AI Regulation
Why Regulating AI Feels Like Writing Traffic Laws Before Cars Were Invented
Every major attempt to regulate artificial intelligence so far has been trying to describe a destination nobody has visited yet.
The Idea
Most regulation works retrospectively — society notices harm, builds consensus, then codifies rules. We regulated leaded petrol after decades of poisoning. We reformed financial derivatives after the 2008 collapse. The thing existed, the damage was measurable, and lawmakers had something concrete to argue about. AI regulation is a different kind of problem entirely: it asks governments to constrain a technology that is actively changing what it is capable of, often faster than any legislative cycle can track. The fundamental tension is between two incompatible instincts. One says: wait until the harms are clear, then respond. The other says: by the time the harms are clear with something this powerful, you may have lost the window to respond at all. Neither instinct is obviously wrong, which is why the policy landscape looks so fractured. What makes this genuinely hard — not just politically, but intellectually — is that AI doesn't behave like a product. A car is a car. An AI model in 2024 can be a medical diagnostic tool, a weapons guidance system, a poetry generator, and a fraud engine, sometimes simultaneously. Regulating 'AI' as a category is a bit like regulating 'software' — the category is too vast to be meaningful, but carving it into subcategories requires technical distinctions that most legislators haven't yet developed the vocabulary for. The EU's AI Act, the most comprehensive attempt so far, tried to solve this with a risk-tiered framework. It's an ambitious idea. Whether the execution is deft enough to remain useful as the technology evolves is a genuinely open question.
In the World
In March 2024, the European Parliament passed the AI Act — three years in the making, over a thousand amendments filed, and a last-minute scramble when the emergence of ChatGPT forced legislators to retrofit 'general purpose AI' into a framework that had been designed mostly with narrow systems in mind. The Act categories AI by risk: unacceptable risk (banned outright, such as social scoring systems), high risk (heavily regulated, such as AI used in hiring or credit decisions), and lower-risk systems that require only transparency obligations. It sounds logical. The problem emerged almost immediately in the negotiations: who decides which tier a given system belongs to? When an AI model can be fine-tuned for medical advice one week and customer complaints the next, the risk level isn't intrinsic to the model — it's a function of deployment context. This created an enormous amount of definitional work that companies, not regulators, will largely end up doing themselves. Meanwhile, across the Atlantic, the US chose a different approach: executive orders and voluntary commitments rather than binding legislation. The White House's October 2023 AI Executive Order was sweeping in ambition but thin on enforcement. Critics called it regulatory theatre. Defenders argued that flexibility was a feature, not a bug, for a technology moving this fast. The contrast between Brussels and Washington isn't just a story about regulatory philosophy — it's becoming a geopolitical one. If the EU's rules become the de facto global standard simply by market weight, that's a form of soft power that neither side fully anticipated.
Why It Matters
You don't need to work in policy or tech to have skin in this game. The rules being written now — or not written — will shape what AI systems are deployed in hiring processes, healthcare triage, credit scoring, and content moderation. Those are decisions that will touch most people's lives within the decade. The thing worth carrying from this is a sharpened skepticism in both directions. Distrust the instinct that says regulation is inherently backward-looking and will only stifle innovation — the history of unregulated powerful technologies is not uniformly cheerful. But also distrust the instinct that says a well-intentioned framework guarantees good outcomes; poorly designed rules can entrench incumbent players, create compliance theatre, and miss the actual harms entirely. The more useful posture is probably this: treat AI regulation less like a solved problem being implemented and more like an ongoing negotiation between people with genuinely different — and not always self-interested — views about what the technology should be allowed to become. That negotiation is happening right now, and it is far more open than it looks.
A Question to Ponder
If the speed of AI development means no regulation can fully keep pace, what is the most valuable thing regulation can still realistically achieve?
Get a new one of these every morning.
Start learning with Thinkable