Federal regulation of artificial intelligence can reduce its harms without unduly hindering innovation

What's this about?

People disagree about whether US rules for AI can cut harm without slowing new ideas.

The result would depend on how leaders write, use, and enforce those rules.

What supporters say

• AI can harm people through false facts, unfair bias, data leaks, and unsafe computer systems.
• Risk-based rules could set tougher limits for AI used in jobs, health care, or key services.
• One set of US rules could make life simpler for firms facing many state laws.

What critics say

• We still lack proof that rules would cut harm while keeping new ideas moving.
• Vague rules could make firms wait before putting helpful AI tools to use.
• Rule costs could push small firms out because they have less money and staff.

How to read this

The number of points on each side does not show who is right; strong proof matters more.

The bottom line

Rules could lower some AI harms, but we are not sure yet that they would avoid slowing good new work.

Both sides have points, but critics have stronger proof that the claimed overall gain remains unproven.

Federal regulation could reduce some of artificial intelligence’s harms without stopping useful innovation—but the available evidence does not yet show that it would achieve both goals. The outcome would depend heavily on how rules are designed, applied and enforced.

The case for

AI harms are no longer hypothetical. NIST identifies recurring problems in generative AI, including made-up information, bias, privacy leaks, cybersecurity weaknesses and intellectual-property disputes. Incident reports also document discrimination, safety failures, privacy violations and misinformation. Tools such as audits, transparency requirements, testing and post-launch monitoring offer plausible ways to detect and limit these problems earlier 2 (see Figure 3).

The strongest argument for regulation is that rules can be tied to the level of risk. A system used for a low-stakes task would not necessarily face the same obligations as one used in health care, employment or critical infrastructure. Analysis of the EU AI Act describes this kind of tiered approach, while NIST’s framework focuses on managing risks involving safety, security, privacy, fairness and reliability. That does not prove the rules would reduce harm, but it suggests regulation need not amount to a blanket restriction on AI 1.

Federal standards could also simplify a fragmented regulatory landscape. Companies now may face different requirements across states or sectors. A review of AI tools used in mental-health settings found variation and gaps among state approaches, while comparisons involving medical-device cybersecurity found that differing frameworks can create substantial compliance complexity. A coherent federal baseline could reduce those costs—but only if it replaces conflicting requirements rather than adding another layer on top of them 3 (see Figure 2).

The case against

The central weakness is that the evidence has not yet measured the claimed trade-off. Existing research mainly identifies AI risks, possible safeguards and likely compliance burdens. It does not provide a causal before-and-after assessment showing that federal regulation reduces actual harm while preserving innovation. Incident databases measure reported events, which can be shaped by reporting and selection biases, while cost studies depend on assumptions about how rules would be implemented 6.

Regulation could also weigh more heavily on smaller companies. Documentation, testing, risk assessments and monitoring can impose fixed costs that large firms are better able to absorb. Organizational research indicates that a company’s resources and compliance experience affect its ability to manage those costs, raising concerns that rules could reduce entry and experimentation even if total investment in AI remains strong 4 (see Figure 1).

Unclear or overlapping requirements may create a different problem: delay. Companies could postpone beneficial products, avoid high-risk applications altogether or divert staff from development to compliance. Analyses of the EU AI Act and medical-device cybersecurity rules link difficult-to-interpret or differing frameworks with added complexity and possible deployment delays. These findings are not direct measurements of a U.S. federal system, but they show how uncertainty can become an innovation cost 5.

The results would therefore depend on implementation. Flexible, standards-based rules that match obligations to potential harm could limit burdens. Broad, prescriptive or poorly coordinated rules could do the opposite, especially for smaller organizations. Even the existence of a safeguard—such as an audit or disclosure requirement—does not establish that every mandated version will be effective, affordable or consistently enforced.

The bottom line

The evidence slightly favors the claim as a plausible possibility, but not as an established result. It strongly supports the narrower conclusions that AI harms are documented, that useful controls exist and that fragmented compliance can impose real costs. But it provides much weaker support for the claim’s full promise: that a federal regime will reduce harm without unduly slowing innovation.

The decisive unanswered question is causal and practical: whether rules can be made proportionate, coherent and effectively enforced across sectors and company sizes. Until studies measure real effects on both harm and innovation, confidence in the proposed balance should remain limited.