Commentary. Artificial intelligence is no longer waiting for lawmakers to decide what it is. It is being deployed in workplaces, government services, education and consumer products while rules remain fragmented, voluntary or still under debate. Our view is straightforward: the United States needs enforceable national safeguards for high-risk AI—but not a licensing regime so broad that it freezes useful innovation.
The case for action is no longer hypothetical. States are legislating around automated decisions in employment, housing, finance and education, while federal proposals address frontier-model risks and third-party auditing. The result is a growing patchwork in which obligations differ by state and sector, even as the same systems operate across state lines. The Center for Democracy and Technology reports that 69 AI bills were introduced across 26 states during the 2026 legislative session, with three enacted at the time of its review.[1]
That patchwork creates genuine costs. Smaller companies may struggle to interpret overlapping compliance duties, and consumers may receive different protections depending on where they live. Public agencies, meanwhile, risk buying systems whose errors are difficult to investigate or contest. Federal procurement rules are beginning to address some of these concerns: revised General Services Administration requirements concerning data safeguards in large language-model systems took effect in October, although implementation will arrive through later contract updates.[2]
Yet regulation can fail when it mistakes visibility for effectiveness. A sweeping pre-approval system for every advanced model could privilege the largest firms, which can afford lawyers, auditors and compliance teams. It could also push experimentation offshore or discourage open-source development without materially reducing misuse. Proposals that would ban systems deemed “smarter than humans,” for example, raise an obvious practical question: smarter at what task, measured by whom, and with what remedy for a false positive?[3]
The better approach is risk-based and concrete. Rules should focus first on consequential uses: systems that can determine access to employment, housing, credit, education, medical care or essential public services. Developers and deployers should document training limitations, test for foreseeable disparate impacts, maintain meaningful human review and provide a process for people to challenge decisions. Independent audits should be required where the stakes justify them, but audits must be transparent enough to be useful and standardized enough to avoid becoming ceremonial paperwork.
Accountability should also follow control. A model developer should not escape responsibility when it knowingly markets an unsafe system, but a hospital, bank or public agency that chooses how to deploy that system should not be treated as a passive bystander. Liability rules should distinguish among design defects, negligent deployment, deliberate misuse and unavoidable error. Without that distinction, companies will either over-restrict ordinary uses or externalize the costs of reckless ones.
What opponents get right
Critics of new mandates are right that America’s technological lead is economically and strategically important. Excessive restrictions could slow productivity gains, raise costs for small businesses and leave public institutions dependent on foreign systems. Voluntary standards can also move faster than legislation, and technical details can become obsolete before a statute is fully implemented.
Those objections argue for adaptable rules, not inaction. Congress can establish baseline rights and duties while directing expert agencies to update technical standards through public procedures. Sunset reviews, regulatory sandboxes and exemptions for low-risk experimentation would help prevent yesterday’s assumptions from becoming permanent barriers.
The immediate priority should be honesty. Companies should say where AI is used, what it can and cannot do, and how users can obtain human review. Government agencies should publish procurement requirements and incident reports. Legislators should resist both the fantasy that self-policing will solve every problem and the temptation to treat every model as an existential threat.
AI policy should protect people without protecting incumbents from competition. A national floor for safety, transparency and remedy would do more good than a race among states—or a promise that voluntary principles will somehow become enforceable after harm occurs. Innovation deserves room to grow. It does not deserve immunity from accountability.