Commentary: The argument over artificial intelligence regulation has become trapped between two slogans: move fast and do not break things, or regulate before the technology causes irreversible harm. Both instincts contain truth. But the public deserves something more practical than a culture war over innovation. It needs enforceable rules, transparent institutions and remedies when automated systems cause damage.
The regulatory landscape is already changing. The European Union’s AI Act became enforceable on Aug. 2, 2026, giving the EU AI Office and national market-surveillance authorities enforcement powers over different categories of AI systems. A legal analysis of the Act’s implementation describes the new division of responsibilities.[1] In the United States, meanwhile, states continue to legislate on chatbots, automated decisions, frontier models and public-sector uses, while no federal AI bill had passed in the current session as of late October, according to the Center for Democracy and Technology.[2]
Our view is straightforward: regulation should focus less on whether a system is branded “artificial intelligence” and more on what it can do to people. A chatbot that drafts a shopping list is not the same public risk as software that influences a person’s access to housing, employment, credit, education or essential services. The latter systems deserve disclosure, independent testing, records of how decisions were made and a realistic way to challenge them.
The case for caution
Supporters of stronger rules are not merely trying to slow technology. Automated systems can reproduce discriminatory patterns, expose personal data, generate convincing falsehoods and shift responsibility from identifiable decision-makers to opaque software. Those risks become more serious when systems operate at scale or make decisions affecting people who cannot opt out.
Recent state activity reflects that concern. The CDT’s review notes movement on automated decision-making in employment, housing, finance and education, as well as requirements concerning third-party auditing and frontier-model risks.[2] California has also enacted rules concerning AI auditors, companion chatbots and customer-service chatbots, while Connecticut’s expanded privacy framework took effect Oct. 1, according to a recent regulatory survey.[3]
These measures will not automatically protect anyone. A disclosure that is technically complete but unreadable is not meaningful transparency. An audit paid for and controlled by the vendor may identify weaknesses without creating accountability. And a right to appeal is hollow if the appeal is slow, expensive or decided by the same system that produced the original result.
The case against overreach
The opposing argument deserves equal seriousness. Heavy compliance costs can burden smaller companies more than dominant platforms, discourage beneficial research and push development toward jurisdictions with weaker safeguards. Vague rules can also produce defensive behavior: companies may withdraw useful tools from schools, hospitals or public agencies rather than navigate unpredictable liability.
That is why blanket bans and one-size-fits-all paperwork are poor substitutes for risk-based oversight. Singapore’s Monetary Authority, for example, issued guidelines in October covering all forms of AI used by financial institutions while phasing implementation over several years. The framework applies proportionately and begins with governance and core risk-management requirements before later lifecycle controls.[4] That model points toward a sensible principle: the greater the potential harm, the stronger the evidence, supervision and human accountability required.
What enforcement should mean
Governments should now concentrate on four basic tests. First, people should know when an AI system materially affects them. Second, high-impact systems should be tested for accuracy, bias, security and foreseeable misuse before deployment and periodically afterward. Third, operators should preserve enough records to reconstruct consequential decisions. Fourth, affected people should receive timely human review and compensation when preventable failures cause harm.
Regulators also need technical capacity and independence. Rules without inspectors, funding and penalties calibrated to corporate resources will become public relations. At the same time, enforcement should distinguish negligence from good-faith experimentation and give companies clear compliance guidance before imposing punishment.
The temptation will be to measure success by the number of laws passed or principles announced. That would be a mistake. The meaningful measure is whether a tenant can contest an algorithmic rejection, whether a patient can learn how an automated recommendation was produced, and whether a worker can obtain redress without proving the mathematics of a proprietary model.
Innovation is not the opposite of accountability. For technologies that increasingly mediate access to opportunity, accountability is part of the infrastructure that makes innovation trustworthy.
AI will continue to develop faster than legislatures prefer. That is not an argument for surrendering public oversight; it is an argument for designing rules that can be updated, independently tested and enforced in the real world. The future should not be decided by the loudest promise from industry or the loudest fear from its critics. It should be judged by whether people retain knowledge, choice and recourse when machines enter decisions that shape their lives.