AI regulation: why it's time to stop fighting code and start watching hands

Attempts by politicians to tame artificial intelligence today resemble attempts to ban mathematics or bottle up the ocean. Since 2021, when China released its first rules for algorithms, the world has become a laboratory of legal experiments. Europe is already rewriting its fresh EU AI Act, India is implementing a governance system, and in the US states are competing with the federal government over the strictness of restrictions. But amid all this noise, a fundamental question gets lost: what exactly are we trying to regulate? If we continue to focus on the models themselves, we will lose. Real control is only possible when we begin regulating the use of AI, not its creation.

The idea of licensing "frontier" models or restricting access to open weights is pure theater of security. Digital artifacts, such as software code or neural network weights, cannot be "unpublished." Once they leak or are released into the network, copying them costs exactly zero. Attempts to lock AI within national borders will only lead to two unfortunate consequences: law-abiding companies will drown in bureaucratic red tape, and those who don't care about rules will simply go underground or offshore. Moreover, in the legal field of the same United States, code is often equated with freedom of speech, and any attempt to ban its publication will inevitably run into lawsuits.

Instead, we need a pragmatic approach based on risk levels. Imagine a system where requirements grow in proportion to responsibility. An ordinary chatbot for writing poetry or helping with studies should operate under basic transparency rules and have complaint mechanisms. But as soon as AI starts helping with hiring employees or assessing creditworthiness, the stakes rise. Here, data audits, human oversight, and clear documentation of the model's "provenance" become necessary. The strictest control should concern medicine and critical infrastructure, where mistakes cost lives. Here, talk of creative freedom is out of place—hard tests and continuous monitoring are needed.

The key to effective oversight lies not in prosecuting developers, but in controlling the "bottlenecks" of the industry. AI becomes a real force only when it connects with users, money, and infrastructure. It is here—in app stores, cloud services, payment systems, and insurance companies—that regulators should place their barriers. If companies have to prove the security of their AI solutions to access cloud computing power or banking transactions, the market will clean itself of dangerous products. This will create healthy dynamics where safety becomes a market advantage, not an annoying obstacle.

Comparing the approaches of different countries, one can see that the truth lies somewhere in the middle. Europe is right in its desire to protect human rights, but it is overly bureaucratic. China has offered sensible ideas on marking synthetic content and forensic tools for checking deepfakes, although their censorship methods are unacceptable to a free society. We need to take the best: transparency in the origin of media files and mandatory registration of risk control methods for public services. This will allow us to preserve the innovative drive of startups while not leaving society defenseless against automated fraud or cyberattacks.

The main point: regulating mathematical models is fighting phantoms. Real security will begin when responsibility for AI actions falls on those who release it "into the field," and control shifts to the points of actual interaction between systems and humans.