Commentary. The artificial-intelligence debate has reached an unhelpful stage: governments are being urged either to regulate immediately or to stand aside while innovation accelerates. Our view is less dramatic and more demanding. Rules are necessary, but their value will be measured by enforcement, evidence and accountability—not by the number of laws announced.
The European Union offers the clearest test. The AI Act is now enforceable, with the EU AI Office and national market-surveillance authorities receiving powers over general-purpose models and other AI systems.[1] The bloc has also adopted an “AI Omnibus” intended to simplify implementation of harmonised rules.[2]
That combination—legal obligations paired with an effort to reduce compliance complexity—points toward the right principle. Companies should know what is required, regulators should have the capacity to inspect and penalise, and citizens should have meaningful remedies when automated systems affect employment, credit, education or access to services.
Yet the case against hurried regulation deserves a fair hearing. Smaller developers may struggle with documentation, testing and auditing requirements designed with the largest firms in mind. Overlapping national rules can fragment markets and raise costs without improving safety. Some technical standards may become obsolete before they are implemented. In a field moving this quickly, inflexible rules can protect yesterday’s risks while missing tomorrow’s.
Those objections are not arguments for voluntary promises alone. In the United States, federal AI legislation has not advanced in the current session, while states continue to pursue their own safeguards for consequential decisions, frontier-model risks and public-sector use.[3] The resulting patchwork may be awkward, but it reflects a real failure: national lawmakers have not yet agreed on which harms require a common baseline.
Voluntary commitments can help bridge that gap, especially when technology changes faster than statute books. But they cannot substitute for independent verification. A company’s promise to test a model is not the same as a public standard for what must be tested, who reviews the results, or what happens when a system fails. The debate over mandatory evaluations—whether they should be conducted by government experts or rely mainly on company assessments—remains unresolved.[4]
What proportionate oversight looks like
Regulators should begin with consequences, not headlines. A chatbot generating an occasional inaccurate answer is not equivalent to an automated system denying a person housing or employment. High-impact uses should face stronger duties: clear records, impact assessments, human review, avenues for appeal and liability that cannot be shifted entirely onto users.
Rules should also distinguish between model developers, deployers and institutions that make final decisions. A hospital, bank or government agency cannot escape responsibility by blaming a vendor. At the same time, a developer should not be held accountable for every unforeseeable misuse of a general-purpose tool. Clear allocation of responsibility is more useful than broad language that invites years of litigation.
Financial regulators are beginning to illustrate this risk-based approach. Singapore’s monetary authority has issued AI risk-management guidelines covering governance, inventories, materiality assessments, lifecycle controls and third-party systems, with implementation phased over several years.[5] That timetable may frustrate advocates seeking immediate protections, but phased implementation can give institutions time to build competent oversight—provided deadlines are real and supervision is credible.
Our position is therefore neither “regulate everything” nor “let the market decide.” Governments should establish enforceable minimum rights, publish practical technical guidance and coordinate across borders. Companies should disclose meaningful information about testing, limitations and incidents. Civil society and affected communities should have a voice before systems are deployed, not after harm becomes a case study.
The central question is not whether AI regulation will slow some projects. It probably will. The question is whether society is willing to accept speed as the overriding public value. We are not. Innovation that survives scrutiny is stronger innovation, and public trust earned through accountability is a competitive advantage—not an obstacle.