Commentary. The artificial-intelligence debate has moved beyond whether governments should regulate. They are regulating—often in parallel, sometimes in conflict. The question now is whether this expanding rulebook will make AI safer in practice or merely create the appearance of control.
Our view is clear: enforceable safeguards should come before grand promises of technological leadership. But regulation must be targeted, measurable and adaptable. A law that is too vague to enforce protects nobody; one that is so rigid that smaller firms cannot comply may simply entrench the largest companies.
The European Union offers the most developed test case. Most provisions of the AI Act are now entering force, with enforcement beginning for applicable rules, while a 2026 “Digital Omnibus” has simplified implementation and postponed some obligations for high-risk systems.[1][4] That adjustment illustrates both the value and the weakness of the European approach. Policymakers are trying to impose a risk-based framework, yet the timetable is already being revised before the system has fully matured.
That is not necessarily failure. Complex technology often requires staged implementation. Delaying obligations can give regulators and businesses time to develop workable standards, especially in sectors such as healthcare, transport and critical infrastructure. But postponement becomes dangerous when it is driven by lobbying rather than evidence, or when public protections are treated as optional whenever compliance becomes inconvenient.
The case for stronger guardrails
AI systems increasingly influence decisions about employment, access to services, safety and personal information. The EU framework seeks to prohibit certain practices, impose transparency duties and regulate general-purpose models.[6][10] New York has also enacted restrictions on unsafe chatbot features aimed at minors, reflecting growing concern about systems that can simulate companionship or provide harmful advice.[2]
These measures are defensible because individuals cannot negotiate equally with platforms that control the data, interfaces and incentives shaping automated decisions. Voluntary promises are useful, but they are not a substitute for liability, audits and a clear route to redress.
Nor should public authorities confuse innovation with deregulation. Predictable rules can help responsible developers compete by making safety a condition of market access rather than an expensive choice that only ethical companies make.
The case against blunt regulation
Critics are right to warn that regulation can become protectionism by another name. Compliance costs may fall hardest on startups, universities and public-interest researchers, while established firms absorb them as a cost of doing business. Overbroad definitions can also capture low-risk applications, diverting regulators from genuinely consequential systems.
There is a further danger in fragmented policymaking. Recent developments show governments choosing different priorities: China is pursuing broader oversight of AI agents and biometrics; India has opened consultation on responsible AI in telecommunications; and the United Kingdom is developing new approaches to policing, biometrics and medical technology.[2][7] This activity demonstrates urgency, but it also raises the cost of operating across borders and makes it harder for citizens to understand their rights.
The answer is not a race to the weakest standard, nor a single universal rule written before the technology is understood. Regulators should agree on basic principles—traceability, meaningful human accountability, privacy protection, security testing and compensation for demonstrable harm—while allowing national authorities to tailor enforcement to local institutions.
What credible oversight would look like
First, regulators need technical capacity and independence. Rules without inspectors, testing infrastructure and penalties will produce paperwork rather than safety. Second, companies should disclose enough about system performance and risks for external scrutiny, without forcing the publication of trade secrets that could undermine security or competition.
Third, enforcement should follow impact, not publicity. A chatbot generating amusing errors deserves attention; an opaque system determining eligibility for housing, medical treatment or employment deserves far more. Finally, governments should publish evidence when they delay or revise obligations. Citizens can accept changed deadlines more readily when the reasons are transparent.
The political temptation is to announce sweeping AI strategies and claim victory. The public need is more modest and more demanding: institutions that can investigate failures, punish abuse and correct rules when evidence changes.
AI regulation will not succeed because one bloc writes the longest statute. It will succeed when people can tell who is responsible, what protections apply and where to seek remedy. That standard should guide every new framework, whether it is introduced in Brussels, Albany, Beijing, New Delhi or London.