A moving target
Governments around the world are deciding whether and how to set rules for artificial intelligence. The situation changes quickly: proposals are drafted, amended, delayed, passed and revised, and details vary by jurisdiction. For that reason this article describes general approaches, not specific laws, and nothing here should be read as a statement of what is currently in force anywhere. For the current position in a particular country, consult official sources or legal professionals.
Why regulate at all?
Arguments for rules usually point to a few concerns: automated decisions about jobs, credit, housing, education or health can affect people’s lives; harms such as unfair treatment are hard for individuals to detect or prove; companies may have weak incentives to spend on safety; and voluntary promises can be uneven. Arguments for restraint include that rules may be written before the technology is well understood, that compliance costs fall hardest on small organizations, that rules might push development elsewhere, and that existing laws may already cover many harms.
Approach 1: Rely on existing laws
Many harms from AI already fall under laws on discrimination, consumer protection, product safety, data protection, defamation and competition. Some governments take the view that these laws, perhaps clarified through guidance, are the right starting point. The attraction is flexibility and speed. The drawback is that existing laws were written with human decision makers in mind, and it can be unclear how, for instance, a rule requiring a reason for a decision applies to a system whose reasoning is hard to inspect. That gap is part of why explainable AI is of interest to lawyers.
Approach 2: Risk-based rules
One widely discussed model sorts AI uses by how much harm they could cause. Higher-risk uses, such as those affecting access to essential services or involving biometric identification, face stricter obligations, while low-risk uses face few or none. Some uses regarded as unacceptable might be prohibited outright.
Obligations for higher-risk systems often discussed include:
- Documentation of data sources and testing.
- Assessment of risks before use.
- Human oversight arrangements.
- Record keeping so that decisions can be reviewed.
- Notices to people that they are dealing with an automated system.
Supporters like that the rules scale with the stakes. Critics point out that deciding which category a system belongs in can be hard, that general-purpose models serve many uses at once, and that the paperwork can be burdensome.
Approach 3: Sector-specific oversight
Instead of one broad framework, some governments let existing regulators handle AI within their own areas: health regulators for medical software, financial supervisors for credit scoring, transport authorities for vehicles. This builds on regulators’ expertise, which matters for things like AI diagnostic tools and self-driving cars. The downsides are possible gaps between sectors and inconsistent standards from one regulator to another.
Approach 4: Voluntary standards and self-regulation
Others favor non-binding guidelines, industry codes, technical standards and company commitments. Standards bodies develop shared methods for testing and risk management, which can later be referenced by laws or contracts. Voluntary approaches are quick and adaptable, but they depend on companies choosing to follow them and may not protect people when commercial pressures run the other way.
Approach 5: Targeted rules for particular harms or technologies
Some rules focus on narrow problems instead of AI in general. Examples of topics lawmakers have addressed in various places include deepfakes in elections or intimate imagery, automated hiring tools, the use of facial recognition by public authorities, and disclosure when people talk to a chatbot. This is easier to draft and enforce but can leave other areas uncovered.
Tools regulators can use
Whatever the overall model, governments pick from a similar set of tools.
| Tool | Basic idea | Common challenge |
|---|---|---|
| Prohibitions | Ban certain uses | Defining the boundary precisely |
| Licensing or pre-approval | Check before release | Slow, costly, needs expertise |
| Audits and testing | Examine performance and bias | Access to systems and data |
| Transparency duties | Require disclosure or notices | Disclosure may not be understood |
| Liability rules | Assign responsibility after harm | Proving cause; see automated accountability |
| Procurement rules | Set standards for public purchasing | Covers only government buyers |
| Sandboxes | Let firms test under supervision | Risk of uneven treatment |
Cross-cutting questions
Who is covered? Developers, the organizations that deploy a system, or both? Responsibility can be split between makers and operators.
What about general-purpose models? Models used for many tasks complicate any approach based on a specific use. Proposals include obligations based on model capability or scale, and these remain debated.
How is it enforced? Rules are only as strong as the regulator’s staff, budget and technical skill.
What about borders? AI services are offered across countries, so national rules overlap or conflict. Some governments pursue international agreements or shared principles, though countries differ on priorities, such as safety, economic growth, security or rights.
How should rules stay current? Techniques include requiring periodic review, using technology-neutral language and delegating details to regulators who can update guidance faster than legislators.
Why approaches differ
Differences reflect legal traditions, views on the proper role of government, economic goals, and public attitudes towards privacy and risk. A country that prioritizes consumer protection may favor detailed rules, while one that prioritizes rapid growth may prefer light-touch guidance. These are not simply right or wrong choices, and approaches continue to converge and diverge as experience builds.
What readers can take from this
When you read news about a new AI rule, a few questions help put it in context: Is it binding or voluntary? Does it cover all AI or specific uses? Who enforces it and with what penalties? Has it passed, or is it a draft? Rules tend to be shaped by the wider debates on AI ethics, including fairness, privacy and safety, and the details usually matter more than the headline.