Four Ways to Regulate AI, Explained Without the Jargon

When people argue about "regulating AI," they often imagine a single law that either exists or doesn't. In reality, governments around the world are experimenting with several very different approaches, often combining them. Each has a logic, a set of fans and a set of honest weaknesses.

This guide explains the four main approaches in plain language, plus a fifth that sits alongside all of them. It doesn't take sides. The goal is to help you recognize which approach a proposal is using, so you can ask better questions about it.

The four main approaches

1. Risk-tiered rules

The idea: Sort AI uses into categories by how much harm they could cause, then apply stricter rules to the riskier categories. A spam filter gets almost no oversight. A system used in hiring, credit or medical decisions gets a lot. A small set of uses might be banned outright.

Where you've seen it: The European Union's AI Act is the best-known example of this structure. It groups uses into tiers, from minimal to unacceptable risk, with obligations that rise with each tier.

Why people like it: It focuses effort where harm is most likely, and leaves low-stakes uses alone.

The honest weakness: Someone has to draw the lines between tiers, and technology doesn't always respect them. A general-purpose system can drift from low-risk to high-risk use depending on who deploys it and how.

2. Sector-specific rules

The idea: Don't write a general AI law at all. Instead, let existing regulators — for health, finance, transport, employment and so on — update their own rules to cover AI in their area.

Why people like it: These regulators already understand their sectors deeply. A health regulator knows what a dangerous medical error looks like far better than a general AI agency would.

The honest weakness: Gaps and inconsistencies. A system that crosses sectors may face five sets of rules, or none. And some regulators have more resources and technical expertise than others.

3. Liability rules

The idea: Instead of telling companies in advance what to do, make it clear who is legally responsible when an AI system causes harm. If you know you'll pay for damage, you have a strong incentive to prevent it.

Why people like it: It's flexible. Companies can figure out the best way to be safe, rather than following a checklist that may age badly.

The honest weakness: It works after the harm has happened, and proving that an AI system caused a specific harm can be very hard. People with fewer resources may struggle to bring a case at all.

4. Licensing and thresholds

The idea: Require developers of the most capable systems to register, test or obtain approval before releasing them. Often this uses a threshold — for example, the amount of computing power used to train a model — to decide who is covered.

Why people like it: It concentrates oversight on a small number of the most powerful systems, where some believe the biggest risks lie, before they are widely available.

The honest weakness: Thresholds can become outdated as technology gets more efficient. Critics also worry that licensing could favor large incumbents who can afford compliance, and make it harder for smaller developers and open research to compete.

The fifth approach: standards and voluntary codes

Alongside all four, there's a softer layer: technical standards, industry codes of conduct and voluntary commitments. Standards bodies write detailed guidance on testing, documentation and risk management. Companies sign on to shared principles.

Fans say this layer moves faster than legislation and draws on real technical expertise. Skeptics point out that voluntary means optional, and that commitments are only as strong as their enforcement. In practice, standards often become the detailed rulebook that formal laws point to.

At a glance

How to read a proposal

Next time you see a headline about a new AI rule, try asking these five questions:

1. Which approach is it using? Most real proposals combine two or three.
2. Who does it cover? Developers, deployers, users, or all three?
3. What triggers it? A type of use, a sector, a size threshold or a harm?
4. How is it enforced? Fines, lawsuits, audits, licenses, or public pressure?
5. When will it be reviewed? Rules for fast-moving technology need a plan to update.

You don't need to be a lawyer to ask these. And once you can tell the approaches apart, a lot of the noise in the debate starts to sound like what it often is: people who agree on the goal arguing about which tool to use.