Commentary. Artificial-intelligence policy has entered its implementation era. The European Union’s AI Act became enforceable on 2 August, while regulators elsewhere are adding rules for automated decisions, chatbots, financial institutions and AI-generated content. The central question is no longer whether governments should regulate AI. It is whether they can do so clearly enough to protect people without freezing useful innovation.
Our view is that the next phase should be defined by enforcement, not by a race to produce more legislation. A growing rulebook can look like progress while leaving citizens unsure of their rights, companies unsure of their obligations and regulators without the staff or technical capacity to act.
The EU offers the clearest test. Its AI Act distributes responsibilities among providers, importers, distributors and deployers, with different obligations for prohibited, high-risk, general-purpose and transparency-related systems. Some high-risk requirements do not apply until 2027 or 2028, but enforcement powers have already begun to take effect. The European Commission is also consulting on procedures for investigating and penalising certain violations.[Source][Source]
That staged approach has merits. Complex systems cannot be governed responsibly through a single deadline, and phased obligations give organisations time to test documentation, risk assessments and human oversight. Transparency rules can also help people distinguish synthetic material from human-created work, an increasingly urgent need as AI-generated content spreads through public life.
But delay creates its own danger. A person denied a job, loan, benefit or educational opportunity cannot be comforted by knowing that a stronger compliance deadline is two years away. Nor does a label alone reveal whether an automated decision was fair, accurate or contestable. Regulators must therefore prioritise remedies: accessible explanations, independent appeals and meaningful audits where automated systems affect someone’s life.
The case for restraint
The counterargument deserves respect. AI development is fast, international and economically significant. Excessively prescriptive rules could burden small firms, push investment elsewhere or prevent hospitals, schools and public agencies from adopting tools that improve services. In the United States, policymakers have favoured a more fragmented approach: states have continued legislating on consequential automated decisions and chatbot use, while no federal AI bill had passed in the 2026 session according to the Center for Democracy & Technology.[Source]
That patchwork may be inefficient, but it reflects a legitimate concern. A poorly designed rule can turn compliance into paperwork rather than safety. Regulators should avoid treating every algorithm as equally risky, and they should make room for controlled experimentation, especially where the potential public benefit is substantial and human supervision remains strong.
Yet “innovation” cannot become a synonym for immunity. A system used to recommend a film is not equivalent to one used to screen applicants for housing. Risk-based regulation is sensible only if high-risk categories are broad enough to capture real-world harm and if companies cannot evade them by changing labels or outsourcing deployment.
Build the capacity to enforce
The practical priority is investment in institutions. Financial regulators are already moving in this direction: Singapore’s monetary authority issued AI risk-management guidelines in October, with governance requirements scheduled to begin in 2027 and further lifecycle controls in 2028.[Source] Similar expectations should apply across sectors, supported by technical experts who can inspect models rather than merely review corporate assurances.
Governments should publish enforcement statistics, clarify which complaints they will investigate and protect researchers and workers who expose dangerous failures. Companies, for their part, should disclose enough about training, testing and deployment to permit scrutiny without forcing them to reveal legitimate trade secrets.
The goal is not maximal regulation. It is credible regulation: rules that ordinary people can understand, businesses can follow and public authorities can enforce. The AI governance race will be won not by the jurisdiction with the longest statute book, but by the one that can demonstrate that its safeguards work when someone is actually harmed.