Commentary. The world is entering an awkward phase of artificial-intelligence regulation: lawmakers are no longer debating whether rules are necessary, but whether an expanding patchwork of rules can actually protect people. Our view is straightforward: regulation should move ahead, but governments must stop measuring progress by the number of laws, consultations and guidance documents they announce.
Recent developments show both momentum and fragmentation. The European Union’s AI Act entered a new enforcement phase in August 2026, while the European Commission has consulted on how to investigate and penalize certain providers. New York is preparing requirements for large frontier-AI developers, including transparency, safety and incident reporting. Colorado has replaced an earlier automated-decision law with a revised framework, and Connecticut is phasing in rules covering AI transparency and companion chatbots.[Source][Source][Source]
This is not bureaucratic noise. Automated systems increasingly influence employment, housing, finance, education and access to services. When a person is rejected by a system they cannot inspect, a disclosure and a route to appeal are not luxuries. They are basic conditions of accountable decision-making. Rules requiring documentation, risk assessment and incident reporting can give affected people and regulators the information needed to challenge harm.
But the case for regulation is not a case for regulatory maximalism. Smaller companies may lack the money and legal staff required to comply with overlapping regimes. Vague definitions can encourage defensive paperwork rather than safer products. Rules that demand extensive audits without ensuring qualified auditors exist may produce certificates that look reassuring while missing serious risks. The concern that compliance could entrench the largest technology firms is legitimate, particularly when complex obligations favor companies already able to absorb them.
Those objections should change the design of regulation, not end the project. The answer is proportionality: lighter obligations for low-risk applications, stronger duties where systems affect rights or safety, and clear exemptions for research and genuinely narrow tools. Regulators should coordinate their terminology and reporting templates so a company is not forced to answer the same question in five incompatible formats.
The enforcement gap
The more serious danger is that governments will create rules faster than they build the institutions needed to enforce them. Europe’s implementation work, New York’s coming requirements and state-level U.S. laws all depend on regulators with technical expertise, stable budgets and authority to demand evidence. Without those capacities, the public receives promises rather than protection.
Enforcement also needs to be visible. Agencies should publish anonymized case studies, explain why they opened investigations and disclose meaningful penalties when violations are proven. Companies should not be allowed to treat safety reports as confidential marketing material. At the same time, regulators must protect legitimate trade secrets and avoid publishing details that would help malicious actors exploit systems.
There is a further risk in treating AI regulation as a contest between innovation and restraint. That framing is convenient, but false. Clear rules can improve competition by preventing responsible firms from being undercut by businesses that ignore safety, privacy or discrimination risks. They can also give customers confidence to adopt useful systems. Innovation without trust is a short-term strategy.
Critics are right that poorly drafted laws can slow beneficial experimentation. They are wrong if they conclude that the alternative is voluntary self-policing. The history of high-impact industries offers little reason to believe that pledges alone will consistently protect people when commercial incentives point the other way.
Our position is therefore conditional but firm: governments should regulate AI according to demonstrable risk, focus on outcomes rather than paperwork, and fund enforcement before announcing the next layer of obligations. The public does not need an impressive shelf of statutes. It needs to know when AI is being used, who is accountable, how errors can be challenged and what happens when companies fail.
The regulatory race will not be won by the jurisdiction that produces the longest rulebook. It will be won by the one that makes rights understandable, oversight credible and correction possible. That is the standard policymakers should now be judged against.