Commentary: The argument over artificial-intelligence regulation has moved beyond whether rules are necessary. The more consequential question is who will write them, how quickly they will apply and whether anyone will be able to enforce them when systems cause harm.
Our view is straightforward: voluntary commitments from technology companies are useful, but they are not a substitute for law. The rapid expansion of capable AI systems affects elections, personal data, cybersecurity, employment and children. Those risks cannot be managed indefinitely through private assurances whose terms may change with a company’s commercial priorities.
Recent developments illustrate both the scale of the problem and the weakness of the current patchwork. The European Systemic Risk Board’s scientific advisers have warned that banks relying on similar AI models could experience correlated failures, amplifying market shocks. [1] In the United States, lawmakers have introduced bills addressing AI agents used in hacking, biometric surveillance and chatbot safety for minors, but those proposals have not become federal law. [1]
The case for enforceable rules
Rules are justified where the consequences of failure extend beyond the user who chose to deploy a system. A bank, hospital, school or government agency can impose risks on people who never consented to an experiment. Requirements for testing, documentation, incident reporting and human accountability would not eliminate danger, but they would make it harder to hide.
That principle is already visible in Europe, where implementation of the EU AI Act is being adjusted. The revised timetable reportedly pushes some high-risk obligations into 2027 and 2028, reflecting the practical difficulty of applying a broad regulatory framework. [2] Delays may frustrate advocates, but they also show why rules must be precise. A standard that no small developer can understand or comply with will encourage legal uncertainty rather than safety.
There is a second reason for legislation: accountability. A court in India recently restrained unauthorized AI-generated and manipulated content using actor Samantha Ruth Prabhu’s name, image and voice, relying on existing personality-rights and misrepresentation law. [1] That case demonstrates that courts can sometimes adapt old doctrines to new technology. It also demonstrates the limits of improvisation. People should not have to discover, case by case, whether their identity has protection.
The counterargument deserves respect
Critics of aggressive regulation are not simply defending corporate interests. They correctly warn that poorly designed rules can entrench the largest companies, slow beneficial research and give officials excessive power over speech and innovation. A preliminary U.S. court ruling blocking enforcement of Montana’s deepfake election law found that the measure likely raised free-speech problems because it treated some AI-generated depictions differently from others. [1]
That concern should shape, not defeat, regulation. Governments should not criminalize satire, impose vague duties to remove controversial opinions or require permission for ordinary creative tools. Nor should every model be regulated as though it carries the same risk. A spam filter, a medical diagnostic system and an autonomous cyber agent should face different obligations.
What responsible policy would look like
The sensible middle path is risk-based and transparent. High-impact systems should undergo independent testing; operators should preserve audit trails; serious incidents should be reported; affected people should receive notice and a meaningful avenue of appeal. Regulators should publish clear thresholds and review them as evidence changes.
International coordination matters too. AI companies operate across borders, while a fragmented maze of state and national rules can leave gaps and raise compliance costs. But international principles must eventually become enforceable domestic standards. Soft law can establish common language; it cannot compensate victims or deter reckless deployment on its own.
Innovation will continue whether governments act or not. That is precisely why public institutions must set the conditions under which innovation earns trust. The choice is not between progress and regulation. It is between accountable progress and a system in which the public bears the downside while private actors retain the upside.
AI policy should therefore begin with a modest but firm commitment: no organization deploying a powerful system should be allowed to treat foreseeable harm as someone else’s problem.