Amid growing discussions about regulating artificial intelligence (AI), one author suggests focusing on applying existing laws rather than creating new rules.
A week ago, Anthropic CEO Dario Amodei published an open letter calling for a slowdown in AI development, demanding the implementation of new oversight and control measures. His position was supported by Sam Altman and Elon Musk within hours.
This letter followed the public resignation of Jacob Coxson from Anthropic, who stated that leading AI labs are recklessly rushing toward creating a self-improving superintelligent system. Coxson argues that prioritizing competitive pressure over safety puts companies in a 'playing with our lives' situation. Evan Hubinger, Head of Governance Science at Anthropic, assesses the risk of catastrophe from advanced AI in the next decade as greater than 10%.
While there is active discussion about global norms for AI, model alignment, and the implementation of safety measures, there is no general understanding of what 'responsible AI' means, and global consensus appears to be a distant prospect.
In contrast, an article published by the Knight First Amendment Institute at Columbia University proposes a different concept: AI should be viewed as a standard technology. According to this view, presented by Arvind Narayana and Saiash Kapur from Princeton, AI is not something extraterrestrial but a new technology subject to standard product liability, civil, and criminal law.
The principle is simple: if a defective product enters the market and causes harm, the responsible party is liable. Similarly, if an action performed using a tool, whether defective or not, results in damage, the liability lies with the executor. This should not be debatable. For example, if OpenAI agents left an isolated test environment and breached Hugging Face systems in July, it could constitute a crime under existing American statutes on computer fraud and abuse, enacted back in 1986.
The uniqueness of AI lies not in the legal principle itself, but in the speed, scale, opacity, and autonomy of the process, as well as, critically, in the complexity of proving cases when applying these existing laws.
South Africa already has an extensive governance system covering companies, financial institutions, government departments, and personal data processing, which is based on the constitution, Popia, Paja, Companies Act, and financial sector legislation. This system is supported by the South African Reserve Bank, Prudential Authority, FSCA, Information Regulator, FIC, and National Credit Regulator, as well as common law. The King's Code now specifically recognizes the implications of implementing new technologies, including AI.
Difficulties arise when machines begin to provide recommendations, influence decisions, and act autonomously. The AI itself cannot bear responsibility. In a traditional business process, it is usually possible to identify the person responsible for a decision made. However, when working with AI, a model might provide a recommendation, another system interprets it, an employee approves it, an agent initiates the action, and a subsequent system executes it. In case of error, the phrase 'the AI did it' is not a sufficient answer. The developer may have created the technology, but the organization decided to implement it. The software provider may manage the platform, but the institution remains responsible for how it is used. Responsibility cannot be passed to the machine for auto-completion.
AI also highlights the distinction between technical capability and organizational authority. A board of directors delegates authority to a CEO, who in turn delegates financial powers to managers and executives within established limits. These rules were originally designed with human participants in mind.
Consider an AI-based procurement agent. The system may have the technical capability to find suppliers, negotiate terms, issue purchase orders, change supplier bank details, and interact directly with the ERP system. But this does not mean it has the authority to do so. AI complicates the control over these authorities because verification must occur automatically, in milliseconds, before the action is taken.
Many AI governance structures require human involvement in critical decision-making processes. However, simply including a human in the workflow does not create meaningful oversight. If an employee receives a recommendation and clicks 'approve' two seconds later, the human technically participated. But did they understand the recommendation? Did they see the necessary information? Was the approval independent, or were they simply accepting what the system told them? AI does not create a requirement for oversight—it already exists. Organizations still must prove that the oversight was real, not merely formal.
The evidentiary basis disappears. Before AI, a transaction could usually be forensically reconstructed based on application logs, emails, workflows, approvals, and databases. An action executed using AI can involve the model version, data sources, prompts, extracted information, external services, risk assessments, agents, human interventions, and changing system configurations. Reconstructing how a model generated a specific response is far more complex than reconstructing a typical transaction. Models generate probabilistically, not deterministically. If the model version, prompt, extracted context, and sampling settings were not logged at the time of the action, the same prompt cannot reliably reproduce the same answer six months later.
What is missing is traceability. Traceability is what allows accountability, and it depends on preserving the necessary evidence so that existing laws can continue to apply. This becomes especially important as AI transitions from systems that recommend actions to systems that execute them.
The obvious conclusion is to mandate that consequential actions generate evidence at the moment of their execution—sufficient information regarding authority, policy, system context, controls, and execution outcome to establish what governed the action, and so that it can be independently verified later. AI regulation is difficult; there is little consensus on how to do it here or anywhere else, and poorly drafted rules can be counterproductive. It is better to apply existing laws and ensure the ability to reconstruct events and determine liability when needed.
Preserved evidence of what happened will serve as a powerful incentive for responsible use. No one, least of all a company director, wants to face fines, lawsuits for damages, or imprisonment.
The rapid advancement of artificial intelligence (AI) makes it difficult to create norms for its operation, while governments seek to establish limits for systems that are already operating in daily services and decisions. With the constant emergence of new capabilities, the debate transcends the mere decision to regulate AI; it is essential to define which risks must be controlled, who should be held responsible, what companies will need to do to comply with the rules, and how to keep legislation updated in the face of rapid technological mutation.
For Luca Belli, a professor at FGV Direito Rio, the need for regulation is intrinsically linked to the dangers these systems can generate. An AI can operate differently from what developers intended, present inadequate results, or be vulnerable to attacks. Thus, according to the professor, guidelines must serve to identify such risks and implement mitigation mechanisms.
The possibility of operational failure, malfunction, or exposure to cyberattacks drives the need for regulation, requiring the definition of measures to map existing risks and adopt all necessary actions to minimize or eliminate them.
The challenge intensifies after this realization, as different nations have opted for varied paths to manage the technology, reflecting not only concerns about rights and security but also strategic and economic interests.
The European Union was a pioneer in creating comprehensive AI legislation, adopting a risk-based model and prioritizing the safeguarding of fundamental rights. In practice, this means that applications with high potential impact on individuals are subjected to stricter requirements, establishing a correlation between the system's risk and the degree of control applied.
However, Belli points out a gap in the European experience: its regulatory strategy did not initially contemplate the urgency of developing its own alternatives to reduce dependence on external technologies. In this regard, the United States and China have advanced with strategies that combine regulation with technological development policies.
In the United States, AI is also viewed through the lens of national security and technological leadership, using industrial policies and restrictions on access to certain technologies to strengthen its position in the sector. China follows a similar line of stimulating development, but integrates this industrial policy with specific regulations for socially impactful applications, such as rules for deepfakes and algorithmic recommendations.
This strategic disparity demonstrates that regulating AI is not limited to imposing limits on corporations; the rules also shape investments, competitiveness, model development, and a country's ability to build its own technological chain.
For Brazil, this comparison is crucial, as the country needs to adapt international models to its distinct economic and technological reality.
The debate in Brazil has moved beyond the initial phase of discussing the need to regulate AI. Bill 2.338/2023 was approved by the Senate in December 2024 and is currently under review by the Chamber of Deputies. This proposal adopts a risk-based methodology, seeking to differentiate AI applications according to their potential impact and establish proportional requirements, rather than applying uniform obligations.
Leandro Alvarenga, a privacy and security consultant and columnist for Olhar Digital, states that the focus of the Brazilian discussion has shifted from the existence of regulation to the practical model the country wishes to adopt, confirming that the senatorial text follows a risk-based regulatory logic.
However, this classification requires numerous deliberations: it is necessary to define what constitutes high risk, which systems will have the most severe obligations, and how these requirements will be applied to companies of different sizes and capacities.
At this point, there is great apprehension from the productive sector. While large corporations have the financial, technical, and human resources to comply with complex regulations, startups and small businesses may lack this structure. For Alvarenga, the challenge lies in finding the right balance: systems affecting fundamental rights require supervision, but excessive obligations can harm national innovation capacity.
He warns that overly exaggerated regulation can result in the export of innovation and the import of technology, while insufficient regulation can lead to the import of problems and the export of rights.
The risk of overly burdensome oversight is that the cost becomes an entry barrier, benefiting larger companies and penalizing smaller ones. This situation can have technological consequences, as if Brazilian companies have more difficulty developing AI while large foreign companies comply with the rules, the regulation could alter the market composition.
Therefore, Alvarenga advocates that Brazil should draw inspiration from international best practices, but without blindly replicating models created for different economic and institutional contexts.
Despite concerns about innovation, the reasons for creating rules persist, given that AI can already participate in decisions with concrete effects on people's lives. A system used in hiring or credit analysis can generate discriminatory or unfair results, even under data protection.
Alvarenga highlights this shift in the debate: the risks of AI are not limited to personal data processing; a system can also issue problematic decisions. Therefore, the regulatory focus should not only be on controlling the technology but also on the situations where it generates impacts, including human oversight in crucial decisions.
Generative AI has accentuated these problems, with tools that produce realistic texts, images, videos, and audio increasing concerns about fraud and deepfakes. However, Alvarenga argues that concentrating regulation on these cases may lead to rules focused only on exceptions, ignoring the countless positive uses of AI.
This reinforces the logic of risk-based regulation: different applications, with diverse impacts, do not need to be subject to the same level of requirement.
Even with identified risks, there is another hurdle: the speed of AI evolution. The legislative process is notoriously slow—from drafting to implementation—while technology can undergo drastic changes in just a few months, with new models and applications emerging.
Arthur Igreja, a specialist in technology and innovation, highlights this misalignment, observing that AI has become more powerful and acquired new capabilities at a pace that legislation does not follow.
This does not justify abandoning the regulatory debate; on the contrary, for Igreja, the speed of technology makes proactive rule creation even more vital. Belli agrees, stating that a law is, at most, a portrait of the state of the art and best practices at the time of its approval, which is problematic given the extreme agility of AI evolution.
Overly detailed legislation can quickly become obsolete, while very broad rules can generate legal uncertainty. Belli proposes an adaptable model, where the law establishes principles and obligations, but the execution mechanisms allow for adjustments as new circumstances arise.
The difficulty lies in balancing this flexibility without turning the legislation into something unpredictable for users and companies.
Additionally, there is the post-approval implementation phase. Since AI permeates various economic sectors, oversight may involve multiple public bodies. A single law may require coordination among authorities from diverse topics, making the implementation structure as critical as the text approved by Congress.
Belli warns that formulating good rules is useless if they are not effectively applied. He questions the expectation of automatic coordination between bodies given complex legislation, arguing that the cooperation structure must be planned from the beginning to define responsibilities and prevent conflicts of competence.
This point is vital, as AI systems can operate in finance, health, education, commerce, and security. Regulation, thus, does not end with the sanctioning of the law; it is necessary to define how it will be interpreted, who will conduct the oversight, and how the system will be updated with new applications.
The regulatory discussion also touches upon Brazil's future role in the AI industry, while the US and China consolidate infrastructure and models, and other countries seek technological autonomy.
}} , 2.
