June 8, 2026

AI Regulation: Who's Really in Control?

In 2023, the European Union passed the AI Act. It was called a landmark. A first, a signal that governments were finally taking control of artificial intelligence.

That same year, OpenAI released GPT-4, Google released Gemini, Meta released Llama, Anthropic released Claude, and Mistral released its models openly to anyone who wanted them. The number of AI systems deployed globally grew faster than any regulatory framework could possibly track.

This is the fundamental tension at the heart of AI governance. Governments regulate, while companies build. However, the builders are moving at a speed the regulators cannot match. And the gap between those two speeds is where the real power lives.

The Regulator’s Dilemma

To regulate something, you need to understand it. To understand it, you need people who work with it every day. The people who work with AI every day work for the companies building it.

This is not a conspiracy. It is a structural problem. Governments worldwide are struggling to hire and retain people who understand AI at the technical level required to write effective regulation. The salaries governments can offer are a fraction of what technology companies pay. The talent flows toward the companies. The regulators are left to write laws about systems they only partially understand, often based on briefings provided by the companies they are supposed to regulate.

This creates a dynamic that has a name in political science. It is called regulatory capture. The regulated become the experts. The experts shape the regulation. The regulation serves the regulated.

We have seen this before with finance, pharmaceuticals, and energy. In each case, the industries that most needed strong oversight ended up with oversight designed largely by themselves. AI is following the same pattern. Faster.

What Governments Are Actually Able to Do

Let me be fair to the regulators. They are not entirely without tools.

On the one hand, the EU AI Act introduced risk-based categories. High-risk applications like medical devices, credit scoring, and hiring tools face stricter requirements. This is a sensible framework. It recognizes that not all AI is equally dangerous and focuses regulatory energy where harm is most likely.

On the other hand, China has moved decisively on narrow applications: Deep-fake regulation, algorithm transparency requirements. Rules about how recommendation systems can operate. These are specific, enforceable, and meaningful.

However, the United States has taken a different approach entirely. Executive orders, and voluntary commitments from companies. These are guidelines rather than rules. The American regulatory model for AI is, at its core, a negotiation between the government and the industry it is nominally overseeing.

Voluntary commitments are not regulation. They are public relations. A company that commits voluntarily to safety standards can un-commit whenever those standards become inconvenient. There is no enforcement mechanism. There is no penalty. There is only reputation, which turns out to be a remarkably weak constraint when billions of dollars are at stake.

The Companies Are Writing Their Own Rules

Watch what the major AI companies actually do rather than what they say.

They create internal safety boards with no external accountability. They publish usage policies they enforce inconsistently. They fund research into AI safety at organizations they control or heavily influence. They lobby governments for the specific regulatory frameworks that create barriers to entry for competitors while leaving themselves free to operate.

This last point deserves more attention than it receives. Large AI companies are not opposed to regulation in principle. They are opposed to regulation that threatens their competitive position. They are entirely comfortable with regulation that requires compliance infrastructure so expensive that only large incumbents can afford it. This is not altruism dressed up as safety advocacy. This is market strategy dressed up as safety advocacy.

When a CEO calls for AI regulation while their company spends millions lobbying against specific provisions that would constrain their products, the contradiction is not accidental. It is a sophisticated political strategy. Support regulation in the abstract. Oppose it in the specific.

The Geography Problem

Governments have borders. AI does not.

The EU can regulate what AI companies do within European territory. It cannot regulate what a model trained in San Francisco, hosted in Singapore, and accessed by a user in Berlin actually outputs. The reach of any single government ends at its borders. The reach of a globally deployed AI system does not.

This creates what regulators call a race to the bottom. If France imposes strict AI rules and the United States does not, the companies move their operations or simply route around French jurisdiction. The country with the strictest rules ends up with fewer AI companies and no more safety. The country with the loosest rules attracts the companies and the investment.

No single government can solve this alone. Effective AI governance requires international coordination at a level that has never been achieved for any technology before. The track record of international coordination on technology issues is not encouraging.

The Speed Problem

The EU AI Act took roughly four years to pass from proposal to legislation. During those four years, the AI landscape changed so dramatically that large portions of the Act were already outdated before it became law.

This is not a failure of the EU. It is a structural feature of democratic governance. Laws require debate. Debate requires time. Time is exactly what AI development does not give you.

GPT-4 to GPT-5 took less than two years. In that same period, a government trying to regulate GPT-4 would still be in committee hearings. By the time the regulation passed, the system being regulated would be two generations obsolete and its successor would already be reshaping the world in ways the legislation never anticipated.

Regulation that arrives after deployment is not really regulation. It is archaeology.

So Who Actually Holds the Power?

Let me answer this directly.

Right now, in 2026, the companies hold the power. Not because governments are weak or corrupt, though both things are sometimes true. But because the structural conditions of AI development favor the builders over the regulators in almost every dimension that matters.

The companies have the talent. They have the capital. They have the speed. They have the information asymmetry. They know what their systems can do. Regulators know what companies choose to tell them.

The companies also have the single most powerful lever in democratic politics; economic leverage. A government that imposes regulation too strict for AI companies to operate under risks losing the investment, the tax revenue, and the jobs those companies bring. Politicians who understand this, and most do, regulate with one eye on the economic consequences. This is not necessarily corrupt. It is the normal functioning of political economy. But it is also the reason that truly strong AI regulation is extraordinarily difficult to pass in any country that wants to remain competitive in AI.

The Third Player Nobody Mentions

Every conversation about AI regulation frames it as a contest between governments and corporations. This framing is incomplete. There is a third player whose power is rarely discussed.

The researchers.

A small number of people, perhaps a few thousand globally, understand AI at the level required to build frontier systems. These people make decisions every day that shape what AI can and cannot do. They decide what to publish and what to keep private. They decide which safety problems are worth solving and which are theoretical. They decide whether to work at a large corporation, a startup, a university, or an independent research lab.

No government voted for these people. No democratic process selected them. No accountability structure constrains them beyond the norms of their professional community and the terms of their employment contracts.

The decisions made by a few hundred researchers at a handful of institutions in 2024 and 2025 will shape the lives of billions of people for decades. This is the most significant concentration of unaccountable technical power in human history. And it barely registers in the mainstream conversation about AI governance.

What Meaningful Control Would Actually Require

If we are serious about governance rather than the performance of governance, several things need to happen that currently show no sign of happening.

Governments need independent technical capacity. Not consultants from the industry. Not voluntary advisory boards stocked with company employees. Genuine, well-funded, independent bodies with the expertise to audit AI systems without depending on the companies that built them.

International coordination needs to be treated as seriously as nuclear non-proliferation was treated. AI safety is a civilizational-level concern. The institutions governing it should reflect that. Right now they do not.

The public needs to be part of this conversation. Not through abstract consultation processes that produce documents nobody reads. Through genuine participation in decisions about which AI applications are acceptable and which are not. These are not technical questions. They are value questions. Value questions belong to the public.

The Answer Is Honest and Uncomfortable

The honest answer to who is really in control of AI is: nobody, fully. Not governments. Not companies. Not researchers.

Governments have partial authority constrained by borders, speed, and expertise gaps. Companies have enormous power constrained by competition, reputational risk, and the occasional functioning regulator. Researchers have technical capability constrained by funding dependencies and professional norms.

The result is a system that is genuinely ungoverned. One of the most powerful technologies in human history is being deployed at extraordinary speed with no adequate framework for deciding what it should and should not do.

We are not at the beginning of a governance story. We are in the middle of a power vacuum. And history is quite consistent on what fills power vacuums.

The question is not whether we will eventually regulate AI. We will. The question is whether we will do it before or after the systems have already made their most consequential decisions for us.

Originally published on Substack. ← Back to all articles