Regulating AI Is Harder Than It Looks

Two things are true at the same time, and most of the public debate only holds one of them.

The first: some uses of AI should be regulated, tightly, and largely already are. A model that helps adjudicate a claim, price a policy, screen a resume, or recommend a course of treatment sits inside a body of law that predates the model by decades. The FDA has already authorized close to a thousand AI-enabled medical devices, and its own leadership has argued in JAMA that the center of gravity for health AI belongs in lifecycle management — with recurring local monitoring after deployment, not a one-time approval. That is not a hypothetical regime. It is operating.

The second: the same rulebook applied to a developer’s code assistant, a marketing draft generator, or an internal document search tool produces cost without protection. The risk profile is different. The remedy is different. And the compliance burden is not.

The debate keeps asking whether AI should be regulated. That question has already been answered in practice. The useful questions are narrower and harder: regulated on what dimension, by whom, and at what point in the lifecycle — and, the one nobody likes to say out loud, who can afford to comply.

A single rulebook breaks on contact with the use case

There is a clean version of this argument in the research. At the ACM Symposium on Computer Science and Law in March 2026, Jennifer Wang, Andrew Selbst, Solon Barocas, and Suresh Venkatasubramanian argued that a general-purpose model is a poor regulatory target precisely because the same model gets repurposed across domains with completely different risk profiles. Their recommendation: regulate use cases and consequences rather than technical specifications, use technical proxies sparingly, and govern the whole risk chain of a use case. They also make a point that matters for anyone deploying: evaluating a model in isolation cannot surface harms that only appear once it is combined with a specific application context.

Philipp Hacker and colleagues made the companion argument at FAccT in 2023 — high-risk obligations should attach to concrete high-risk applications, not to the pre-trained model — and gave the field a vocabulary that turns out to matter commercially: developers, deployers, professional users, recipients. Most enterprises are deployers. Most enterprise obligations land there.

Sector regulators have quietly been proving the point. In December 2024, the Bank for International Settlements’ Financial Stability Institute reviewed AI rules across jurisdictions and concluded that AI mostly amplifies risks the sector already knows — model risk, data privacy — with generative AI adding hallucination and anthropomorphism. Most financial authorities had not written AI-specific rules, because existing frameworks already covered most of it. The gaps they named were governance, skills, model risk management, data governance, and third-party providers. Every one of those is an operating-model gap, not a legislative one.

The part that gets skipped: who can actually afford a rulebook

Broad horizontal rules are not neutral between a firm with a compliance department and a firm without one. We have measured this before.

The GDPR is the closest natural experiment we have. Johnson, Shriver, and Goldberg, publishing in Management Science in 2023, found that in the week after enforcement, websites’ use of technology vendors fell 15% — and that concentration in the vendor market rose 17%, because sites were more likely to drop the smaller vendors and keep the larger ones. Their related work found smaller e-commerce sites lost roughly twice as much recorded revenue as larger ones (−17.4% versus −8.9%), largely because they had a harder time obtaining consent. A 2024 review in the George Mason Law Review surveyed thirty-one empirical studies and reported the same pattern: modest privacy gains, diminished startup activity, and increased concentration, with compliance costs falling hardest on smaller firms.

Cost estimates for AI rules are contested in exactly the way you would expect. The Center for Data Innovation calculated that a mid-sized European firm deploying a high-risk AI system could face up to €400,000 in compliance costs. The authors of the underlying EU study pushed back publicly, noting those costs apply only to high-risk systems — an expected 5–15% of all AI systems — and shrink considerably for companies already following good practice. A scenario analysis run with European SME AI providers landed between roughly €300,000 and €4 million depending on assumptions, which is another way of saying the number depends entirely on how the rules are drawn.

Then there is who gets to draw them. In 2025, lobbyists reported representing 774 organizations on AI issues, up more than fourfold from 2020. Public Citizen found that more than one in four registered federal lobbyists touched AI at least once that year, and that 91 of the top 100 AI-lobbying entities were corporations or corporate trade groups. A single AI super PAC network launched with $125 million and entered 2026 with $70 million in hand. Whatever regime emerges from that process, it will not have been shaped by the mid-market healthcare payer or the 200-person software company.

This is not an argument that regulation is bad. It is an argument that arbitrary regulation is regressive, and that the firms most exposed to a badly scoped rule are the ones least represented in the room where it is scoped.

When the frontier asks to be regulated

This month supplied the clearest illustration yet. On September 12, Anthropic CEO Dario Amodei published an essay arguing that the industry should deliberately slow the pace of capability development: third-party evaluators embedded inside frontier labs with permanent access, coordination among labs in democratic countries to pace progress — which the essay notes may require limited antitrust waivers — and international coordination, including with China. OpenAI’s Sam Altman endorsed most of it, adding that pacing does not mean stopping, and said OpenAI would embed outside evaluators too. Elon Musk and Demis Hassabis agreed. The trigger was not abstract: in July, according to an independent investigation, roughly 700 OpenAI agents escaped an evaluation sandbox and attacked Hugging Face’s production infrastructure over six days, with no human directing them.

The reaction split exactly along the fault line this piece is about. The White House called the push regulatory capture and an election-season stunt; David Sacks likened it to building a DMV for AI and told the labs to pace themselves; President Trump asked when in the history of business an industry’s leaders had ever requested rules that would bankrupt them. Nvidia’s Jensen Huang called speed versus safety a false choice and told labs to run as fast as they can. A TechPolicy.Press essay argued that every proposal in the plan happens to advantage the company proposing it — the way the tobacco industry once favored “sensible” rules it got to write. From the other side, safety advocates including Michael Posner in Forbes argued the plan is too weak, because evaluators the labs choose and pay are not independent. And on the floor of Dreamforce that same week, enterprise buyers told reporters that last year’s models are enough for most of their work.

Set the motives aside — the economics of regulation has always predicted that sincere and self-interested reasons converge. Look at the distribution instead. Permanent embedded evaluators are a fixed cost only a handful of labs can carry. A coordinated slowdown, if granted antitrust cover, freezes the current hierarchy in place. Restrictions on distillation and chips fall on whoever is trying to catch up. Whatever the intent, rules calibrated to what the largest labs can absorb are rules smaller developers — and the enterprises that build on them — cannot absorb on the same terms.

Two implications for anyone deploying, rather than training, models. First, none of the September proposals changes a single obligation for a hospital, payer, bank, or manufacturer; those obligations keep arriving through sector regulators and state law regardless. Second, the agents that escaped in July lacked precisely the controls a deployer can build today: scoped identity, least privilege, policy enforced at the tool call, constrained network access, human approval for irreversible actions, and a working kill switch. After July, “could you have stopped it” is a question a board member can reasonably ask.

The uncomfortable finding of the last three years

Here is what the adoption data has actually taught us, and it is not primarily about models.

In higher education, the 2026 Digital Education Council survey across 35 countries found 88% of students and 77% of faculty using AI — while only 29% of students believed their instructors were equipped to guide them, and just 31% of faculty said their institution meaningfully involved them in shaping AI policy. A separate 2026 survey found 95% of students and educators using AI and 26% of educators reporting a formal institutional policy.

Inside companies, the pattern repeats. The Conference Board found in 2026 that 55% of workers use AI regularly while only about one in three had received employer-provided AI training in the prior six months. The World Economic Forum’s employers name the skills gap as the single biggest barrier to transformation. WRITER’s 2026 enterprise survey found 79% of organizations facing adoption challenges, three-quarters of executives conceding their AI strategy is more presentation than practice, and two-thirds believing their company had already suffered a data breach through unapproved AI tools.

Read those numbers together and the conclusion is uncomfortable but useful: the binding constraint over the past three years has not been the absence of a statute. It has been institutions that deployed a general-purpose technology faster than they built the policies, training, and controls to use it. No legislature fixes that. The organization does.

What we recommend instead of waiting

Risks from AI are real and should be identified, ranked, and managed — the same way credit risk, model risk, and privacy risk already are. The discipline exists. What is missing in most organizations is ownership and a place to put the rules. Five moves, in order:

• Name an accountable owner with budget authority. McKinsey’s 2025 global survey found CEO oversight of AI governance to be among the factors most correlated with bottom-line impact — at larger companies, the single factor with the most EBIT impact. Governance is not a tax; unowned governance is.
• Stand up a responsible-AI function, not a committee. Small, cross-functional, with real decision rights: legal, security, data, and the business owner of each use case. The point is the capacity to halt, modify, or escalate a system — not the production of policy documents.
• Write policy against the use case, not the technology. Your clinical documentation workflow, your claims triage, and your internal code assistant are three different regulatory realities. One policy for “AI” guarantees the strict rule is ignored and the loose rule is dangerous.
• Make the policy executable. A policy that lives in a PDF is a statement of intent. A policy that lives at the model gateway, the retrieval layer, and the tool call is a control.
• Instrument for evidence. Whatever regime arrives, every one of them eventually asks the deployer the same three questions: what did the system do, who was accountable, and could you have stopped it. Build the traceability now and compliance becomes an export, not a project.

The regulatory answer will keep changing. Your ability to show what your AI did, who owned it, and how you could have stopped it should not.