Commentary. The central question in artificial-intelligence policy is no longer whether governments should regulate AI. That argument has already been settled by events. The question is whether lawmakers can enforce rules that protect people without smothering useful innovation.
Our view is straightforward: regulation should be judged by what it makes possible in the real world, not by the ambition of its language. A law that demands transparency, accountability and redress but leaves regulators without technical capacity, funding or clear jurisdiction is not protection. It is political theater.
The European Union is now entering that test. The EU AI Act’s enforcement regime became operational in August 2026, giving the European Commission and national market-surveillance authorities powers over prohibited, high-risk and transparency obligations.[Source] The Commission has also opened a consultation on rules governing investigations and penalties for certain AI systems.[Source]
That transition matters. Europe’s law has often been treated as a model because it attempts to regulate risk rather than simply ban a technology. But the model will be credible only if enforcement is consistent. Companies need predictable standards, citizens need meaningful remedies, and smaller developers need a path to compliance that does not assume the legal and engineering budgets of a multinational.
The case for tougher rules
The argument for firm oversight is compelling. AI systems increasingly influence employment, housing, finance, education and access to public services. Errors in these settings are not merely inconvenient; they can deny someone an opportunity while hiding the reason behind a complex model. Regulators also face fast-moving risks from deepfakes, automated fraud and systems that imitate human conversation convincingly.
Developments in the United States illustrate the pressure for action. The Center for Democracy and Technology reports that state lawmakers have continued to address automated decisions in consequential areas, public-sector uses and frontier-model risks. It also counted 146 AI-related bills proposed, passed or enacted across the 2025–26 state legislative sessions.[Source] Such activity reflects public concern that voluntary promises alone cannot manage harms that fall on people with little bargaining power.
Transparency requirements are especially defensible. People should know when they are dealing with an automated system, when an image or recording has been synthetically generated, and how to challenge a consequential decision. These are ordinary principles of due process adapted to a new technology.
The case against blunt regulation
Yet the opposing concerns are not manufactured by industry lobbyists alone. Rules can be vague, duplicative and expensive. A small company building an accessibility tool may face the same paperwork as a large platform, even though the risks and resources are entirely different. Compliance costs can also push development toward the largest firms, reducing competition and making the market less—not more—accountable.
There is a second danger: fragmented regulation. In the United States, the absence of a comprehensive federal framework has encouraged states to legislate separately, while federal policy has emphasized a lighter national approach and challenged state measures viewed as inconsistent with it.[Source] Businesses may respond by withdrawing useful services from some jurisdictions, or by designing to the least demanding rule. Neither outcome serves the public.
Rules can also become obsolete before they take effect. Legislators should regulate identifiable harms and responsibilities, not attempt to predict every technical form AI may take. The most durable obligations will concern documentation, testing, security, human oversight, auditability and compensation for damage.
What responsible enforcement looks like
Governments should therefore pursue three priorities. First, fund independent regulators with enough technical expertise to test claims rather than rely on corporate paperwork. Second, create proportionate duties: a chatbot for entertainment should not be treated like a system that determines medical treatment or eligibility for credit. Third, require usable remedies, including explanations, human review and avenues for appeal.
International coordination would help. Singapore’s financial regulator has issued AI risk-management guidelines covering traditional, generative and agentic systems, with implementation phased over coming years.[Source] Different jurisdictions need not adopt identical laws, but common vocabulary and baseline expectations could prevent a race to the bottom.
At Archange Shadows, the editorial position is neither “regulate everything” nor “trust the market.” It is that democratic governments must make enforceable promises. If an AI system can materially affect a person’s rights, livelihood or safety, someone must be responsible for its design, deployment and consequences. If a rule cannot identify that person or institution, it is not yet ready to protect anyone.
The era of AI principles is giving way to the era of enforcement. That is a less glamorous phase, but it is where public trust will be won or lost.