Doc McConnell, Head of Policy and Compliance at Finite State, comments, “Let's not overcomplicate the question of AI regulation. In every other sector of the economy, we hold manufacturers accountable for the safety of what they build: toys, houses, cars. There's no reason AI should be the exception. Today, what clouds the debate over accountability is that there are multiple actors: the frontier labs that train the models, the companies that deploy them, and the users who prompt them and act on the outputs. That gives everyone a reasonable-sounding excuse. The lab claims that a deployer failed to sandbox the agent, the deployer blames a reckless user, and the user says the underlying model was flawed.

“To ensure that these models are fundamentally safe, there must be meaningful liability for the frontier labs. This liability should apply to the doomsday scenarios we're hearing about today, like biological agents or cyber attacks against real-world infrastructure. But it should also apply to the harms that we've already seen play out: the creation of child sexual abuse material, or the contributions of chatbots to self-harm and suicide. And the liability must be strong enough to counterbalance the enormous commercial incentive for labs to build faster, more responsive, more autonomous models.

“And there can be no compromise to our existing anti-discrimination protections in fields like healthcare and housing. AI is a tool, used by people. Those people must remain accountable for the fair and equitable outcomes of their work, no matter what tools they choose to use.”

Denis Calderone, CTO at Suzu Labs, adds, “Workable regulation is whatever survives an administration that doesn't want to regulate, and that narrows it fast to two things, mandatory incident disclosure and clear liability for real-world harm.

“Self-reporting fails for the same reason the SEC has mandatory disclosure and OSHA runs inspections instead of waiting for companies to mail in hazard reports, because the organization with the most to lose is the worst one to decide what the public hears.

“Put people with real security experience in the room. The people who've actually built, broken, and hardened production systems, who've worked a breach and had to explain to a customer what happened to their data, should be designing these tests and reviewing the findings.”