Solving this tension requires moving away from static, heavy-handed laws toward dynamic, risk-based oversight. One practical approach involves a tiered regulatory system, similar to how the aviation industry operates. Small startups building niche applications shouldn't face the same scrutiny as firms training frontier models like GPT-4 or Gemini. By focusing enforcement on high-compute thresholds or specific catastrophic risk profiles, regulators can let smaller players experiment freely. This prevents a 'compliance moat' where only the wealthiest corporations can afford to enter the market.
On an international scale, we need something akin to the IAEA for nuclear non-proliferation. A global monitoring body could establish technical benchmarks for model weights and compute usage. Rather than banning specific code, these mechanisms would focus on auditing hardware supply chains—specifically high-end GPUs. If a model shows signs of emergent capabilities that cross safety thresholds, international protocols could trigger mandatory third-party audits.
Liability frameworks also offer a way forward. If companies face strict legal responsibility for foreseeable harms caused by their models, they will naturally bake safety into the development lifecycle. This shifts the burden from government guesswork to corporate accountability. It uses the existing legal machinery of tort law to drive safety without requiring a new, massive bureaucracy to dictate every line of code.
