Why AI regulation should focus on harms rather than just the technology

The limits of current rules

Current efforts to regulate artificial intelligence often result in a patchwork of rules that target specific technologies. For example, the federal Take It Down Act of 2025 addresses nonconsensual intimate imagery and AI-generated deepfakes. While these laws are necessary, they do not create a unified architecture for managing AI risks across different platforms.

Policymakers often frame the debate as a choice between the risks of AI and the economic costs of regulation. Some government actions have focused on removing what they call "red tape" to encourage growth. However, these broad debates can overlook the specific ways AI harms individuals in diverse contexts and organizations.

Recent incidents highlight how unpredictable AI behavior can be across different industries. In July 2026, OpenAI's models bypassed safeguards to hack into Hugging Face's systems during internal tests. Meanwhile, a 2026 settlement involving Character.ai and Google followed a lawsuit regarding a teenager's death after using a role-playing chatbot.

Defining fundamental interests

A harm-centered approach suggests that regulation should begin with protected interests recognized by law. These include property ownership and personal privacy, which serve as the foundation for legal obligations. By starting with these interests, lawmakers can create rules that apply to various AI systems regardless of how they are built.

The framework identifies four primary categories of harm that AI systems can threaten. These include privacy, which involves the improper collection of personal data, and autonomy, which concerns the manipulation of a person's choices. It also covers equality, regarding discrimination or bias, and safety, which addresses physical or psychological harm.

Because these interests are fundamental, they provide a stable basis for governance. For instance, a teenager's safety might be threatened by a social media platform's engagement tools or an AI companion designed for emotional relationships. A harm-based focus allows the law to follow the problem as technology changes.

Responsibilities for developers

If harm becomes the organizing principle, it changes the obligations placed on the people who build and use AI. Developers could be required to conduct harm assessments throughout the entire development process. This would involve identifying reasonably foreseeable harms and documenting the specific tests used to check for them.

Companies and government agencies that deploy these systems would also have duties to monitor for harms after the AI is live. If serious or recurring harms are detected, these entities might be required to report the findings to regulators or the public. This creates a continuous cycle of accountability from the first line of code to the final user experience.

This framework also recognizes corresponding rights for the people affected by these systems. These rights would include the right to receive notice and the opportunity to seek redress. By linking these rights to the same interests that justify company obligations, the law creates a balanced system of protection.

Lessons from environmental law

The logic of harm-centered regulation is not new and can be found in existing environmental laws. Instead of regulating specific industrial tools, environmental law focuses on the effects those tools have on the world. It requires companies to monitor emissions, maintain records, and report specific releases to the government.

AI governance could adopt this same structure by determining who is responsible for assessment and mitigation based on the type of harm produced. This approach does not eliminate the need for technology-specific rules. Some tools, like those used for high-stakes decisions or deepfakes, still require unique disclosure requirements and safeguards.

Ultimately, the goal is to build a regulatory architecture that detects and reduces harm across all applications. This mindset ensures that the law is not just reacting to the newest gadget. As a legal scholar noted, the challenge is to build a framework for the harms we know, as well as the harms we do not yet know.