Vague rules could discourage beneficial applications in medicine, accessibility and scientific research. Policymakers also risk regulating yesterday’s systems while missing tomorrow’s dangers.
Those concerns argue for proportionate regulation, not regulatory surrender. Rules should focus on outcomes and uses rather than imposing identical burdens on a spam filter and a system that recommends whether someone receives housing or employment. Small organizations should receive technical support and sensible exemptions where risks are demonstrably low.
The EU’s experience also shows that regulation is not automatically permanent or perfect. European policymakers have already faced pressure to delay or adjust some compliance deadlines, illustrating the tension between enforceability and practical implementation.[5]
What responsible oversight requires
Governments should establish a baseline built around four principles: clear notice when AI is materially involved; independent testing for high-risk systems; accessible avenues to appeal harmful decisions; and penalties large enough to outweigh the benefit of cutting corners. Regulators should publish audit methods and protect whistleblowers who reveal concealed risks.
This is not an argument against innovation. It is an argument for directing innovation toward systems that can earn confidence. The technology industry is right that governments must understand AI before legislating it. Governments are right that companies cannot be the sole authors of the rules governing their own power.
At Archange Shadows, we believe the sensible compromise is neither a blanket moratorium nor a handshake agreement. It is enforceable oversight that scales with risk, leaves room for useful experimentation and gives the public a meaningful remedy when systems fail. Voluntary action can be the first layer. It should never be the last.