1. Research Question

Does AI require a different form of regulation from the regulatory systems we have today, and what exactly are we regulating?

2. Research Context

By this point, I had arrived at governance lag. The previous experiments had established that execution authority was migrating from humans to systems and that governance architecture was struggling to keep pace with that migration. The next question was therefore about regulation.

Regulation is the lever most commonly proposed when societies encounter technologies that create new forms of risk or power. When artificial intelligence is discussed in institutional and public policy settings, the response is frequently framed in regulatory terms. Governments should regulate AI. Companies should be subject to new obligations. High-risk systems should face stricter controls. Certain uses should be prohibited. Providers should be held accountable for the consequences of their systems.

The instinct is understandable. Regulation is one of the established mechanisms through which societies place boundaries around activities that can produce significant consequences.

But this raised a more fundamental question.

What exactly are we regulating when we say that we are regulating AI?

Artificial intelligence is not a single regulatory object. It can be a model, a company, a dataset, a product, a service, a decision-making system, an autonomous agent or a component within a larger infrastructure. Each interpretation produces a different regulatory problem.

The intellectual property debate made this particularly visible. The question of whether copyrighted material can be used to train an AI model is not the same question as whether the resulting model should be commercially controlled. Nor is it the same question as who owns an output produced by the model. What appears to be one debate about AI and intellectual property is actually a series of questions about what enters the system, what is produced by the system and who has rights over the resulting value.

Data privacy presents a similar problem. The issue is not simply whether an AI company possesses data. It concerns what data enters the system, whether its use is legitimate, what purposes it can be used for, whether individuals retain meaningful rights over it and whether information can be combined, inferred or transformed in ways that exceed the original conditions under which it was collected.

The regulatory challenge therefore extends across the system. It concerns the material entering the system, the capability being developed inside it and the consequences produced when that capability becomes action.

This became particularly important under the Infrastructure Condition. AI increasingly operates within an interconnected environment of compute, data, cloud infrastructure, networks, identity systems, APIs, software and execution systems.

The capability of an AI system is therefore not contained entirely within the model. Its capacity to produce consequences depends upon the infrastructure to which it is connected and the authority that infrastructure allows it to exercise.

3. Research Method

I treated the experiment as a conceptual regulatory analysis rather than an attempt to determine whether a particular piece of AI legislation was sufficient.

I examined the regulatory problem across the lifecycle of an AI system, beginning with what enters the system, moving through the capability developed inside the system and ending with what happens when that capability produces consequences.

I then used existing regulatory categories as a stress test. Intellectual property provided a case for examining what enters the system and who has rights over the material used to develop it. Data privacy provided a case for examining how information enters, moves through and is transformed by AI systems. Model capability provided a case for examining whether regulation should intervene before a system produces an external consequence. Liability provided a case for examining where responsibility should sit once an AI system acts.

I also examined the United States as a live regulatory case. Federal authorities have increasingly used reporting requirements, testing and evaluation mechanisms and export controls to influence advanced AI development. These interventions provide evidence of regulation moving beyond the finished AI application and towards model capability and the infrastructure required to develop it.

I used these cases to identify three points of regulatory intervention. The first concerns what enters the system. The second concerns what the system is capable of doing. The third concerns what happens when the system acts.

4. Research Findings

The first finding was that AI is not a single regulatory object. A model, a developer, an application, an autonomous agent, a decision and an infrastructure layer are different things. Regulating one does not necessarily regulate the others.

The second finding was that existing regulation remains relevant. AI does not automatically invalidate intellectual property law, privacy law, consumer protection, financial regulation, product regulation or liability frameworks. Many of these systems can continue to regulate the consequences of AI. The problem is that AI connects these regulatory domains in ways that existing categories did not necessarily anticipate.

A single AI system can consume protected material, process personal data, develop capabilities, make decisions and initiate actions. The regulatory questions therefore move across the system rather than remaining within one established category.

The third finding was that the regulatory problem can be organised around three points of intervention.

The first concerns what enters the system. Intellectual property and data privacy primarily concern what enters the system, the conditions under which it can enter and the rights attached to that material.

The second concerns what the system is capable of doing. This concerns model capability, how that capability is measured and whether certain capabilities should trigger regulatory intervention before deployment.

The third concerns what happens when the system acts. This concerns liability and consequence allocation. If an AI system produces a consequential outcome, responsibility has to attach somewhere. It may sit with the developer, deployer, owner, operator, user or another actor within the chain.

The fourth finding was that model capability itself is becoming a regulatory object.

The United States provides a live case. Federal authorities have used reporting requirements, testing and evaluation mechanisms and export controls to influence advanced AI development. These interventions reach beyond the regulation of a finished AI product and towards the capability of the model and the infrastructure that enables that capability.

This is significant because regulation does not necessarily have to wait until an AI system causes a consequence before intervening. It can intervene earlier, at the level of capability or access to the infrastructure required to develop that capability.

The fifth finding was that ownership and authority are increasingly difficult to separate.

The organisations developing advanced AI models can determine how models are trained, constrained, deployed and accessed. They can determine which systems the models connect to and which capabilities are made available to others.

This creates a question of authority that extends beyond conventional corporate ownership.

Who should hold authority over a model whose capabilities can affect people who have no relationship with the organisation that built it?

The sixth finding was that governance remains necessary, but as supporting architecture rather than as the regulatory object itself.

Regulation establishes formal boundaries. Governance organises authority within and around those boundaries.

Regulation may require human oversight, but governance determines who exercises that oversight and whether intervention is actually possible. Regulation may establish liability, but governance determines where custody and responsibility sit within the organisation. Regulation may restrict access to data, but governance determines who controls that access.

The central finding was therefore that AI regulation can be understood across three points of intervention: what enters the system, what the system is capable of doing and what happens when the system acts.

These are not three separate regulatory systems. They are three points along the same chain.

Inputs shape capability. Capability creates potential authority. Authority produces action. Action produces consequences.

5. Research Implications

The first implication is that the question of whether AI needs new regulation is too broad.

Some AI-related problems can be addressed through existing regulatory frameworks. Others may require adaptation. Still others may require new regulatory instruments.

The more useful question is where existing regulatory categories cease to correspond to the technological reality.

The second implication is that regulation may need to move upstream.

Traditional regulation often responds to activities, products or consequences. AI creates circumstances in which intervention may also need to occur before capability becomes action.

This raises the possibility of regulating access to certain capabilities, development conditions, testing requirements or infrastructure.

The third implication concerns liability.

If AI systems increasingly participate in execution, consequence allocation becomes more difficult. Regulation cannot simply assume that the human who pressed the final button remains the only meaningful point of responsibility.

As execution authority migrates into systems, regulation may need to identify responsibility across the chain through which authority is delegated and exercised.

The fourth implication concerns the AI laboratories themselves.

The organisations developing the most capable systems increasingly possess authority over technologies whose effects can extend into society at scale. This raises questions about whether regulation should focus not only on the systems they produce but also on the authority they exercise over those systems.

The fifth implication is that the regulatory object may need to become dynamic.

A model may begin as a research system, become a commercial product, acquire access to external tools, become an autonomous agent and eventually operate as part of critical infrastructure.

Its regulatory significance changes as its capability and authority change.

Regulation may therefore need to respond not only to what a system is, but to what it is capable of becoming and what it is permitted to do.

6. Conclusion

The experiment began with a simple question: does AI require a different form of regulation?

The answer was more complicated than simply yes or no.

AI does not necessarily require the replacement of existing regulatory systems. Many existing forms of regulation remain relevant and necessary.

The deeper problem is identifying the regulatory object.

AI can be understood as a model, a product, a service, a capability, an agent, an infrastructure layer or a system of execution. Each creates different regulatory questions.

The experiment therefore produced a more precise proposition.

The challenge of AI regulation is not simply to create new rules. It is to determine what should be regulated, where regulation should intervene and to whom authority and responsibility should attach.

Three points became particularly important.

What enters the system. What the system is capable of doing. What happens when the system acts.

Intellectual property and data privacy operate primarily at the first point. Model capability operates at the second. Liability and consequence allocation operate at the third.

The significance of the Infrastructure Condition is that these points are increasingly connected.

Inputs shape capability. Capability creates potential authority. Authority produces action. Action produces consequences.

The regulatory challenge therefore emerges at the point where technological capability becomes executable authority.

This leaves the experiment with a final question.

If execution authority is migrating from humans into systems, is the new regulatory object no longer simply AI, but the authority to execute through AI?

7. References

Lessig, L. (1999). Code and Other Laws of Cyberspace. Basic Books.

The White House. (2026). Promoting Advanced Artificial Intelligence Innovation and Security.

U.S. Department of Commerce. (2024). Commerce Marks One-Year Anniversary of Historic Biden-Harris Administration Executive Order on AI.