Commentary. The most consequential AI policy question is no longer whether governments should regulate artificial intelligence. It is whether they can do so steadily enough for citizens, companies and public institutions to know what the rules mean.
Recent developments point in the wrong direction. In Europe, lawmakers agreed to delay requirements for some high-risk AI systems, including applications involving biometrics, critical infrastructure and law enforcement, until December 2027. The proposed delay also pushes back the registration database for high-risk systems. The Business & Human Rights Resource Centre reports that the change is part of the bloc’s Digital Omnibus effort.
In the United States, the picture is more fragmented. The Center for Democracy & Technology says state lawmakers continued to address automated decisions in employment, housing, finance and education, while federal legislation on frontier-model risks had not passed during the 2026 session. Colorado, meanwhile, replaced an earlier automated-decision law with a measure that removed developer “duty of care” obligations and several risk-assessment requirements. CDT’s legislative review describes the shift.
Our view is straightforward: governments should resist both regulatory theater and regulatory retreat. Rules should be proportionate to risk, but they must also be durable. A company building a tool for hospital triage should face different obligations from one deploying a low-stakes writing assistant. That distinction is sensible. Delaying core protections without publishing a clear timetable, enforcement plan and accountability mechanism is not.
Why caution has a case
The argument for delay is not frivolous. Smaller businesses may struggle with complex compliance duties, and overlapping rules can discourage investment or push developers toward jurisdictions with weaker safeguards. Europe’s own policy changes have been presented as an attempt to simplify obligations, expand testing opportunities and improve consistency across legislation. Simmons & Simmons notes that the EU’s AI framework includes enforcement powers, transparency duties and limited grace periods for some generative-AI systems.
That concern deserves a practical response: clearer standards, shared testing infrastructure and support for small firms. It does not justify making people wait indefinitely for explanations when an algorithm affects access to work, housing, education or public services.
The cost of uncertainty
Weak or shifting rules create a different burden. They leave individuals unsure when they are interacting with a machine, give public agencies inconsistent guidance and make responsible companies compete with firms willing to cut corners. The result is not innovation in the public interest, but a race to interpret loopholes.
The spread of chatbot regulation illustrates the stakes. CDT counted 146 bills proposed, passed or enacted across the 2025–26 state legislative sessions involving chatbots, conversational AI and AI companions. Some measures focus on children, including disclosure, limits on personalization and restrictions on advertising. Those proposals reflect legitimate concern about vulnerable users, even as lawmakers must avoid treating every automated conversation as equally dangerous.
There is also a lesson in the emerging focus on incident reporting and independent evaluation. A recent industry position in Australia reportedly backed mandatory reporting after disclosures involving unauthorized access to government websites, while regulators elsewhere are pressing companies to demonstrate that capability gains are matched by safeguards. MLex’s reporting captures that broader movement.
What responsible regulation looks like
Regulators should concentrate on four principles: transparency when people are dealing with synthetic content; independent testing for high-impact systems; meaningful human appeal when automated decisions cause harm; and prompt reporting of serious incidents. These requirements should apply according to a system’s consequences, not the marketing language surrounding it.
Companies, for their part, are right to demand predictable rules and reasonable implementation periods. But predictability cannot mean a permanent exemption from scrutiny. The public is not a beta-testing environment, and “move fast” is not a substitute for assigning responsibility when systems fail.
Europe should clarify its revised timetable rather than allow delay to become drift. The United States should set baseline protections instead of leaving fundamental rights to a state-by-state lottery. Both should preserve room for experimentation, but experimentation must occur with consent, monitoring and a route to redress.
AI policy will not succeed through maximalism. Nor will it succeed through promises that voluntary restraint is enough. The durable middle path is firm on harm, flexible on methods and stable enough to be understood. That is not an obstacle to innovation. It is the condition that allows the public to trust it.