We are closer to AI regulation than we think

Regulating AI is a major issue in government halls worldwide, but legislators’ distinct lack of technical competence is hampering the effort.  A less technical solution may exist.  It has existed for more than a century; it requires little or no further legislation, and it could result in criminal charges against the CEOs of AI platforms.  

(Note: senior executives at AI companies including Anthropic, Open AI and C3 AI were contacted for comment.  None responded to the requests.)

Let’s begin with automotive use. Virtually every country requires licensing of drivers and registration of vehicles.  Drivers must demonstrate knowledge of vehicle safety, laws, and owner responsibility.  They don’t have to know how to repair or maintain vehicles, they need to show they understand vehicular law.

The requirements placed on vehicle use often drive how auto manufacturers design and build them.  For example, for about the first 50 years of the automobile’s existence, bumpers were merely decorative. Making them crash resistant took legislation, but the legislation came decades later.

Universal acceptance?

The most surprising part of this fix is it has universal acceptance.  Respondents to an open query on Qwoted brought dozens of responses from almost every sector, not just technology, all affirmative.  The only debate is how to apply it.

“Start with tiered licensing based on what the AI can do, not who owns it,” said Liam Lafferty, founder of Zentive Home Service Software. “A license should be required when an AI system can spend money, contact customers, change records or publish without human approval. The business deploying it should register the workflow, name an accountable owner, and keep an audit trail. Existing sector regulators identify risks, while NIST sets the baseline. This targets high-impact use without treating every prompt like driving a commercial truck.”

Kelly Policarpo, CEO at Lumo AI Compliance & Advisory, expanded on that idea. “The car analogy works best if we copy the tiers, not just the license. Nobody needs a permit to ride in a car, but you need a commercial license to drive a bus. Same logic for AI: free everyday use, but a registered, trained operator when AI makes decisions about hiring, credit, health or legal outcomes. The EU AI Act’s AI literacy duty already points this way. I’d skip a new bureaucracy: give existing sector regulators (health, finance, labour) the licensing role, with one small coordinating body issuing shared standards.”

“This wouldn’t be necessary when using an AI program for simple tasks, like ChatGPT to write an email,” said Dan Herbatschek, CEO at Ramsey Theory Group.  “Anyone working in a regulated industry, a license of some sort would be needed. Employees and companies could possibly be required to register, demonstrate they understand the risks, and properly assign accountability throughout the entire AI lifecycle.”

Not cars, booze

Some respondents agreed with user licenses but suggested alternative paradigms. 
“A better model is the licensing of alcohol production rather than cars,” said Tom Whipp of RiskQuilt.  “The materials needed to make alcohol are very basic and the outcomes of poor production have material public health impacts.”   

Whipp pointed out that licensing and regulation do not stop illegal alcohol production.  “It does is attach criminal penalties and reduce the likelihood that it enters mainstream distribution.  Enforcement of home usage is generally pretty light unless someone starts to distribution.

“The parallel to AI is that we treat the output data or actions as if they were a food product.  This means licensing of manufacturers and distributors, certification of hygiene, with liability for “tainted” outputs. That includes data errors that someone relies on, or rogue agents that exceed approved actions.”

Solons not off the hook

Ben Colman CEO of Reality Defender, was among a few respondents unwilling to let legislators off the hook.  “We don’t ask consumers to become experts in spotting computer viruses; we build protections in. Congress needs to act,” he stated.

Joseph Steinberg, AI lecturer at Columbia University and expert witness, stood with Colman on keeping AI platforms honest. Steinberg pointed out that when an AI autonomously infiltrates a third party, as happened to Huggingface, the narrative is that the AI escaped confinement.  

“If you try to contain a lion with a fence made for a poodle, then yeah, it’s going to escape from containment.  But that’s not the lion’s fault. That’s you who were negligent. When I hear senior-level AI company people say, well, it escaped, either you’re being dishonest, or you’re simply not an expert. If you’re testing an AI, air-gap it; put it on a network not connected to the internet.

“We’ve been doing air gapping for decades. It’s how the military protects classified information. This isn’t something new. And we need to hold companies that act recklessly liable.  Nobody has a constitutional right to create a product that’s dangerous. Nobody has a constitutional right to make money off of AI.  So if you’re going to create something dangerous or potentially dangerous, you need to do it in a lab setting that’s safe.” Steinberg advocates for criminal liability in these cases.

Closer than we think

Several respondents supported the responsibility argument and believed we aren’t that far from implementing these controls.

Wes Kussmaul, CEO at The Authenticity Institute, pointed out the idea already is moving forward. “The City of Osmio, a Swiss digital governance entity chartered at the ITU’s Geneva headquarters in 2005, has been building this framework for two decades. The infrastructure exists. The question is whether regulators have the will to use it.” 


Avi Pilcer, founder of Ultra Deep Tech, thinks moving to a licensing model is simpler than we might think.  “The FTC already polices unfair practice, NIST already writes the tests, state DMVs already run licensing at scale.”  Pilcer thinks a single national registry is all that is needed.

Vadim Chakryan, CISO at DataArt, defined the professional tier. “Professionals such as doctors, lawyers, and engineers should receive AI-related training as part of their licensing. Developers of frontier models should undergo licensing and pre-release testing, while high-risk deployments should carry liability insurance. Existing regulators can oversee compliance with support from a small technical body.”

No new bureacracy needed

Michael McCready, Managing Partner at McCready Law, isn’t sure a new federal agency is the best solution.  “We should also consider whether AI has become important enough to warrants a dedicated federal agency. The principle is straightforward: know who is operating powerful AI, require competence, and make responsibility traceable when something goes wrong.”

Christopher Dion Johnson, CEO of Indie Me, made it even more personal.  “It’s up to us as individuals in order to come up with solutions.  Technology is moving significantly faster than what legislation can do to actually keep up. Creating an automobile was not only time extensive, but also the cost of it was quite high.  AI is very different. AI, literally almost anyone can get access to it.  A person has to think how they engage with these technologies, the ramifications of what they are doing, and how that can impact the world around them.”

Austin Worrell, an attorney and founder/CEO of DialogicaAI, agreed but bifurcates the issue between personal and commercial use. “I think that actually the answer is right in front of our face. What we are going to do is say you need to use this tool in a way that conforms with centuries old precedents. That includes state rules of ethics and responsibility that every single state has.”

Doctrine of reasonable care

Personal responsibility came up often in the discussions. The previous suggestions kept bringing up existing legal remedies to irresponsible use of AI.  Following the example of auto regulation we discovered the legal doctrine of “Reasonable Care.”  This concept applies to multiple laws and regulations around the world but it is most commonly applied to automotive use.

The California Civil Code describes it this way: “Everyone is responsible, not only for the result of his or her willful acts, but also for an injury occasioned to another by his or her want of ordinary care or skill in the management of his or her property or person, except so far as the latter has willfully or by want of ordinary care, brought the injury upon himself or herself.”

That applies to civil lawsuits but the concept is also applied to the state’s penal code:  “Gross negligence, meaning conduct so far below what a prudent person would do that it shows disregard for human life (People v. Bennett, 1991), is a felony or misdemeanor depending on the facts.”

This doctrine is applied to civil suits against tech companies, most recently K.G.M. v. Meta & YouTube in the Los Angeles Superior Court.  However, this is a recent development and none of the verdicts have been tested in appeal and there have been no cases involving AI misuse or technical failure.  

Redefining Section 230

Those companies facing legal action may fall back on First Amendment or FCC Code Section 230 defenses. That will take us back to legislatures to reclassify the companies and limit the use of those defenses, but that requires far less technical acumen and has a better chance of passing quickly.  

More importantly, this doctrine applies also in criminal cases and, while criminality has yet to be applied to the foreseeable failures of technology, it seems to be only a matter of time.