Commentary: Artificial intelligence regulation is entering its most consequential phase—not because lawmakers have solved the technology’s risks, but because they are finally confronting where those risks land: in hiring offices, classrooms, hospitals, banks and public agencies. Our view is straightforward: governments should regulate AI according to the harm it can cause, not the novelty of the system behind it.
That principle sounds modest. In practice, it requires resisting two opposing temptations. One is to treat every AI product as an existential threat and smother useful innovation under blanket rules. The other is to declare that innovation moves too quickly for democratic oversight, leaving citizens to serve as involuntary test subjects. The second argument has been winning too often.
State legislatures in the United States are increasingly targeting automated decision systems used in consequential areas such as employment, housing, finance and education. The Center for Democracy & Technology reports that 69 AI-related bills were introduced across 26 states during the 2026 legislative session, with measures enacted in Maryland, Minnesota and New York. Connecticut passed what the organization described as the session’s most comprehensive law, combining a regulatory sandbox, chatbot controls and consideration of independent third-party auditors. The Center for Democracy & Technology’s legislative overview documents both the momentum and the unevenness of this state-by-state approach.
That unevenness is a genuine concern. Businesses operating nationally face a patchwork of obligations, while smaller companies may lack the lawyers and engineers needed to comply with multiple regimes. Critics also warn that poorly designed rules could discourage startups, slow medical research or push development to jurisdictions with weaker safeguards. Those arguments deserve more than a dismissive response. A regulation that is impossible to understand or comply with is not responsible governance.
But complexity is not an excuse for inaction. Automated systems can influence whether a person gets an interview, a loan, a place at a university or additional scrutiny from the state. In such cases, the basic protections should be familiar: notice that AI is being used, meaningful human review, an explanation of material decisions, testing for discriminatory outcomes and a practical route to appeal. These are not anti-technology demands. They are minimum conditions for using powerful technology in public life.
The accountability gap
The federal government’s slower movement makes the gap more visible. The same CDT review says no federal AI bill had passed in the 2026 session, even as federal attention focused on frontier-model risks and public-sector use. A separate legal analysis reported that the United States had rejected international coordination on AI governance while several states pursued their own oversight initiatives. That analysis also described a new White House effort to coordinate national policy and assess the government’s role in overseeing AI.
National coordination would help, but centralization alone is not the answer. Federal officials may be better placed to establish common standards for safety testing, data protection and documentation. State and local authorities, however, often see harms first and can adapt rules to specific public services. The sensible compromise is a federal floor—not a ceiling—that prevents the weakest jurisdiction from setting the standard for everyone.
Industry’s counterargument is strongest when it demands precision. Rules should distinguish a recommendation engine for entertainment from a system that determines access to housing or healthcare. They should also avoid requiring companies to reveal genuinely protected trade secrets or forcing humans into nominal oversight roles without the authority or expertise to intervene. Audits must be independent enough to matter, but not so expensive that only the largest firms can participate.
Those qualifications strengthen, rather than weaken, the case for regulation. Good rules do not attempt to predict every future model. They establish duties that remain relevant as models change: assess foreseeable risks, monitor performance after deployment, disclose significant failures and give affected people recourse. This is less glamorous than a race to build ever-larger systems, but it is how public trust is earned.
International cooperation matters too. AI systems cross borders, and a purely national approach invites regulatory arbitrage. Yet diplomacy should not become a synonym for delay. Governments can begin with narrow agreements on incident reporting, testing methods and protections for high-risk uses while broader disputes continue.
Our position is not that every AI deployment needs a new bureaucracy. It is that no company or government should be allowed to outsource responsibility to an algorithm. Innovation remains valuable; speed remains economically important. But when speed and accountability conflict, the burden should fall on the institution introducing the system—not on the person who must live with its decision.