Commentary. The argument over artificial-intelligence regulation has reached a familiar but dangerous stage: everyone agrees that safety matters, yet responsibility keeps being postponed to the next summit, the next framework or the next generation of models.
Our view is straightforward. Governments should stop treating voluntary AI commitments as a substitute for law. Companies developing the most powerful systems should face clear duties to test, disclose and mitigate serious risks before deployment—and those duties should be enforced by independent regulators.
The case for urgency is no longer theoretical. The European Union’s AI Act remains the world’s most comprehensive attempt to regulate the technology, covering issues including data quality, human oversight and cybersecurity. But implementation of some high-risk requirements has been delayed to December 2027, according to recent reporting.[1] A rule that arrives after harms occur is not a functioning safeguard.
Meanwhile, international coordination is weakening. A recent policy briefing described the United States as rejecting coordination on AI governance at the United Nations, even as several US states pursue their own oversight measures.[2] That patchwork may encourage experimentation, but it also gives firms incentives to move sensitive activity toward the least restrictive jurisdiction.
The strongest argument against heavy regulation
There are legitimate counterarguments. AI is advancing quickly, and rigid rules can become obsolete before they take effect. Smaller companies may struggle with compliance costs that large technology firms can absorb. Excessive restrictions could slow medical research, productivity gains and tools that benefit people with disabilities. The public should also be wary of allowing governments to define “safe” AI so broadly that censorship or political control follows.
These concerns deserve more than dismissal. Regulation should be proportionate, technologically neutral and focused on demonstrable harm rather than speculation. It should protect research and ordinary low-risk applications while imposing the toughest obligations on systems used in critical infrastructure, health care, employment, policing and finance.
But the answer to bad regulation is better regulation—not no regulation. The claim that innovation requires a legal vacuum is particularly unpersuasive when the industry itself is asking governments to act. Microsoft president Brad Smith has called for global safety rules, including breach reporting, outside evaluation and mechanisms to pause systems when necessary.[3] Industry support is welcome, but it cannot replace public accountability. Companies should not be allowed to write the rules, select their auditors and declare success.
What credible oversight would require
First, regulators need access. Frontier developers should be required to provide confidential technical documentation, testing results and incident reports to competent public authorities. Second, high-risk systems should undergo genuinely independent evaluation before release, with results published in a form the public can understand. Third, affected people need remedies: notice when automated systems make consequential decisions, a meaningful appeal process and compensation when negligence causes harm.
Fourth, lawmakers should address the infrastructure behind AI. Data centres consume substantial electricity and can shift costs onto households and local grids; US lawmakers have already debated whether operators should pay more of those costs.[4] The environmental and economic effects of AI cannot be separated from its software.
Finally, democratic governments should cooperate. Europe’s rules, US state initiatives and emerging British guidance will remain weaker if they evolve in isolation. Shared testing standards, incident reporting and minimum protections would reduce regulatory arbitrage without requiring identical laws.
The temptation is to celebrate every voluntary pledge as progress. Some pledges are useful, especially when they establish common language and encourage technical cooperation. Yet a “morally binding” promise is still not a legal duty, and an independent auditor chosen by the industry is not the same as an accountable regulator.[3]
AI policy should neither worship innovation nor fear it. The sensible position is more demanding: welcome useful systems, scrutinize powerful ones and insist that those who profit from risk cannot be the only people deciding how much risk society must bear. The next phase of the debate should be measured not by the number of declarations signed, but by whether ordinary people can challenge, understand and survive the decisions these systems make.