Bloomberg maps out how to regulate AI, from incident reports to an outright ban

The debate over AI regulation stopped being a question of "whether to regulate" a long time ago. Now the argument is about where on the scale of strictness to stop. Bloomberg Tech has collected the options in a single guide: at the soft end, a duty to report safety problems; at the hard end, an outright ban on "superintelligence." The original sidebar gives few details, so below we lay out this scale using examples of laws that have already been passed or have been debated. The 10^25 FLOPs threshold in the European AI Act and fines of up to 7% of global turnover show that this is not an abstraction.

The soft end: reporting and testing

The most realistic measure is a duty to disclose incidents. It costs the state little and does not stop companies from shipping products. This is how California's SB 53, signed in September 2025, works: large developers of frontier models publish their safety protocols and report critical incidents to the regulator. Violations carry fines of up to $1 million.

The next step requires pre-deployment testing and independent audits. This is where the sharpest questions appear: who does the checking, using what methods, and with what access to the model's weights. The European AI Act took this route for general-purpose models with "systemic risk." There is a single criterion for them: training with a compute budget above 10^25 FLOPs.

A typical set of soft and intermediate tools:

• mandatory reports on safety incidents;
• publication of internal risk-assessment protocols;
• pre-deployment tests for dangerous capabilities (biology, cyberattacks);
• protection for employees who report violations;
• fines tied to turnover (in the AI Act, up to 7% of global turnover for prohibited practices).

The hard end: kill switch and ban

The idea of an emergency off switch sounds simple, but in practice it depends on architecture. Bill SB 1047, which California Governor Newsom vetoed in 2024, required the ability to shut a model down completely. It covered systems that cost $100 million or more to train and exceeded 10^26 FLOPs. If a model runs through an API on the company's servers, cutting off access is indeed possible. If the weights are published, the copies can no longer be recalled, and the "kill switch" becomes a declaration. Critics make exactly this argument, while supporters respond that the right to publish the weights of the most powerful systems should itself be regulated.

The most radical position is a ban on developing "superintelligence" until a scientific consensus on its safety emerges. In October 2025, the Future of Life Institute issued such a call, and the signatories included Geoffrey Hinton and Yoshua Bengio. But this is a petition, not a bill. There is not even an agreed definition of where the line falls between a powerful model and "superintelligence." Without one, any ban is hard to write and even harder to enforce.

How to prepare

Teams building products on LLMs have no reason to wait for the final version of the rules. Even now, it makes sense to keep an incident log: model failures, data leaks, cases of harmful outputs. Teams should document test results and maintain a separable control layer for agents with access to real systems, whether payments, code or infrastructure. For companies that work with models through an API, the main risk lies with the provider: if it falls under a regulatory threshold, access terms, limits and prices will change. Investors and product managers should look not at loud bans but at the boring reporting requirements. Those are what will determine the cost of compliance in the coming years.