--- title: "A Policy Researcher on Writing Rules for a Technology That Won't Sit Still" dek: "Uses versus models, rules that expire, sandboxes that aren't loopholes: Theo Brooks talks with a nonpartisan researcher who tries to get both sides of the AI debate in one room." author: "Theo Brooks" author_title: "Staff Writer, Startups" category: "Policy & Ethics" series: "Bro Talks" format: interview tags: ["Research", "Safety", "Regulation"] published: 2026-10-31T04:13:07.284Z updated: 2026-10-31T04:13:07.284Z reading_minutes: 6 url: "http://localhost:3000/article/bro-talks-ilse-marchetti-owusu-rules-for-ai" ai_disclosure: human ai_disclosure_label: "Human-written" members_only: false summary: - "AI policy debates polarize because people use one word, regulation, for very different problems." - "The researcher favors regulating high-stakes uses through notice, explanation, appeal and records, while acknowledging the case for frontier oversight." - "Sunset clauses and well-designed sandboxes force evidence-based revisits instead of drift." - "She sees incident reporting as an under-discussed idea and urges readers to engage locally." publisher: "Ideabro" --- # A Policy Researcher on Writing Rules for a Technology That Won't Sit Still *Uses versus models, rules that expire, sandboxes that aren't loopholes: Theo Brooks talks with a nonpartisan researcher who tries to get both sides of the AI debate in one room.* Most conversations about AI regulation turn into a shouting match within about four minutes. One side says the rules will strangle innovation. The other says the lack of rules will hurt people. Neither is listening. Dr. Ilse Marchetti-Owusu has spent her career trying to get them to talk to each other instead. A senior fellow at the Larkspur Center for Technology and Public Life, a nonpartisan research institute, she has advised city councils, school boards and legislative staff on how to write rules for technologies that change faster than rules can be written. Her current project is a field guide for local governments buying AI systems, which she describes as "deeply unglamorous and therefore probably useful." We talked about why she thinks most AI policy debates ask the wrong question, the case for rules that expire, and what an ordinary reader can actually do. The conversation has been edited for length and clarity. ## The wrong question **Let's start with the shouting match. Why does AI policy get so polarized so fast?** Because people are arguing about different things using the same word. When someone says "AI regulation," one person hears "rules for the companies building the largest models." Another hears "rules for a landlord using software to screen tenants." Another hears "a ban on deepfakes in elections." Those are completely different problems with completely different tradeoffs. So the first thing I do in any room is ask: which AI? Used by whom? To do what? The heat usually drops by half once people realize they mostly agree about the specific case and were only fighting about the abstraction. ## Uses, not models **You've argued that we should regulate uses, not technology. What does that mean in practice?** It means starting from the decision being made, not the tool making it. If a system decides who gets a loan, who gets a job interview or who gets flagged for a benefits review, those are high-stakes decisions about people's lives. They deserve scrutiny whether the tool is a cutting-edge model or a spreadsheet with a formula nobody remembers writing. Meanwhile, the same underlying model might also be used to suggest recipes. Nobody needs a compliance audit for a recipe suggestion. If you regulate the model, you either over-regulate the recipe or under-regulate the loan. **But some people argue the most powerful models themselves need oversight, regardless of use. Are they wrong?** I don't think they're wrong to worry. That's an important part of the debate, and I try to be fair to it. The argument goes: some capabilities are risky no matter who uses them or why, and once a powerful system is widely available, you can't easily control its uses after the fact. That's a serious point. Where I land is that both layers matter, but they need different tools. For the frontier — the most capable systems — you're mostly talking about testing, transparency and incident reporting at a handful of organizations. For uses, you're talking about thousands of deployments in hiring, housing, health and so on. Most real-world harm today happens in that second layer, and it gets far less attention. > The most dangerous AI in your town is probably not the smartest one. It's the boring one making decisions about people that nobody has checked. **What does a good rule for a "boring" deployment look like?** Four things, and none of them are exotic. First, **notice**. If a system meaningfully influenced a decision about you, you should know that. Second, **explanation**: a reason you can understand, not a technical dump. Third, **appeal**: a way to reach a human who has the authority to change the outcome. Fourth, **records**: the organization keeps enough documentation that an auditor or a court can reconstruct what happened. For decisions like credit, much of this already exists in many places. The job is applying familiar principles consistently, not inventing new ones. ## Sunsets and sandboxes **You're a proponent of what you call "sunset clauses." Explain.** Technology rules age badly. A rule that makes sense for the systems of today might be irrelevant or harmful in three years. So I like rules that expire automatically unless they're actively renewed — say, after three or four years. It cuts both ways, which is why I like it. People worried about over-regulation get a guarantee that rules will be revisited. People worried about under-regulation get a forcing function: the legislature has to look at what happened and decide again, with evidence, instead of letting a rule drift. **Isn't that just guaranteeing more lobbying every few years?** Maybe! But the lobbying happens anyway. At least a renewal debate happens in public, on a schedule, with data. I'd rather have a scheduled argument with evidence than an unscheduled one without it. **What about regulatory sandboxes? Fans love them; critics call them loopholes.** Both are right, depending on the design. A sandbox is a controlled space where a company can test a new product with a regulator watching, under relaxed rules, for a limited time. Done well, it's how regulators learn instead of guessing. Done badly, it's a permission slip with a nicer name. The difference comes down to three things: Is it time-limited? Is there real reporting back to the public? And do the people affected know they're part of a test? If the answer to any of those is no, I get nervous. ## Common ground **Where do you think each side of the debate is right?** The innovation side is right that badly written rules can lock in today's biggest players. Compliance is expensive, and a small startup can't afford a legal team the size of a large company's. Rules should scale with risk and size, or you end up protecting incumbents. The safety side is right that "we'll fix it later" has a bad track record with technology. Once systems are embedded in schools, hospitals and courts, they're very hard to unwind. Some guardrails have to come early, even with imperfect information. Both are right that vague rules are the worst outcome. Vague rules mean uncertainty for builders and weak protection for the public. Everyone loses. **What's one idea you wish more people were discussing?** Incident reporting. In aviation, when something goes wrong — even a near-miss — there's a strong culture of reporting it, so the whole industry learns. AI has nothing comparable at scale yet. If a hiring tool systematically screens out a group of applicants, or a chatbot gives dangerous advice, there's often no shared place for that knowledge to go. A well-designed reporting system, with protection for people who report honestly, would help regulators, companies and researchers all at once. Nobody will put it on a protest sign, but it's the kind of thing that actually makes systems safer over time. ## What readers can do **What can an ordinary reader do? Most people aren't writing legislation.** More than they think. A few things: - **Ask the question.** When a school, employer, landlord or city uses an automated system to make decisions about you, ask: what does it do, who checked it, and how do I appeal? Organizations notice when people ask. - **Show up locally.** City councils and school boards are buying AI tools right now, often with very little public discussion. Procurement meetings are public, and almost nobody attends. - **Comment on proposed rules.** Many governments invite public comment on draft regulations. A specific, personal comment from someone affected is often read more carefully than you'd expect. - **Stay specific.** "I'm worried about AI" is easy to ignore. "I was rejected by an automated system and couldn't find out why" is not. **Last question. Are you optimistic?** Cautiously. Not because I think we'll get everything right — we won't — but because the conversation has moved from "should we have any rules?" to "which rules, for what, and how do we check they're working?" That's a much better argument to be having. It's slower and less exciting. That's usually a sign of progress. *Editor's note: Dr. Ilse Marchetti-Owusu and the Larkspur Center are fictional, created for Ideabro's launch issue. The ideas discussed reflect common positions in public policy debate and are presented to illustrate them.* --- Source: [A Policy Researcher on Writing Rules for a Technology That Won't Sit Still](http://localhost:3000/article/bro-talks-ilse-marchetti-owusu-rules-for-ai) — Ideabro. Human-written: Reported and written by a person. AI not used for the text.