AI Regulation: Too Much Too Soon, Or Not Enough?

For technology leaders, the real question is not whether AI will be regulated, but who inside the organisation is prepared to translate external uncertainty into internal controls. The management challenge is to avoid waiting for legislation to settle while still preventing the business from locking in risky tools, contracts and data practices. That means treating AI governance as an operating capability, not a future policy exercise.

The first implication is decision rights. CIOs, security leaders, legal, privacy, procurement and business sponsors need a clear forum for approving use cases, model classes and data access. Without that, AI adoption tends to fragment: teams bypass review for speed, while central functions respond with blanket restrictions. The trade-off is obvious โ€” tighter oversight can slow experimentation โ€” but weak oversight creates hidden exposure in regulated data, intellectual property and customer commitments.

The second implication is portfolio discipline. Not every AI opportunity deserves enterprise funding. Leaders should separate low-risk productivity use cases from higher-risk customer, employee or safety-facing deployments, then match controls to the impact profile. Next questions: which use cases can proceed under standard guardrails, which require exceptional approval, and what evidence will prove that risk is being reduced rather than merely documented?

Finally, AI regulation should be treated as a design input for vendor management and assurance. Contracts, audit rights, logging, data retention and model-change notifications matter more than broad claims about innovation or safety. The most resilient organisations will build a repeatable review process now, so they can adapt quickly as expectations shift instead of rewriting policy after the fact.


There have been many calls โ€” along with many forms of legislation drafted โ€” for governments to establish guardrails to keep AI in check. Time may be running out: a recent post by Anthropic suggests that we only have about 18 months for governments to get their arms around AI. โ€œGovernments should urgently take action on AI policy in the next eighteen months,โ€ the Anthropic authors state. โ€œThe window for proactive risk prevention is closing fast. Judicious, narrowly targeted regulation can allow us to get the best of both worlds: realizing the benefits of AI while mitigating the risks. Dragging our feet might lead to the worst of both worlds: poorly designed, knee-jerk regulation that hampers progress while also failing to be effective at preventing risks.โ€ Furthermore, โ€œas models advance in capabilities, the potential for misuse is likely to continue on a similar scaling trend,โ€ the post states. โ€œAbout a year ago, we warned that frontier models might pose real risks in the cyber and [chemical, biological, radiological, and nuclear] domains within 2-3 years.โ€ So how much is enough? How heavy-handed should regulation of AI be without hindering innovation? Many within the industry caution that itโ€™s still too soon to decide the direction of guardrails. โ€œRegulating AI safety prematurely could stifle progress and hinder innovation, especially when we donโ€™t fully understand the future of AI technology,โ€ legal expert Andrew Grosso Esq, chair of the Association for Computing Machineryโ€™s subcommittee on law, told me. โ€œIt is best to let the technology, and the use of the technology evolve, before any legislature puts pen to paper. Otherwise, we are going to need a big eraser.โ€ This calls for a balancing act between the immense promises of AI and the immense damage it could create. For instance, โ€œusing generative AI and machine learning in medical diagnostics provides considerable benefits by offering initial analytical insights that could potentially save lives by narrowing down possible diseases affecting patients,โ€ said Rob T. Lee, chief of research and head of faculty at the SANS Institute. โ€œNonetheless, the intermingling of sensitive medical records within datasets poses a significant risk for accidental leakage of confidential information.โ€ While there are fears that too much regulation will stifle innovation, โ€œthe reality is that bad regulation hampers innovation,โ€ said Ivana Bartoletti, global chief privacy and AI governance officer at Wipro. โ€œGood and agile regulation fosters it. It is of course difficult to regulate something that evolves so quickly. This is why we need to think pragmatically about the values we must protect such as privacy, safety, and human dignity.โ€ As with all technology waves, โ€œthere needs to be a balance between regulation and embracing safe innovations,โ€ Lee said. โ€œRestricting new technologies outright can seem overly authoritative without a clear threat.โ€ Ultimately, businesses, consumers and policymakers need to develop a consensus around degrees of AI regulation. The mutual agreement on robust security measures and protections โ€œwill foster greater confidence in AI technologies as their use becomes more widespread.โ€ said Lee. โ€œAt present, a distinct security culture is absent in many of the companies developing AI technologies. Build more trust by adopting a dedicated security and safety culture while advancing technological boundaries, similar to what has been observed in industries like medicine, automotive, and airlines.โ€ The key is all parties and stakeholders need to hold off and see how things develop with AI, while still heeding Anthropicโ€™s warning that a consensus needs to be built within the coming months. โ€œHolding a company responsible for AI models that they design and market misses an important aspect of AI,โ€ said Grosso. โ€œAI has independence from its designer,โ€ he continued. โ€œIt learns. It changes its processing as it learns. It is not capable of being monitored in real time. All told, it is substantially unpredictable. It is like a person hiring an artist to paint a mural and then allowing that person to sue the artist if he or she doesnโ€™t like the way the mural turned out. How much of a market do you think will develop for mural painters under such a legal regime? Such proposals risk strangling the commercial development of AI when we should be nurturing it.โ€
https://www.forbes.com/sites/joemckendrick/2024/11/12/ai-regulation-too-much-too-soon-or-not-enough/

Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.