David Colburn

For anyone who thinks AI regulation is some distant issue that government officials will eventually get around to, last week offered a reality check.
Last week, the federal government abruptly pulled the plug on Anthropic’s newest AI models, citing security issues. At nearly the same time, New York lawmakers approved legislation that would require disclosures on AI-generated news content, while a German court ruled that Google could be held liable for errors generated by its Gemini AI summaries.
Taken together, the developments highlight how quickly AI regulation is moving from theoretical debate to real-world action.
For the past few years, most of the conversation around artificial intelligence has focused on what the technology can do. Increasingly, however, the focus is turning to what governments, courts, and regulators will allow it to do. Given how rapidly AI has become woven into search engines, smartphones, social media platforms, office software, and countless other tools, that shift is probably inevitable.
The challenge is that history suggests we often end up making rules for transformative technologies before we fully understand where those technologies are headed.
One of my favorite examples comes from the early days of the automobile. In 1865, the British Parliament passed what became known as the Red Flag Act, which required self-propelled vehicles traveling on public roads to have a person walking ahead carrying a red flag or lantern to warn others of the approaching machine.
Today, that’s a pretty funny image. Imagine buying a new car only to learn that before you can drive to the grocery store, you need to hire someone to jog down the road in front of you waving a flag.
But the lawmakers who passed that law weren’t fools. They were confronting a technology unlike anything most people had ever seen. Roads were designed for horses, wagons, and pedestrians. A noisy, self-propelled vehicle seemed both unfamiliar and potentially dangerous. Legislators recognized there were risks and tried to address them.
Their mistake wasn’t that they regulated automobiles. Their mistake was assuming they understood where the technology was headed.
That’s the lesson I keep coming back to as governments around the world begin wrestling with AI.
Many of the concerns driving current proposals are entirely legitimate. Political deepfakes can mislead voters. AI-generated scams can trick people into sending money to criminals. Voice-cloning technology can be used to impersonate family members. AI systems can produce inaccurate information and present it with a confidence that often exceeds their actual knowledge.
Those are real problems, and they deserve serious attention.
At the same time, regulation often creates consequences of its own. Consider some of the age-verification laws proposed for social media. The goal is understandable. Most parents support efforts to protect children online. But some proposals require users or parents to provide government-issued identification, credit card information, or other personal data in order to verify that the account belongs to a child user.
That raises an obvious question: Where does all that information go?
Every new database containing driver’s license numbers, financial information, or personal records becomes a potential target for hackers. A regulation intended to solve one problem can unintentionally create another. In some cases, it may even create a bigger one.
The same principle applies to AI. A disclosure requirement for AI-generated content sounds straightforward until you start asking practical questions. If AI writes an entire article, disclosure seems reasonable. But what if it drafts a simple event announcement for a community fundraiser or church picnic? Suggests a headline? Corrects grammar? Summarizes a meeting transcript? At what point does AI assistance become AI authorship?
The closer you get to actual day-to-day use, the fuzzier those lines often become.
The same can be said for questions of liability, privacy, security, and public safety. Who should be responsible when an AI system generates false information? How much access should governments have to monitor advanced AI systems? How much information should companies be required to collect about users? Which safeguards genuinely improve safety, and which simply create additional layers of bureaucracy?
These are difficult questions, made even more challenging by the fact that AI continues to evolve at a breathtaking pace. A law drafted today may be regulating a version of artificial intelligence that looks very different from the systems people are using just a few years from now.
That’s why I think the most important quality lawmakers can bring to this discussion is humility.
Not because regulation is unnecessary. Some uses of AI clearly require oversight. Fraud, identity theft, malicious deepfakes, and other forms of deception are not hypothetical concerns.
But humility is important because nobody fully understands where this technology is headed.
The people building AI don’t know exactly where it will lead. The people regulating AI don’t know. The people using AI don’t know. We’re watching one of the most significant technological shifts of our lifetimes unfold in real time, and everyone is trying to make decisions while the ground is still moving beneath their feet.
History teaches us that today’s sensible precaution can become tomorrow’s punchline. The lawmakers who required a man carrying a red flag to walk ahead of an automobile believed they were acting responsibly. Given what they knew at the time, they probably were.
The challenge facing today’s policymakers is similar. They need to protect the public from genuine harms without unnecessarily restricting beneficial innovation. They need to address legitimate risks without creating new ones. And they need to do all of that while recognizing that the future may not unfold the way anyone currently expects.
The debate over AI regulation is no longer theoretical. It has arrived.
The question now is whether we can approach it thoughtfully enough that twenty years from now, our AI laws don’t look as quaint as a man jogging down the road waving a red flag in front of a car.