Safety and regulation
How do rules become safer systems in practice? · updated 2026-09-07
A risk framework, a voluntary code and binding law do different jobs. Useful governance connects a use case to evaluations, accountable people and a response to failure. Neither a compliance badge nor a benchmark score proves that an application is safe.
The concern
Without accountability, incident handling and external scrutiny, written safety promises are hard to enforce. Harm can arise from connections to data and tools even when a base model passes evaluations. Duties need to reach the application and affected people.
The counter-view
Proportionate requirements can focus effort on higher-risk uses. NIST's voluntary framework organizes work without treating every chatbot as a critical system. Clear guidance and reusable evaluation evidence can reduce duplicated effort for smaller teams.
The Commission overview now includes enacted simplification and later high-risk dates. NIST says AI RMF 1.0 is being revised. Versions, dates and jurisdiction are part of the evidence.