How Can Countries Positively Regulate AI?

Five measures for positive AI regulation

1. Adopt risk‑based, proportionate rules
   One‑size‑fits‑all regulation either overreaches or under‑protects. A risk‑tiered approach targets the systems most likely to harm safety or fundamental rights, while allowing light‑touch oversight for benign uses. Practically, this means defining risk categories, requiring impact assessments and conformity checks for high‑risk systems, and keeping bans narrow and clearly justified. For low‑risk systems, existing consumer and competition laws often suffice. Proportionality preserves innovation oxygen while focusing scarce regulatory capacity where it matters.
2. Bake in transparency and accountability
   People should know when AI is used and have recourse when it affects them. Regulations can require disclosure to users, documentation and technical transparency for auditors, and human‑in‑the‑loop oversight for consequential decisions. Algorithmic impact assessments before deployment—and ongoing updates—help organizations surface and mitigate bias, privacy, and safety risks. Rights to explanation and contestation for automated decisions reinforce accountability. Clarity that deployers remain responsible for outcomes (not “the algorithm”) aligns incentives.
3. Stand up dedicated oversight capacity
   Generalist regulators need help. Countries should create or empower specialized AI authorities (or coordinated inter‑agency bodies) with technical staff capable of evaluating models, datasets, and safety claims. These bodies can issue guidance, certify or register high‑risk systems, run regulatory sandboxes, and coordinate with sectoral regulators. Building government expertise speeds policy learning cycles and gives innovators a clear point of contact for pre‑deployment questions, reducing uncertainty.
4. Mandate safety testing, monitoring, and audits
   High‑impact AI deserves pre‑release testing for robustness, bias, and misuse risks; post‑deployment it needs continuous monitoring, event logging, and periodic independent audits. Standards bodies and regulators can publish evaluation protocols and reference datasets. Third‑party conformity assessments—familiar from medical devices or aviation—can be adapted where appropriate. Rather than “compliance theater,” the goal is measurable safety: catching failure modes early and forcing design mitigations before scale. For businesses, clear test‑and‑audit expectations level the playing field so responsible teams are not undercut by corner‑cutters.
5. Coordinate internationally and keep rules adaptive
   AI is borderless; governance should be interoperable. Countries can align around core principles (fairness, safety, accountability), contribute to international technical standards, and recognize each other’s certifications where feasible. Data transfer rules should be made compatible enough to enable legitimate cross‑border AI while protecting privacy. Equally important, regulations must be revisited frequently. Formal review clauses, empowered AI offices, and participation in multilateral forums help keep law synced with rapid technical change and reduce fragmentation that burdens startups.

‍