Commentary. The rush to regulate artificial intelligence has entered a consequential phase. New York Governor Kathy Hochul signed legislation on October 28 restricting specified unsafe chatbot features for minors, while the European Union moved ahead with new AI transparency obligations. These are reasonable responses to real risks. But the emerging regulatory map also raises a warning: protecting people from AI should not mean building an incoherent maze of overlapping rules.
Our view is straightforward: lawmakers should set firm, enforceable protections for children and for people subject to high-stakes automated decisions, while resisting laws written so broadly that they freeze useful experimentation or make compliance impossible for smaller companies. The goal should be accountable AI, not regulation as political theater.
Why the case for action is strong
Children are a particularly defensible place to draw a regulatory line. Generative chatbots can imitate intimacy, provide confident but wrong answers and encourage prolonged engagement. Young users may be less equipped to distinguish an entertaining conversation from trustworthy advice. New York’s law, as summarized by legal analysts, targets specified unsafe features rather than banning chatbots outright. That is a more proportionate approach than treating every AI interaction as inherently harmful.
The broader direction is also justified. The European Union’s AI framework has begun applying transparency obligations, and regulators are working through enforcement and penalties. The Centre for Democracy & Technology reports that U.S. lawmakers have increasingly focused on automated systems used in employment, housing, finance and education—areas where an opaque error can alter a person’s life.
These measures reflect a principle that should not be controversial: when companies deploy systems that affect access to opportunity, they owe the public more than a promise that the software is innovative. People need notice, meaningful avenues to challenge decisions and clear responsibility when systems fail.
The costs of a fragmented response
Yet good intentions do not guarantee good policy. The United States is moving through a state-by-state process, while the EU is developing its own detailed regime and other governments are pursuing distinct rules for biometrics, agents and automated vehicles. The result may be a compliance landscape in which the same service is lawful in one jurisdiction, restricted in another and subject to incompatible reporting duties elsewhere.
That fragmentation can hurt consumers as well as companies. Large technology firms can hire legal teams and redesign products for different markets. Smaller developers, schools and nonprofit organizations cannot do so as easily. They may respond by withdrawing useful tools, limiting access or avoiding public-interest applications altogether.
There is also a risk that lawmakers regulate the label rather than the harm. A chatbot is not dangerous merely because it is conversational, just as a traditional search engine is not safe merely because it is familiar. Rules should focus on measurable conduct: manipulation, failure to protect minors, discrimination, privacy violations and the absence of human review in consequential decisions.
A better bargain
The emerging framework needs three disciplines. First, child-safety rules should require age-appropriate design, privacy protection, crisis escalation and independent testing, while allowing transparent services that meet those standards to operate.
Second, high-impact systems should face common baseline requirements across jurisdictions. Companies should document training and testing, monitor disparate outcomes and provide affected people with a genuine appeal. Regulators should coordinate definitions and reporting formats so compliance does not become a contest in paperwork.
Third, governments should publish evidence about whether rules work. Sunset clauses, periodic reviews and public incident data would make regulation more accountable. If a requirement reduces harm, keep it. If it merely drives responsible developers away while bad actors ignore it, revise it.
Industry warnings about innovation deserve consideration, but they should not become a veto. The counterargument is strongest where rules are vague, duplicative or imposed without technical expertise. It is weakest when companies resist basic transparency or independent scrutiny in systems marketed to children or used to determine people’s opportunities.
The choice is not between unrestricted AI and a government ban. It is between thoughtful guardrails and a patchwork that leaves everyone—families, users, developers and regulators—guessing. New York’s action is a useful signal that child safety belongs near the center of the debate. The next step is ensuring that protection is consistent, evidence-based and enforceable beyond the headlines.