Commentary. The latest wave of artificial-intelligence regulation is moving in the right direction—but not yet at the right speed or with enough practical clarity. Our view is straightforward: when an automated system can affect someone’s job, safety or access to essential services, a human being must remain accountable for the outcome.
That principle is gaining ground. Delaware has enacted amendments that lower the threshold at which businesses fall under its privacy law and add safeguards for automated decisions in employment, including adverse-action notices, opportunities to request human review and impact assessments. A separate measure, the No Robo Bosses Act, requires human involvement when automated systems are used in discipline or termination decisions. [Source]
These are sensible guardrails. An algorithm may identify patterns quickly, but it cannot explain a hidden bias in a training dataset, understand a worker’s circumstances or accept moral responsibility. A person dismissed by software deserves more than a generic notification and an appeal routed back to the same software.
The case for caution
Still, regulation can become performative if it demands human involvement without defining what meaningful oversight requires. A manager who clicks “approve” on an automated recommendation is not necessarily exercising judgment. Nor does a disclosure automatically make an opaque system understandable.
Companies also have a legitimate concern about fragmented rules. Delaware’s changes arrive alongside a growing patchwork of state, national and regional requirements. In Europe, regulators are still preparing the implementation of the AI Act, while policymakers are considering new frameworks for emerging technologies such as neuro-AI. [Source] Compliance costs may fall most heavily on smaller firms, reducing competition and leaving the market to the largest technology companies.
That argument should not be dismissed. A badly designed rule can discourage useful tools in medicine, education or public administration. Automated systems can help detect fraud, sort large volumes of evidence and flag risks that humans might miss. The alternative to imperfect automation is not always careful human judgment; sometimes it is delay, inconsistency or no decision at all.
Accountability must be concrete
But innovation is not a reason to make affected people carry the risk. The answer is targeted regulation: stricter obligations for high-impact uses, lighter requirements for low-risk applications and clear enforcement against deliberate evasion.
At minimum, high-impact systems should have four features: a documented purpose, testing for discriminatory outcomes, records showing how decisions were made and a genuine route to human reconsideration. Regulators should also be able to inspect systems after deployment, because performance in a laboratory is not proof of safety in the real world.
Recent warnings about frontier AI reinforce the point. The UK Financial Conduct Authority has said models with cyber capabilities may accelerate vulnerability discovery faster than firms can respond. [Source] That is not an argument for banning powerful systems. It is an argument for requiring institutions that deploy them to understand their failure modes before those failures become someone else’s emergency.
Age and privacy protections raise a similar tension. Proposals for an EU Kids Act would introduce age restrictions on social-media access, while new privacy rules increasingly require companies to account for profiling and data use. [Source] Protecting children is an urgent public duty, but blunt age checks can create new surveillance risks and exclude teenagers who rely on online communities for support.
Our position is therefore neither “regulate everything” nor “let the market decide.” It is that power should carry responsibility. Companies should be free to build and improve AI, but not free to outsource consequential decisions to systems they cannot explain or control.
The public does not need a promise that machines will never make mistakes. It needs institutions prepared to acknowledge mistakes, repair harm and identify who is answerable. Human oversight is valuable only when it has authority. The next generation of AI rules should make that authority real.