Living digestA multi-source map of the regulation debate — v1, begun June 2026. Two arguments mapped so far.
How do you govern a technology that changes faster than the law can?
AI advances in months; legislation takes years. This is a living field map of the smartest answers to that mismatch — read side by side. It opens with two: two crossbench peers writing in The Economist, who would re-engineer the sectoral regulator; and Dean Ball, soon of OpenAI, who would re-engineer how we govern the frontier lab. Part III draws them together.
What this is
A comparative reader's map on one question: how to regulate AI that moves faster than the rulebook. Rather than summarise a single article, it collects high-quality arguments and reads them against each other — preserving each author's frame while surfacing where they converge and clash.
Mapped so far:Part I — Gus O'Donnell & Sharon White, The Economist (the applied-AI, sectoral-regulator view). Part II — Dean Ball, Hyperdimensional + a companion podcast (the frontier-lab, catastrophic-risk view). Part III — an independent synthesis. More sources will be added over time.
“To keep on top of AI, shift from minimising risk to managing it”
By Gus O’Donnell & Sharon White — June 23, 2026. A former cabinet secretary and a former head of Ofcom, both crossbench peers.
Frame: applied AI across regulated sectors — finance, insurance, health care, government services. The unit of governance is the sectoral regulator.
Months vs. years
The mismatch at the heart of it.
Big, unpredictable advances arrive in months; rules embedded in legislation are “instantly outdated.”
8 yrs
Britain’s Online Safety Act, green paper to full implementation.
Exhibit A for why slow, consultation-bound lawmaking can’t govern fast-moving technology.
4
Jurisdictions, four very different postures.
America permissive; Britain adaptive but under-equipped; Singapore light-touch; the EU precautionary and slow.
4
Features of the proposed regime.
Manage trade-offs; pre-approve them; judge at speed; recalibrate — don’t re-legislate — after failures.
The core move: stop asking regulators to minimise risk and start asking them to manage it. Judge a company not on whether an outcome turned out badly, but on whether its decision was appropriate at the time it was made — given the trade-offs it faced and the evidence it had. The aim is a system that holds firms to account for the choices buried in their models, while still giving them room to take the risks that growth requires.
Section 01 · Behind the curve
01Regulators are behind the technology they police
The argument opens with a live case. Earlier in June 2026 Anthropic released Fable 5, a public version of its more powerful Mythos model. Within days the American government moved to restrict access by foreign nationals on national-security grounds. Anthropic — arguing the risks were overstated and the model’s features already known — couldn’t comply with a demand for selective access, so it suspended access for everyone.
Whatever the merits of that particular dispute, the authors use it to make a structural point: regulators are behind the curve of the technologies they are supposed to supervise, and their reactions are hard to predict. That unpredictability is bad for companies, consumers and society alike.
Crucially, they don’t blame the regulators. The fault lies with an outdated regulatory system — one designed for a world where technology changed slowly enough that fixed rules could keep pace. The people inside it are doing their best with the wrong tools.
The case in brief
The releaseJune 2026
Anthropic ships Fable 5, a public version of the more powerful Mythos model it had previously withheld.
The reactiondays later
Washington moves to restrict foreign-national access, citing national security.
The deadlockthe result
Unable to offer selective access, the firm suspends access for all users.
An illustration, not the whole indictment: the authors care less about who was right than about how unpredictable and ill-fitting the response was.
The thread
The problem isn’t bad regulators — it’s a regulatory model built for a slower world. When supervisors can’t anticipate technology and react in ways firms can’t predict, everyone loses: that uncertainty is itself a cost on innovation and on the public.
Section 02 · Why old rules fail
02Three reasons the traditional approach is nonsense now
The nub of the problem, the authors say, is obvious. Three forces together — the speed of change, the unpredictability of innovation, and the rise of AI that acts on its own — make a mockery of regulation written into law after lengthy consultation.
Force 1
Speed
Big advances happen in months. Rules embedded in legislation after long consultation are “instantly outdated” by the time they take effect.
Force 2
Unpredictability
Where the technology jumps next is genuinely hard to foresee — so rules drafted for today’s systems miss tomorrow’s.
Force 3
AI that acts
AI is shifting from models that recommend actions to systems that act themselves — at scale, across whole sectors.
From recommending to acting
The decisive shift is autonomy. When AI merely advised, a human still made each call. When AI acts — at scale, across banking, insurance, health care and government services — the systems make trade-offs that boards, let alone regulators, may not even be aware of.
It is the combination, not any single force, that breaks the old model: fast + unpredictable + self-acting at scale.
Faced with this, many countries have largely abandoned attempts to regulate AI directly. Instead they lean on existing sectoral regulators — the watchdogs for finance, data, health and the rest — to fill the gap. The trouble is that those regulators are often handed the job without the necessary tools or mandate.
The result is a structural mismatch: a fast, self-acting technology supervised by a slow, retrospective, consultation-bound apparatus. Something has to give — and the authors argue it should be the apparatus, not the ambition to hold AI to account.
The thread
Legislation-by-consultation cannot govern a technology that changes in months, jumps unpredictably, and increasingly acts without a human in the loop. Offloading the problem to under-equipped sectoral regulators is a stopgap, not a solution.
Section 03 · The hidden trade-offs
03The choices are made inside the model
AI models are always weighing one aim against another. These trade-offs are the real substance of what a model does — yet they are usually made inside the model, without being made explicit to decision-makers. The work gets done; the value judgement never surfaces.
Credit scoring & hiring
AccuracyDecisions that reflect the historical data as closely as possible.
vs
FairnessAvoiding bias that accurate-but-skewed history can encode.
A model trained on accurate historical data may still display unconscious bias — a live tension wherever past outcomes feed present decisions.
Banking
Fraud preventionBlock more suspicious activity, catch more bad actors.
vs
AccessDon’t lock legitimate customers out of their own money.
Tighten the screws and you stop fraud — and wrongly reject real customers. The model picks a point on that line; few decision-makers ever see where.
Health care · triaging GP referrals for specialist review
Threshold too lowRefer freely — and overwhelm hospitals.
vs
Threshold too highRefer sparingly — and miss early-stage cancers.
The model does the work, but the decision needs to be made by accountable humans and subject to regulation — not buried in a threshold no one chose deliberately.
“These choices are often made inside the model, without being made explicit to decision-makers.”
O’Donnell & White, The Economist
The thread
Every consequential AI system is quietly resolving a value judgement — accuracy against fairness, security against access, capacity against safety. The danger isn’t that trade-offs exist; it’s that they are made invisibly, so no accountable human ever owns them. Surfacing them is the precondition for governing them.
Section 04 · Four postures
04Four jurisdictions, four ways of falling short
No major jurisdiction has cracked it. The authors survey four leading approaches — and find each inadequate in its own way. The through-line: none moves at the speed of the firms it oversees while still holding them to account for the trade-offs in their models.
United States
Permissive & fragmenting
No comprehensive federal AI statute across sectors. Relies on executive action, agency enforcement and sectoral oversight, with highly variable state approaches — permissive at the federal level, increasingly fragmented between states.
United Kingdom
Adaptive but under-equipped
A principles-based approach run through sectoral regulators, who are expected to apply core principles — transparency, fairness and the like. Adaptive in theory, but under-equipped in practice.
Singapore
Deliberately light-touch
Leans mainly on voluntary governance frameworks, technical-assurance tools and sector guidance. Deliberately light-touch — flexible, but with limited bite.
European Union
Precautionary & slow
The only one with a single statute reaching across all sectors, classifying AI systems by risk level and prohibiting some uses outright. Comprehensive — but precautionary and slow.
The authors’ one-line verdict: America is permissive at the federal level and increasingly fragmented between states; Britain is adaptive in theory but under-equipped in practice; Singapore is deliberately light-touch; the EU is precautionary and slow. Different failures — same gap.
The thread
The spread runs from permissive (US) to precautionary (EU), with principles-based (UK) and voluntary (Singapore) in between. Yet none manages to move at market speed and hold firms accountable for their models’ trade-offs and leave room for productive risk-taking. That triple failure is what the proposal sets out to fix.
Section 05 · The innovator’s bind
05Slow, retrospective rules trap the innovator
Because regulatory interventions are slow and highly retrospective, innovators find it genuinely hard to judge what risks to take. The system punishes with hindsight — so firms face a lose-lose choice that has nothing to do with whether their decisions were reasonable when they made them.
The bind has two horns. Move early, and you accept that if something later goes wrong, the regulator will exact a reckoning based on hindsight — judging your call by an outcome you couldn’t have known. Hold back, and you simply hope the regulator eventually constrains the rivals who didn’t.
Either way, the decision turns on guessing the regulator’s future mood rather than on the merits of the decision itself. That, the authors argue, is exactly backwards. Regulatory judgments should be based not on the outcomes of companies’ decisions, but on the appropriateness of those decisions at the time.
The two horns
Move early
Take the risk — and live with a hindsight reckoning if anything goes wrong, judged on the outcome rather than the decision.
Hold back
Sit tight — and hope the regulator eventually constrains the risk-taking rivals who pressed ahead.
Both responses optimise for the regulator’s unknowable future judgement — not for whether the decision was sound on the evidence available.
“Regulatory judgments should be based not on the outcomes of companies’ decisions, but on the appropriateness of these decisions at the time.”
O’Donnell & White, The Economist
The thread
Retrospective, hindsight-driven enforcement makes risk unmanageable: firms gamble on the regulator’s future verdict instead of on the soundness of their choices. Shift the basis of judgement to appropriateness at the moment of decision, and the whole incentive structure changes — which is what the four reforms operationalise.
Section 06 · A regime to manage risk
06Four features of a system built for speed
A regulatory system built around appropriateness-at-the-time would have four core features. Together they move the regulator from a slow, retrospective judge to a real-time partner that pre-agrees the trade-offs and adjusts them as evidence arrives.
1
Reframe the goal
From minimising risk to managing it
Shift the aim of regulation toward assessing the trade-offs firms make at the moment of decision — such as a bank’s choice between fraud prevention and access.
The obligation: firms must show they have made reasonable efforts to identify and share with the regulator the main trade-offs that drive their models’ behaviour.
Manage, don’t minimiseSurface the trade-offs
2
Agree in advance
Pre-approve the intended trade-offs
Firms should seek regulatory approval of their intended trade-offs in advance, showing the evidence on which those decisions rest.
The bargain cuts both ways: company and regulator are then held to the terms of that approval when outcomes are later judged — without a retrospective rewriting of the rules.
Prior approvalEvidence-basedNo hindsight rewrite
3
Match the market’s speed
Judge in real time, with AI-assisted tools
Regulators must make these judgments at the speed necessary in fast-moving markets — not via periodic returns and retrospective investigations.
What it requires:AI-assisted supervisory tools that let regulators monitor regulated firms’ behaviour in real time — supervising AI, in part, with AI.
Real-time supervisionAI-assisted tools
4
Respond without re-legislating
Recalibrate for the future, don’t pass a new law
When later failures reveal risks not understood at the time, the response should be a recalibration for future decisions — not another piece of legislation.
Worked example: if an agreed fraud-vs-access trade-off produced a wave of AI-driven mortgage rejections, the regulator could simply set a new threshold for future applications — immediately, without waiting for a change in the law.
Recalibrate, don’t re-legislateForward-looking
Today’s modelMinimise risk · judge by outcomes · retrospective · fixed in legislation
→
the shift
The proposed modelManage risk · judge by decisions · real-time · recalibrated by the regulator
The thread
The four features form a loop: surface the trade-offs, pre-agree them on the evidence, supervise them in real time, and recalibrate them — not the statute book — when reality surprises you. The point is a living contract between firm and regulator that moves as fast as the technology.
Section 07 · What it would cost
07The price — and why it beats the status quo
Such a regime is not free. To make it work, regulators would need technical depth and investigative capability to match the firms they oversee — and the political nerve to accept that fast decisions in unpredictable markets will sometimes be wrong.
What it would demand of regulators
Technical depth
Capability that matches the firms they supervise — not periodic paperwork.
Investment
Real money for tools and talent — “of a kind few governments have shown much appetite for making.”
Tolerance for error
Willingness to live with the risk that decisions taken at speed may turn out wrong.
The trade the authors are asking you to make
These are real political costs — investment few governments want to fund, and the certainty that some real-time calls will misfire and invite criticism. The authors don’t pretend otherwise.
But the costs must be weighed against the dead weight of an outdated regulatory system — one that already fails firms, consumers and society by being slow, unpredictable and retrospective. Inaction is not the safe option; it is just a less visible cost.
The bottom line
The choice isn’t between a risky new regime and a safe old one. It is between paying to build supervisory capacity now, or continuing to bear the hidden costs of a system that cannot keep up.
“It is time to recognise the danger the status quo poses.”
O’Donnell & White, The Economist
The thread
Managing risk rather than minimising it asks governments to invest in regulatory capacity and accept that fast judgements will sometimes be wrong. The authors’ closing wager: those costs are smaller than the mounting, hidden cost of leaving an obsolete system in place.
II
Source 02 · Hyperdimensional + The Cognitive Revolution
“What Should Be Done” — and an interview on joining OpenAI
By Dean Ball — June 2026. Former White House (OSTP) AI-policy staffer and contributor to the AI Action Plan; soon to lead a new “Strategic Futures” team at OpenAI. Drawn from his Substack post and a companion podcast interview. His views, written before his start date and explicitly not OpenAI’s.Frame: frontier labs and catastrophic risk. The unit of governance is the lab as an institution — not the deployed product.
Section 08 · Ball’s diagnosis
08A licensing regime nobody can read
Ball reads the same Fable episode from the frontier. When the administration signed its Cyber & AI Executive Order — nominally a voluntary 30-day testing program — he argued it was really a de facto involuntary licensing regime. Events, he says, proved it: Fable’s public access was revoked on security grounds, and OpenAI’s GPT-5.6 was limited to a small set of US companies at the government’s request.
The deepest problem is that nobody knows the bar — and he means that literally. The administration itself can’t say what safety standard would make it comfortable releasing a model at or beyond Mythos’s capability. So the default answer to any release request becomes “no” until some standard exists.
Whether that standard will ever be public (the testing program is classified) or good is doubtful: he notes that few senior officials now driving AI policy have frontier experience — the head of the Center for AI Standards and Innovation, hired with OpenAI and Anthropic experience, was fired within days, and CAISI staff were reportedly placed on a stop-work order during the crisis.
The regime, in brief
The mechanismthe EO
A “voluntary” classified pre-release testing program — functioning as license-to-ship.
The barunknown
No published safety standard; the government itself can’t articulate what “safe enough” means.
The resultin practice
Default “no” to broad release. Fable pulled; GPT-5.6 limited to a handful of firms.
His objection is not that scrutiny exists, but that it is secret, improvised, and unreadable to the firms it governs.
He is not a risk-denier. Ball insists the administration is “not at all directionally wrong” that catastrophic-risk concerns are real — he raised them himself in the AI Action Plan. He faults the prior year’s “lullaby” that mocked those risks (a leaked draft order called them a “purely speculative suspicion”), but he also says it’s wrong to blame the administration as a whole, and wrong to blame the risk-aware for “causing” the overreaction (rebutting Marc Andreessen). The response is “driven by the fundamental reality of AI progress, not by the rhetoric of any person or group.”
The economic cascade he warns about
Restrict releasesGate frontier models to a handful of approved US firms, indefinitely.
→
Demand rendered unlawfulThe global market the $100bn build-out assumes simply isn’t allowed to exist.
Every week of delay eats the short window labs have to recoup training costs. Severe restriction risks making the “over-built infrastructure” prophecy self-fulfilling — and a panic could cascade past AI into nuclear, gas, power electronics and batteries, all of which bank on AI demand.
“In the bears’ minds it would be demand that never materialises. In reality, it would be demand that the US government renders unlawful.”
Dean Ball, “What Should Be Done”
The thread
The current US approach is a secret, improvised preapproval regime with no legible standard — born of real concern but executed by officials new to the issue. It’s not that something shouldn’t be done; it’s that this is the wrong way to do it, and the economic and democratic costs of opacity are mounting.
Section 09 · Ball’s prescription
09Regulate the lab, not the model
Ball’s core move is to change the unit of regulation — from the model to the frontier lab as an institution. A model, he notes, is just “an assemblage of floating-point numbers”; regulating it is the wrong abstraction for what actually needs governing.
Why not the model · 1
It’s a moving target
Labs ship many models, often. With continual learning, weights may change weekly, daily, even per user — a regime built on “the model” could outlaw the innovation itself.
Why not the model · 2
Thresholds rot
Algorithmic efficiency means a capability needing huge compute today needs far less in 6–18 months. Any capability/compute threshold is obsolete on arrival.
Why not the model · 3
The action is internal
Most rules trigger on public release — but the consequential decisions (internal deployments, recursive self-improvement) happen inside the lab, out of regulatory view.
So what would he build instead? A four-part scaffold — deliberately parallel, in spirit, to the Economist’s four reforms, but aimed at the lab rather than the sectoral regulator.
1
Start from what exists
Federalize the labs’ safety & security frameworks
The best available starting point is the labs’ own published frameworks (Anthropic, DeepMind, OpenAI). California, New York and Illinois already require public disclosure of them; make that federal law.
The honest caveat: nobody yet knows how to write a truly excellent version of “what good looks like” — and a static document isn’t enough on its own.
Disclosure floorFederalize state laws
2
Verify, don’t trust
Audit labs through independent verification organizations
Private, technically elite bodies test whether labs actually follow their frameworks — and probe their internal governance of the recursive-self-improvement loop.
Why private, not government: they can pay outside federal scales, get compute fast, innovate on audit methods (even continuous, AI-assisted audits), and win international buy-in a politically-valenced US agency can’t.
License the auditors; use carrots, not just sticks
The state’s role is to certify the verifiers — as it licenses financial auditors — allowing multiple specialized bodies (one for cyber, one for bio, one for RSI governance).
The incentives: require certification to participate, or reward it with liability safe-harbors and government procurement. The market does the rest — uncertified labs would struggle to find insurance or enterprise customers.
License the auditorsSafe harborProcurement leverage
4
The master safeguard
Keep frontier capability broadly diffused
Diffusion is the deepest protection: if every bank, university and industry depends on AI, a large coalition checks the worst outcome — government monopolization of the frontier. Concentration, in a few firms or the state, is the real danger.
Where government is uniquely able: reserve its scarce capacity for software-vulnerability patching, critical-infrastructure security, and biosecurity (e.g. nucleic-acid-synthesis screening, biosurveillance).
Broad diffusionAnti-monopolizationCyber & bio focus
Today’s unitRegulate “the model” · trigger on public release · static, secret approval
Momentum, and a caveat. Ball points to the Obernolte–Trahan “Great American AI Act” as “something very close” to this — the first serious, bipartisan frontier-governance framework before Congress — and to an existing scaffold of bodies (Frontier Model Forum, AVERI, METR, Apollo Research, Fathom, the AI Underwriting Company). He concedes the obvious objection — that verifiers may just be checking labs against their own frameworks — and answers that nobody can yet write a better one, that the labs are best-placed to draft the first, and that real-world experience is the only way to improve them.
“We have to work with the soil that we have in front of us, not the soil we imagine that we could have if we were somewhere else.”
Dean Ball, “What Should Be Done”
The thread
Shift the unit from the model to the lab; police it with private, expert verification backed by light-touch government certification; reserve the state for cyber, infrastructure and bio; and above all keep the technology broadly diffused so power can’t concentrate. Imperfect, but buildable now — and Congress is, for the first time, close.
III
Part 03 · Synthesis
Where the two arguments meet — and where they part
An independent comparison of Sources 01 and 02. The two pieces share a surprising amount of DNA, but aim at different layers of the same stack — which is exactly why they end up complementary rather than rival.
Section 10 · Synthesis
10Same diagnosis, different layer of the stack
O’Donnell & White and Dean Ball start from the identical complaint — fixed legislation cannot govern a technology that changes in months — and reach strikingly similar structural conclusions. Then they diverge, because one is looking at deployed AI in regulated sectors and the other at the frontier lab upstream.
Where they converge
Convergence · 1
The pace gap
Both open on the same mismatch — months vs. years — and both reach for the same live example: the June 2026 Fable/Mythos episode. Static, consultation-bound law can’t keep up.
Convergence · 2
Govern the entity, not the artifact
Each rejects regulating a fixed object. O’D&W target the firm’s decisions; Ball targets the lab and its internal behaviour. Both stress that the real action is invisible — inside the model, inside the lab.
Convergence · 3
Supervise continuously, with expertise
Both want real-time, AI-assisted oversight (not periodic paperwork) and both insist it takes elite technical talent the slow state struggles to hire — and both want iteration over hindsight re-legislation.
Where they part
The question
Source 01 · The EconomistO’Donnell & WhiteGovern the sectoral regulator
Source 02 · HyperdimensionalDean BallGovern the frontier lab
Layer of the stack
O’Donnell & WhiteDeployed, applied AI across regulated sectors — banking, insurance, health, government services.
O’Donnell & WhiteEmpowered sectoral regulators — upgrade the existing state watchdogs.
BallPrivate independent verification organizations — route around the slow state; government merely licenses them.
Stance toward the state
O’Donnell & WhiteInvest in government capacity; the regulator is the solution, if properly equipped.
BallDistrust government capacity (and monopoly); keep its role narrow — cyber, infrastructure, bio.
Primary fear
O’Donnell & WhiteInvisible trade-offs that no accountable human owns.
BallConcentration — especially government monopolization of the frontier.
Timing of judgement
O’Donnell & WhitePre-approve intended trade-offs, then recalibrate forward.
BallAudit adherence after the fact; reward it with safe-harbors and procurement.
The core verb
O’Donnell & WhiteManage the risk — don’t minimise it.
BallDiffuse & verify — don’t monopolize it.
The productive tension
The disagreement is less a contradiction than a division of labour. O’Donnell & White govern the deployment surface — where AI touches consumers through banks and hospitals. Ball governs the upstream lab — where the most powerful systems are trained and internally deployed. A complete regime arguably needs both: verified labs feeding accountable sectoral deployment.
Their sharpest genuine clash is over the state itself. The peers want to pour resources into the public regulator; Ball thinks the public regulator will be too slow and too tempted by monopoly, and wants private bodies doing the technical work under light public certification. That is the fault line a reader should watch as more sources are added.
One stack, two layers
UpstreamBall
The frontier lab: training, internal deployment, RSI. Governed by verification + diffusion.
DownstreamO’D & W
The deployed system in a regulated sector. Governed by managed, pre-agreed trade-offs.
Shared spineboth
Speed-matched, expert, continuous oversight of an institution’s behaviour — not a static rulebook.
A caveat worth keeping: the two aren’t fully commensurable. Forcing them into one set of buckets would flatten real differences in scope.
The shared wager
Both bet that the obsolete status quo is more dangerous than the discomfort of reform — that the way to govern fast AI is to make oversight itself fast, expert and continuous, trained on an institution’s real behaviour rather than a frozen rulebook. They differ on who holds the clipboard — an upgraded public regulator, or a licensed private verifier — and on which layer of the stack most needs watching. Read together, they map the problem more completely than either does alone.
This map is a living document. Part III will grow as sources are added — each new high-quality argument gets its own Part with a source band, and a row in the comparison above. Candidates to slot in next: a frontier-lab safety framework read directly, a dissenting “don’t-regulate-yet” case, or an EU AI Act practitioner’s view.