What should AI policy actually govern?

01 / The technology

First, establish what we’re actually regulating.

A system that identifies a face, generates a video, steers a vehicle, or predicts a molecular structure may be described as artificial intelligence. That shared label does not tell legislators which capability, activity, or consequence needs their attention.

Before debating whether AI needs more or less regulation, we should be able to say what part of it we mean. Four overlapping areas offer a useful starting point. They are a map of capabilities and applications, not an exhaustive technical classification or four separate legal categories.

These areas overlap (Exhibit 1). Generative models can support robotic control. Computer vision can use transformers. Scientific systems can combine predictive tasks with generative methods; AlphaFold 3, for example, uses a diffusion-based architecture to predict biomolecular structures. A rule aimed at one technical method can therefore reach applications well beyond the one its authors had in mind. [1]

That matters when legislators define the scope of a bill. Two systems might identify people in the same setting, with similar consequences, while using different model architectures. A definition tied too closely to one architecture could subject those systems to different safeguards for reasons unrelated to the people affected.

Technical differences can justify different treatment when they change a system’s capabilities, risks, or the ways it can be tested and controlled. Our argument is that legislators should explain that connection. The method used to build a system should not become an accidental substitute for the activity they intended to regulate.

02 / The policy question

Then ask which legislative domain we’re evaluating.

Once we identify the technology, we still need to identify the public concern. Is the issue an adversary’s access to advanced chips, a person’s ability to challenge an automated decision, or responsibility for a machine that causes physical harm? Each question calls for different evidence and a different policy response (Exhibit 2).

These domains overlap too (Exhibit 3). Facial recognition used in a military setting may raise national-security questions; its use by domestic law enforcement also raises questions about privacy, due process, and civil liberties. An autonomous vehicle raises safety questions even when its perception system uses methods found in ordinary image-recognition software.

The purpose of separating the domains is to make the discussion specific enough to evaluate. A national-security rationale should identify the strategic threat. A civil-rights proposal should identify the decision, the affected people, and the protection they need. Calling both “AI regulation” does not resolve either question.

03 / National security

Distinguish capabilities, competition, and components.

National security is a major domain of AI policy because it reaches from the supply of computing hardware to the use of systems in intelligence and defense. Even here, there is more than one problem to solve (Exhibit 4).

Capabilities: what can a system enable?

Legislators may be concerned about military applications, cyber operations, biological misuse, or intelligence analysis. The relevant question is what a system enables a particular actor to do, under what conditions, and with what evidence. A model’s name, size, or technical family is only useful if it helps establish that connection.

Competition: what capacity does a country need?

This includes research, manufacturing, infrastructure, and the people needed to develop and use the technology. The CHIPS and Science Act, signed in August 2022, provided funding for U.S. semiconductor manufacturing and research. It illustrates how legislation can build industrial capacity rather than simply impose restrictions on AI users. [2]

Competition between countries is also different from competition among firms. A policy that strengthens a national industry still needs scrutiny for how it affects smaller companies, access to infrastructure, and concentration within the market.

Components: who can obtain the necessary inputs?

Advanced chips, manufacturing equipment, computing infrastructure, and access to sensitive systems can become objects of policy in their own right. The RESTRICT Act (H.R. 6879), introduced in December 2025, illustrates this approach: the introduced bill would restrict advanced-chip exports to countries of concern while providing a controlled pathway for eligible U.S. firms’ overseas facilities. This is an example of the proposal as introduced, not a statement of current export requirements. [3]

These approaches should be judged against their intended effects. A restriction on access needs a plausible account of what it prevents and how it will be enforced. An investment program needs an account of the capacity it will create. Neither, by itself, answers how an employer should use AI to assess a job applicant.

04 / Legislative examples

Existing measures show how differently the problem can be defined.

Looking at actual measures helps distinguish the technology being discussed from the legal obligation being proposed (Exhibits 5 and 6). The following examples illustrate different choices of scope; they are not interchangeable models or endorsements of every provision.

International governance introduces another instrument. The Council of Europe’s AI Framework Convention opened for signature in September 2024 and addresses human rights, democracy, and the rule of law across the AI lifecycle. It is a treaty framework with its own scope and ratification process; signature should not be read as proof that identical domestic obligations apply in every country. [8]

05 / Choosing a response

Define the gap before choosing the instrument.

A useful policy discussion should now be able to name the capability or activity, the domain of concern, and the people or institutions affected. Only then can legislators judge whether the response calls for a new statute, an amendment, agency rulemaking under existing authority, procurement standards, public investment, or an international agreement (Exhibit 8).

Consider two systems used to identify people. If they create comparable risks in the same setting, a difference in model architecture needs a relevant justification before it produces different protections. Now consider that same capability used to inspect a manufactured component. The purpose, potential harm, and appropriate oversight change, even if some of the underlying methods remain similar (Exhibit 9).

This is the distinction we want AI policy to make: consistency where the capability and consequences are comparable, and specificity where the use changes the stakes. Legislators should also ask who controls the relevant decision. Developers, application builders, deploying organizations, and distributors may each hold different information and different powers to prevent harm.

RUDI’s work adds a practical concern to this discussion. Oversight depends on people who can exercise it. A public buyer needs enough expertise to question a vendor. An employee reviewing an automated recommendation needs time, evidence, and authority to reject it. A smaller organization needs requirements it can understand and implement. Education and institutional capacity belong alongside restrictions and remedies.

Our approach to responsible AI brings those questions into the work of an organization. The legislative discussion should begin with the same discipline: identify what the system does, explain the concern, and make clear what the proposed response is expected to change.