What AI regulation actually requires

Emerging regulatory frameworks impose obligations that vary with the use rather than with the technology.

Risk categorisation

Applications classified by potential for harm.

Which determines what is required.

Prohibited uses

Certain applications banned outright.

Which includes several surveillance and manipulation categories.

Transparency obligations

Disclosure that content was machine generated.

Existing law

Discrimination, consumer protection and data law already applying.

Which is frequently overlooked in discussion of new rules.

The approach most frameworks have taken

Obligations attached to the use rather than to the technology, scaled by the potential for harm.

Which means the same model can be used with almost no requirements in one application and substantial ones in another.

That is a deliberate design choice intended to avoid regulating research and low-risk uses out of existence while imposing real requirements where consequences are serious.

High-risk categories

Employment, credit, education, law enforcement and essential services.

Which attract documentation, testing and oversight requirements.

General purpose model obligations

Requirements on developers of foundation models.

Which several frameworks include.

Extraterritorial effect

Rules applying to systems used in a jurisdiction regardless of origin.

A general note

Regulation differs substantially by jurisdiction and is developing quickly.

Why the mechanics are worth understanding

These systems are described in language that suggests understanding, reasoning and knowledge, and the underlying operations are considerably more specific than those words imply. That gap is where most confusion, most disappointment and a substantial amount of misplaced trust originates.

Someone who knows that a language model predicts tokens, that it has no separate lookup step, that its context is a hard limit and that its confidence is unrelated to its accuracy will make better decisions about when to use one than someone working from the marketing description.

The pattern across all of this

Nearly every behaviour that people find surprising follows directly from a design choice that is documented and comprehensible. Invented citations follow from the training objective. Difficulty with spelling follows from tokenisation. Degradation in long conversations follows from context limits. Cost structures follow from the fact that inference is not free.

None of these are mysteries or failures of implementation. They are consequences, and they are predictable once the mechanism is understood.

What follows in practice

Use these systems for work where the output can be checked, where fluency is genuinely useful, and where a draft that needs revision is more valuable than a blank page. Avoid relying on them for specific facts, citations or numbers where a confident wrong answer is worse than no answer.

That is a narrower recommendation than the enthusiasm suggests and a much broader one than the dismissal allows. Both positions tend to be argued by people who have not looked closely at what the systems do.

Where the reliable information is

Research papers, model documentation, technical writing from the organisations building these systems, and independent evaluation work. Most of it is freely available and considerably more measured than either the promotional material or the criticism built on top of it.

The field moves quickly enough that any general article, including this one, dates rapidly. Anything with consequences attached is worth checking against current documentation.

On the pace of change

Capabilities have moved quickly enough that specific claims about what models can and cannot do have a short shelf life. Several limitations described confidently a few years ago have been substantially reduced, and several that were expected to fall have not.

The underlying mechanisms have changed far less than the capabilities. Next token prediction, tokenisation, context limits and the absence of a verification step have all remained, which is why the same categories of failure keep recurring in new forms even as performance improves.

A note on evaluating claims

When a capability is announced, the useful questions are: measured on what benchmark, compared against what, evaluated by whom, and reproducible by anyone outside the organisation making the claim. Those four questions dispose of a considerable amount of what circulates.

Independent replication in this field is under-resourced relative to the scale of the claims being made, which is a structural problem rather than a criticism of any particular organisation. It means that a great deal of what is asserted has never been checked by anyone with an incentive to find it wanting.

One last observation

The most useful thing anyone can know about these systems is what they are optimising for, because everything else follows from it. A model trained to produce plausible text will produce plausible text, reliably, and regardless of whether the text is true.

That is not a criticism. It is a specification, and reading it as one makes the whole field considerably easier to think about clearly.