Beyond Regulation: Seven Ways AI Governance Can Keep Up With Innovation

A recent RAND report accurately diagnoses a critical failure point in modern technology policy: "big-G government" moves on a linear timeline, while frontier AI moves exponentially. Waiting for centralized, federal legislation to prevent AI insecurity is a strategy designed to fail. The report rightly argues that business and civil society must step up to manage operational risks, design market incentives, and cushion the community-level shocks of workforce disruption.

But while the report provides a useful taxonomy of roles, its prescription relies too heavily on downstream "deployers" building localized risk functions and voluntary corporate governance. In a world where AI capabilities are compounding weekly, this approach is akin to giving car buyers a blueprint to build their own seatbelts. It underestimates corporate self-interest and future AI potential capabilities and treats safety as a patch rather than a structural imperative.

To survive the rate of change ahead, we must push the conversation past voluntary risk triage and focus on hard-coded architectural boundaries, ecosystem leverage, and localized regulatory experimentation.

1. OEM Liability: Moving Safeguards to the Engine Level

Modern technology governance is trapped in a legacy Microsoft Windows paradigm—an open, highly fragmented partner ecosystem where security and safety patches are continuously deployed downstream after vulnerabilities are exploited in the wild. When applied to transformative AI, this model leaves an unmanageable surface area for catastrophic failure. Downstream small businesses and local enterprises should not carry the operational burden of fixing a fundamentally unpredictable tool.

Instead, an OEM (Original Equipment Manufacturer) approach, closer to Apple’s vertically integrated model (but with more open source access) should be encouraged and incentivized. Responsibility must be forced back onto the producers of foundational systems. The guardrails, speed limiters, and computational crumple zones must be built into the core engine before it ever leaves the factory floor. If a foundational model causes a localized cascade failure due to an architectural flaw, the liability must sit squarely with the manufacturer, incentivizing rigorous pre-deployment safety investments. AI needs the equivalent of a Chris Urmson, whose mission has been to ensure that driverless cars do not crash. AI needs to be designed to be harmless at its most foundational level.

2. Federalism as a Tactical Asset: The Laboratories of Democracy

The tech policy establishment is obsessed with achieving a single, unified federal regulatory framework. A massive federal monolith would likely suffer regulatory capture by industry giants, resulting in a stagnant framework that is obsolete before the ink dries. Recent history has shown that we can't have a single set of decision-makers for critical issues like this. The results could be too partisan and deleterious for one side or other of the political divide.

In an era of exponential change, federalism is our best defense. We should lean into the classic concept of states as "laboratories of democracy." Letting different jurisdictions pioneer distinct governance frameworks—whether California targeting training data liabilities, Texas focusing on critical infrastructure protection, or New York tackling automated financial fraud—creates a competitive ecosystem of governance. This allows us to evaluate a variety of live strategies, pressure-test them against real-world data, and naturally scale the best practices while containing the failures.

3. Building Coalitions and Safety Network Effects

We cannot wait for state or federal mandates to catch up to the competitive pressures driving the "AI race." To force OEM-level responsibility into the market today, we must leverage coalition-driven bottlenecks.

If a unified coalition of semiconductor designers, cloud infrastructure providers, and top-tier foundational labs align on immutable baseline physical standards, they create a safety network effect. Compliance ceases to be a voluntary corporate social responsibility metric; it becomes the price of admission. If a new player refuses to build to the coalition’s safety standards, they lose access to the hyper-scaled compute clusters required to train or deploy their models. The market itself can enforce compliance if we target the digital chokepoints.

4. Preparing for the Horizon of Self-Procreation

The absolute limit of our current social and regulatory adaptive capacity lies just beyond the horizon: the moment we see rapidly accelerating breakthroughs pointing toward AIs that iterate, optimize, and effectively procreate without human intervention. When code begins writing code at machine speed, traditional "human-in-the-loop" review becomes an illusion.

There is a certain rate of change that will soon outpace our adaptive capacity as a society. The systemic "snap" could happen via a critical infrastructure meltdown, mass lay-offs, or an automated false positive that triggers an unwanted cascade effect. The consequences could be so severe, we don't have the luxury of only relying on reactive cleanup crews.

To survive this transition, we need the modern computational equivalent of Asimov's "Three Laws of Robotics"—hard-coded, immutable constants built into the foundational utility functions of AI systems. This is easier said than done because of the problem of interpretation, but core principles are better than nothing. This means shifting our technical governance research toward:

5. Internalizing AI Fiduciary Responsibility: AIs need to operate from a standpoint that they have a fiduciary responsibility to their users. They have to put their users best interests above their own.

6. Automated Circuit Breakers: Narrow, isolated security protocols designed to instantly throttle token access or cloud compute resources the moment anomalous self-replication or optimization loops are detected.

7. Self-Policing and Interpretability Architecture: Forcing systems to prioritize transparent self-reporting and step-by-step interpretability directly over optimization speed.

The safest, most efficient and equitable systems are slightly inefficient. There is a reason we have anti-monopoly laws and regulations and similar circuit breakers and brakes across a wide range of technologies and products. Governance is not antithetical to innovation, nor should it be, but it should be antithetical to runaway systems.

The capacity we build today cannot just be about writing better corporate policy guidelines. We must change the core architecture of how these technologies are built, hosted, and deployed. If we don't build the brakes into the engine now, we won't be able to stop the vehicle when it accelerates beyond our ability to steer.