Derek Kan served as the deputy director of the White House Office of Management and Budget in 2020 and undersecretary of transportation from 2017-2019.
Three approaches to regulating the artificial intelligence industry have been gaining traction in recent weeks: Sam Altman’s call for an international regulatory body, styled after the International Atomic Energy Agency; a bipartisan House proposal that would subject AI developers to audits by government-licensed verification organizations, similar to the Federal Aviation Administration’s aircraft certification model; and Google’s proposal to set up an industry-funded self-regulatory body under federal oversight.
Before even considering which regulatory agencies and policies to implement for AI, however, Congress should first define the limits of government power. The lesson of past technological innovation is not that the government should have no role; it is that its role should be circumscribed at the outset so that the technology is not stifled.
The original Bill of Rights already works this way. The government may punish libel or fraud after the fact, but it may not license the press or require approval before publication. It polices abuses; it does not stand at the printing press. An AI bill of rights would draw the same line for software: punish the harm, but do not sit at the keyboard.
I spent years in government and worked alongside countless capable public servants. But no government agency can recruit enough talent and acquire enough knowledge to stay ahead of frontier technology. Civil servants are not demigods, nor are agencies oracles. This is especially true for AI, where the frontier shifts every few months, and even the engineers building it cannot predict how quickly the landscape will change.
Agencies not only fail to keep pace, but also succumb to a familiar Washington pattern: the regulatory ratchet, in which authority delegated to an agency almost always grows far beyond its original scope. Take the federal income tax, which arrived in 1913 as a mere few pages; today the Internal Revenue Code contains millions of words. It took Congress 75 years to respond with the Taxpayer Bill of Rights restraining the reach of the IRS.
Once a dial is created in Washington, it is only ever dialed up, so better to implement limits beforehand. That is why the limits must come first. Try to impose them after an agency exists, and the ratchet works against you: The power keeps expanding while the constraints never catch up. A bill of rights binds a regulator only if it precedes regulation itself.
To prevent overreach by a future, bloated regulatory regime, the first major AI law should be a bill of rights that bars federal agencies from doing four things: licensing AI models or requiring approval before their release; dictating how models are designed or trained; forcing models to promote or suppress particular viewpoints; and conditioning market access on the blessing of a government-sanctioned industry body.
Government should police misconduct, not supervise engineering. Fraud remains fraud. Theft remains theft. Existing laws against cyberattacks, espionage, defective products, antitrust violations and export abuses all remain fully enforceable. The dangers AI may pose are real, and dismissing them would be reckless. If AI could let a single person build a biological weapon or take down the power grid — feats that once required the resources of a state — that is a gap Congress should close with a narrow law aimed precisely at that risk.
Laws that restrain regulation are not exotic. In 1997, the Clinton administration declared what the government would not do to the young internet: no licensing, no preapproval of content or commerce, just the enforcement of existing law. Congress locked in these restraints by statute, and it is a large reason American firms came to dominate the commercial internet. In 2004, Congress barred the FAA from writing passenger-safety rules for commercial spaceflight, which allowed the industry to mature. Restraining regulators has proved successful with emerging technology.
Which brings us back to the three proposals: each flawed in a different way, each the wrong tool.
Altman proposes an IAEA-like body. The IAEA is an inspection agency that keeps a physical inventory of the world’s nuclear material and inspects the small number of facilities that hold it. While uranium is scarce, physical and countable, AI is a globally distributed, increasingly open-source, constantly modified and easily copied software that moves at the speed of the internet. You cannot apply a uranium-accounting regime to code that can traverse the planet in a fraction of a second.
The House bill’s licensed-auditor scheme, based on the FAA model, fares no better. The FAA must approve every aircraft design before it flies. Even in an industry as mature and stable as aviation, certifying a new aircraft commonly takes five to nine years. Those timelines would be disastrous for a technology advancing on monthly rather than decadal cycles. And the FAA delegates much of that review to manufacturers’ own engineers, because only they hold the required expertise. An AI certifying body would be more dependent on the companies it polices. It would be too slow for the technology and too reliant on the industry.
Google’s proposal is a self-regulatory organization, like the Financial Industry Regulatory Authority, which oversees U.S. stockbrokers. These organizations often end up stifling competition. When an industry writes its own rule book under government authority, following those rules becomes a weapon that the biggest players wield against new entrants. They shape the standards to fit what they already do, turn themselves into the gatekeepers who decide who may enter and force newcomers to seek the approval of the very incumbents they hope to unseat. Financial regulation is the cautionary case: Once Washington anointed a handful of credit-rating agencies as official gatekeepers in federal rules, the industry consolidated and stayed that way. Name the last start-up to break into credit ratings.
The mistake shared by all three is one of sequencing: They would build the regulator before deciding what it may not do. Set the limits first. Then decide what to build within them.
The post Before regulating AI, define strict limits for the government appeared first on Washington Post.
