AI regulation is happening. Here's what I think

The EU AI Act is in effect. It classifies AI systems by risk level and imposes requirements on high-risk applications. The US has executive orders mandating safety testing for large models. China requires algorithm registration and content labeling. The UK is building a dedicated AI Safety Institute. NIST published an AI risk management framework.

Regulation is here. It’s real. And it’s different everywhere.

My complicated feelings

I’ll be honest: I’ve changed my mind about AI regulation three times in the last year. I’ll probably change it again.

The case for strong regulation: AI models can generate misinformation at scale, enable surveillance, displace workers, and make decisions about credit, healthcare, and criminal justice with biases baked in. These are real harms. They deserve real constraints.

The case for light regulation: AI moves fast. Regulation moves slow. If the US regulates heavily and China doesn’t, the center of AI development shifts to China. If Europe regulates heavily (which it’s doing), innovation migrates elsewhere. Regulation that kills domestic AI capability while foreign competitors face no such constraints isn’t safety. It’s surrender.

The case for targeted regulation: Not all AI applications are equally risky. A chatbot that writes poetry is different from an AI that makes parole decisions. Risk-based regulation (like the EU’s approach) makes more sense than blanket rules.

I find all three arguments convincing. Which means I’m stuck.

What I actually think, today

Disclosure requirements are good. If an AI system is making decisions about you (loan approval, hiring, medical diagnosis), you should know it, and you should be able to understand why.

Safety testing for frontier models is good. Before a model that could hypothetically help create bioweapons is released, someone should test whether it does. Anthropic’s responsible scaling policy does this voluntarily. Making it mandatory seems reasonable.

International coordination is necessary but unlikely. The EU, US, China, and UK all have different values, different political systems, and different incentives. A global AI regulation framework would be ideal and is probably impossible.

The worst outcome is regulation that protects incumbents. If compliance costs $10 million per model, only big companies can afford it. The barrier to entry kills competition, which kills innovation, which makes the big companies bigger and less accountable.

What I don’t know

Where the line is. How much is enough. How much is too much. Whether anyone can draw the line correctly when the technology changes faster than the rules.

I think regulation is necessary. I think the current approaches are imperfect. I think the absence of regulation would be worse than imperfect regulation.

And I think I’ll change my mind about the specifics at least twice more before this shakes out.

The future needs guardrails. I just wish I were more confident about where to put them.

Related thinking: