The Direction of AI Regulation (2/3)

Regulatory Perspectives

A second deceptively simple question arises here: what exactly is AI regulation? In a related vein, in the late 1990s, governance of the cyberspace was subject to a debate in the USA—popularised as the "law of the horse" debate. The premise was fairly simple: Judge Easterbrook argued that despite all the harms that horses (an allegory for the cyberspace) posed to humans—there was no separate law for "horses," and that all these harms were addressed through traditional legal frameworks, such as torts. This was countered by Lawrence Lessig, who asserted that distinct harms emerge from the cyberspace since the environment of cyberspace that differs from an analogous feature in real space. In the context of AI, similar questions arise: should separate AI regulations exist? Or should existing laws be adapted to address novel harms brought up by AI?

Regulatory directions have been wide-ranging, with countries taking different decisions as a result of differing economic and political priorities. From the USA's innovation-first approach, to the EU's risk-proportionate approach and China's big-state approach, AI regulation in the technologically developed world has already begun to take a concrete shape, often using incumbent institutional frameworks—a luxury not afforded to developing nations.

The United States of America – Innovation First, America First

President Donald Trump has been extremely vocal about the necessity of removing barriers to AI innovation, and this has been the general direction taken by the United States under his leadership. Broadly, while the USA lacks a single legislation/statute like the European Union, its approach to AI regulation relies on two primary strategies: establishing guidelines and standards through federal agencies and encouraging self-regulation within the industry.

The uniquely federal structure of the USA also enables states to make laws governing AI—which will become far too much for us to analyse. To best understand the American approach, we will examine two Federal frameworks: America's AI Action Plan (2025) ("Action Plan"), and Executive Order 14365 (Ensuring A National Policy Framework For Artificial Intelligence) (2025) ("Order").

The Action Plan, a non-binding document released by the US Government, revolves around 3 pillars: AI Innovation, AI Infrastructure, and International AI Diplomacy. At its core, the Action Plan treats AI regulation as an exercise in enabling experimentation rather than constraining deployment. It emphasises reducing regulatory friction, promoting open-source and open-weight AI development, expanding regulatory sandboxes, and accelerating AI adoption in priority sectors.

The remaining pillars—AI Infrastructure and International AI Diplomacy—extend this logic beyond regulation. The former sees AI as an industrial policy problem, looking to develop compute capacity, energy availability, and semiconductor security. The latter treats AI governance as a geopolitical contest, seeking to export American technical standards while countering rival regulatory and technological influence—which we generally infer to mean China and Russia. This adversarial approach to geopolitics is somewhat of a hallmark of President Trump's politics, and likely represents an isolationist approach to standards setting and quality control for AI.

The Order takes a somewhat aggressive step in this direction, looking to harmonise state laws on AI. The premise of this Order is fairly direct: fragmented laws on AI impact innovation, since they make compliance for interstate functionality of AI entities, especially when such laws are excessively onerous. The Government looks to enforce this by making funding under the Broadband Equity Access and Deployment (BEAD) Program [for internet and broadband development] subject to compliance.

Critics observe that the Order goes beyond "excessively onerous" laws, and looks to prohibit any law that it feels is not a "minimally burdensome policy framework"—an obviously over-broad term. Nonetheless, this Order is an excellent representation of the USA's approach – innovation and US dominance, sometimes even at the cost of protections and safety.

In fact, through Executive Order 14179 (Removing Barriers To American Leadership In Artificial Intelligence), revoked Executive Order 14110 (Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence), which was introduced by the Biden administration and looked to create a rights-first-innovation-next approach to development of AI. The US government asserted that Order 14110 was "foreshadowed an onerous regulatory regime," and revocation was necessary for innovation and US dominance in the "AI war."

European Union – Rights First (?)

The European Union has taken the most ambitious regulatory step globally through the EU AI Act—the world's first comprehensive, binding framework for artificial intelligence. Unlike the United States' enablement-first strategy, the AI Act adopts a precautionary, risk-based approach, structuring compliances and obligation around the potential harm posed by different AI systems, with the explicit objective of safeguarding fundamental rights while permitting controlled innovation. At the time of implementation in 2024, it was seen as an extension of the EU's attempt to set global standards for rights-centric technology, just as it did with the GDPR.

At the heart of the AI Act lies a four-tier risk classification system, ranging from minimal risk to unacceptable risk. Systems deemed to pose "unacceptable" risks—such as social scoring, manipulative or deceptive techniques that impair informed decision-making, and certain forms of biometric categorisation—are prohibited outright. High-risk AI systems, by contrast, are permitted only subject to stringent ex ante obligations.

Crucially, the AI Act places the primary burden of compliance on AI developers, particularly in relation to high-risk systems, while also imposing defined obligations on professional users who deploy such systems. Its jurisdictional reach is deliberately expansive, applying to any AI system placed on or affecting the EU market, regardless of where the developer or deployer is located—a similar approach to that of the GDPR.

Another seminal provision is Article 50, which mandates transparency in AI systems—specifically that AI systems are developed and used in a way that allows appropriate traceability and explainability. This means two things: (1) the broad logic followed by the model (how it came up with a decision) is to be fairly understandable, and; (2) a response/decision should be traceable to an AI system if generated by one. This may include labelling, metadata or any other technically feasible and interoperable measure.

However, the introduction of the proposed EU Digital Omnibus Directive ("Omnibus Directive") and the AI Omnibus Directive ("AI Omnibus") in November 2025 as a way to simplify compliance and reduce bureaucracy raises concerns regarding the sanctity of the EU's rights-first approach (hence the "?" in the subheading.) The Omnibus Directive looks to amend large parts of the European Union's existing digital rulebook—including the GDPR and ePrivacy Directive and key cybersecurity laws.

Amendments under the Omnibus Directive have been greeted with concern and scepticism—specifically the proposed Article 9(2)(k) of the GDPR and Article 88c of the Omnibus Directive. Essentially, while the GDPR generally envisions a citizen-first approach, this modification will likely enable mass collection and processing of personal data for any component of AI development without needing explicit permission of the owner of the data, subject to some conditions. In fact, analyses suggest that the European Commission makes two legally invalid assumptions: (1) that the presence of a commercial interest (in developing AI) implies the presence of a legitimate interest (this has been categorically denied by the CJEU); (2) that a legitimate interest always exists in the case of development and operation of AI systems.

The AI Omnibus specifically amends part of the EU AI Act, but the amendments proposed are limited to enforcement timelines and regulatory relaxations. Three changes are important to note: (1) high-risk obligations deferred until clear standards are set; (2) shift from a binding obligation on AI developers to a soft duty on Member States and the Commission to "encourage" AI literacy; (3) broad legal basis for processing sensitive personal data for bias detection in all AI systems. Fortunately, the AI Omnibus does not abandon the EU's rights-first philosophy—but it softens its operational absolutism.

China – The State Knows Best

The Chinese approach has been characterised by quick regulatory responses to new technologies, with much regulatory power in the hands of the state, including an extensive range of obligations imposed on tech firms-ranging from content moderation to data protection, intellectual property (IP), and ethical issues. Industry experts suggest that the cautious, heavy-handed approach undertaken by China is likely an anathema to open innovation, even going so far as to say that it the Chinese state itself is limiting the extent to which innovation of Generative AI models for fear of losing power. Others observe that authoritarian states see tech regulation as a fine line: while on one hand technological advances can empower civil society by reducing the cost of collective mobilization against authoritarian rule, on the other, such advances can improve the state's surveillance and enable pre-emptive crackdowns on anti-state mobilisation, and also enable innovation and development—improving the regime's legitimacy.

Broadly, it helps to understand China's approach to digital regulation (including AI) as focusing on granular control of information flows, traceability of AI outputs, and iterative administrative regulation rather than a single omnibus AI law. Law is less rights-centric or innovation-centric and more focused on maintaining social order. This direction becomes clear when the Interim Measures for the Management of Generative Artificial Intelligence Services (2023), the Administration of Deep Synthesis of Internet Information Services Regulations (2023), the Regulations on the Administration of Algorithm Recommendations for Internet Information Services (2022), and the Measures for Labeling Artificial Intelligence-Generated Content are read together.

Across all four instruments, China does not regulate AI as an independent technological system. Instead, it regulates:

1. information outputs,

2. distribution channels, and

3. their effects on public opinion and social order.

The Interim Measures, Deep Synthesis Regulations, Algorithm Recommendation Rules, and the Labelling Rules all converge on the same regulatory object: AI-mediated information circulation.

The labelling regime makes this explicit. By mandating both explicit labels (visible/audible) and implicit labels (embedded metadata with provider identity and content ID), China is constructing a traceable information environment, not just a transparency regime in the rights-based sense. The obligation imposed on distribution platforms to detect, classify, and reinforce labels shows that governance responsibility follows content downstream, not just upstream at the model developer level.

Further, as opposed to the EU AI Act's transparency requirements, it is clear that China prefers traceability over explainability. The four instruments mandate:

1. explicit and implicit labels, including embedded metadata identifying the service provider and content ID, and require platforms to detect, classify, and reinforce those labels even where AI generation is only possible or suspected;

2. marking AI-generated content, ensure traceability, retrain models after violations, and submit to security assessments;

3. technical identifiers (such as watermarks), prohibiting their removal, and requiring real-name registration and content review;

4. disclosures when algorithms are being used and an option for users to opt out.

However, unlike the EU, there is minimal focus on making systems transparent or explainable to the user.

Further, China has adopted what we may understand as a "custodial responsibility" model—which requires constant compliance by AI developers (also referred to as "providers"). This is a reflection of the "ex-ante" approach associated with China. This means that:

1. Providers are deemed content producers (Interim Measures).

2. They must prevent harms ex ante, retrain models after violations, and block recurrence.

3. Platforms must maintain harmful content libraries, conduct input and output review, and intervene even without user complaints (Deep Synthesis Regulations).

4. Algorithms shaping public opinion require registration and security assessment before deployment.

An interesting aspect to note here is that unlike other regulators, the Chinese government is entrenched in the AI ecosystem itself. In addition to acting as a regulator, the government acts as a policymaker, an investor, a supplier and an end-user of AI systems. A very interesting analysis of what some scholars refer to as the "Chinese Triple Helix framework" explains the nature of this model—where conceptualisation in universities is replaced with direct government involvement in production-stage technologies.

The three models analyses broadly explain the approach of the technologically developed world. Broadly, these models differ on the basis of the answers of the following questions:

1. What is the objective the state wishes to fulfil through AI governance?

2. What is AI governed as?

3. Who is responsible for majority of compliance?

4. Should compliance be ex ante or ex post?