From the Desk of Ashok Mehan
Issue No. 7 was promised to you for August 10. It is arriving seven weeks late, which I would like to present not as a lapse but as research. I set out to write about why governments cannot keep pace with artificial intelligence, and then I proceeded, with great fidelity, to not keep pace with my own newsletter.
In fairness to me, the subject would not sit still. When I wrote the preview for this issue in early August, I told you the European Union's AI Act was in force. It was — but its high-risk rules had been postponed by sixteen months the week before, and I had not noticed. My preview was out of date before it was published. When I began the American section, a bill to override every state AI law for three years was the story. By last week, the Speaker of the House was telling reporters that Congress should not "panic" into emergency AI regulation. Every paragraph I wrote went stale before I could finish the one after it.
That, it turns out, is the whole argument of this issue. So I have stopped apologizing and started writing.
This week also has a second thread, one I have avoided for years. The last time I was on the receiving end of the government's rulebook, it was not an abstraction in a newspaper. It was a lawsuit with my name on it. I know something about how rules actually land on people — slowly, bluntly, and not always on the ones they were written for. That story is in the memoir section below. It is the part of this issue I found hardest to write, and the part I most want you to read.
The European Union did the thing that serious people said needed doing. It wrote a comprehensive, horizontal law for artificial intelligence — the first in the world — and it put it into force on August 1, 2024. The heaviest obligations, the ones covering "high-risk" systems that screen job applicants, score creditworthiness, or sit inside medical devices, were scheduled to bite on August 2, 2026.[1]
They did not bite. The standards bodies that were supposed to translate the law into engineering checklists were not ready. Neither were the national authorities meant to enforce it. So Brussels wrote a second law to delay the first. The so-called Digital Omnibus pushed the stand-alone high-risk rules to December 2, 2027, and the rules for AI embedded in regulated products to August 2, 2028. It was published in the Official Journal on July 24, 2026, and entered into force on July 27 — six days before the original deadline.[2]
I do not say this to mock Europe. I say it because it is the cleanest illustration I know of the central problem. A law is a snapshot. It freezes a set of assumptions about what a technology is and what it does, and then it asks the world to hold still while the paperwork catches up. The world did not hold still. Between the day the AI Act was drafted and the day its core obligations were supposed to apply, frontier models went from writing passable essays to finding software vulnerabilities, running multi-hour agentic tasks, and reasoning through graduate-level science. The law was aimed at the machine of 2021. It was asked to govern the machine of 2026.
"A law is a snapshot. The technology is a film. You cannot regulate a film by studying a single frame very carefully."— Ashok Mehan
The American problem is the mirror image of the European one. Europe has one law that moves too slowly. America has no national law, and fifty state legislatures that move quite quickly indeed. By July 1 of this year, the states had enacted 109 AI laws and 28 laws on data centers — after 159 AI laws in all of 2025.[5] California has frontier-model disclosure duties. Texas has its own framework. Colorado passed a sweeping AI Act, then rewrote it rather than repeal it.[4]
Washington's response has been to try to stop the states rather than to govern the thing itself. In 2025, a moratorium on state AI laws was slipped into a budget bill; the Senate stripped it out by a vote of ninety-nine to one.[6] The White House then issued an executive order calling for a "minimally burdensome" national standard. In June, a bipartisan discussion draft — the Great American AI Act — proposed preempting state AI laws for three years.[3] It has stalled since. And in mid-September, House Speaker Mike Johnson said Congress should not "panic" into emergency regulation and that the companies, not the government, should carry primary responsibility for AI safety.[4]
Read that sequence slowly. The one proposal that has come closest to becoming national AI law was a proposal to prevent AI law. The floor, as one critic put it, would become the ceiling.
So what fills the space where a national law ought to be? In America, mostly the executive branch. Last December the White House issued an order declaring a "minimally burdensome" national framework to be federal policy, and promising to "check the most onerous and excessive laws emerging from the States."[6] An executive order cannot repeal a state statute. That is what Congress is for. But watch what happened anyway.
The order listed a few kinds of state AI law the federal government would leave alone — among them, rules protecting children and rules on data centers and computing infrastructure. In 2026, state legislatures shifted noticeably toward precisely those categories, and researchers tracking state legislation think that was no coincidence.[5] No state was compelled. The order simply told fifty legislatures where the safe ground was, and many of them walked onto it.
That is governance, of a kind. It was not debated in public or voted on by anyone — and it worked. It has arguably shaped state AI law more than anything Congress has done.
And where neither Congress nor the White House has spoken, a third answer is emerging: let the companies do it. When the Speaker says the builders, not the government, should carry primary responsibility for safety, he is describing a real choice, not an absence of one. It may even be the right choice for now. But we should be honest that it is a choice — that "no regulation" is itself a governance regime, with its own winners.
China, which is often described as having no AI rules, in fact has more of them than anyone — just not in one place. Algorithm registration since 2022. Deep-synthesis rules since 2023. Generative-AI measures the same year. Mandatory labeling of AI-generated content since 2025. And on January 1, 2026, amendments to the Cybersecurity Law brought AI governance into national statute for the first time.[7] The Chinese approach is layered and fast, because it does not have to wait for a legislature to agree with itself. It is also, by design, an instrument of state control over information. Speed is not the same thing as wisdom.
I have spent enough years inside federal procurement to be suspicious of anyone who claims to have the answer. But I have three convictions.
First, govern the chokepoints, not the applications. There are thousands of AI applications and a handful of frontier training runs, data centers, and chip supply chains. You cannot write rules for every use of a general-purpose technology. You can require that the few systems at the frontier are tested before release, by people who are not selling them.
Second, fund the referees. The United Nations has now assembled an Independent International Scientific Panel on AI — forty members chosen from more than 2,600 candidates — modeled loosely on the climate panel.[8] Its first report warned that the technology is outpacing governments' ability to adapt.[9] Evaluation capacity — the people and tools to measure what a model can actually do — is the one public investment that does not go stale when the next model ships.
Third, write law the way we write software. Version it. Give every provision a sunset date and a scheduled review. The Omnibus was, in effect, a patch release shipped six days before the deadline. We should plan for patches rather than be surprised by them.
None of this closes the gap. The gap is structural: machines improve on a cycle of months, and democracies deliberate on a cycle of years. I wrote about that mismatch in The Clock Speed Problem. What 2026 has taught me is what happens in the gap. It does not stay empty. Something always fills it — an order, a state statute, a lawsuit.
Working Table — Five Ways the World Is Governing AI, September 2026
| The Regime | Its Instrument | Its Speed | What It Catches | What It Misses |
|---|---|---|---|---|
| European Union | One comprehensive statute, risk tiers, conformity checks | Years; core rules now slipped to Dec 2027 / Aug 2028 | Consumer-facing harms in hiring, credit, health, policing | Capabilities that did not exist when the text was drafted |
| U.S. Federal | Executive orders, agency guidance, chip export controls | Days — when it acts at all | Acute national-security risks at the frontier | Everything that needs a statute, a budget, or public comment |
| U.S. States | Targeted laws: disclosure, deepfakes, chatbots, children, data centers | Months; 109 laws in six months | Local, visible harms voters complain about | Anything that crosses state lines — which is everything |
| China | Layered regulations, filings, labeling, now national statute | Fast, administrative | Content, provenance, platform accountability | Independent scrutiny of the state's own use of AI |
| United Nations | Scientific panel, annual Global Dialogue | Annual | A shared factual baseline across 193 members | Enforcement of any kind |
From the Book · Memoir Passage
In 1990 I started SMAC Data Systems in Gaithersburg, Maryland, with no money and a credit card with a five-hundred-dollar limit. In time we were building specialized rack-mounted, rugged, industrial-grade computers for U.S. Navy aircraft carriers. If you had walked through our lab you would have seen the same messy, hopeful process that built life itself: loose screws, long-haired technicians moving through the room with large screwdrivers, small experiments, swift and brutal selections, and the occasional improbable breakthrough. The Navy got its computers. I got an education.
Success in government contracting attracts attention, and not all of it is welcome. The enemy arrived in the form of a disgruntled former employee who, blessed with a creative legal imagination and a sympathetic prosecutor, filed a case against me that had one distinctive feature: it entitled him to thirty-three percent of whatever the government recovered from me. As incentive structures go, it is a marvel of misaligned motivation. With the arm of the United States government on your shoulder — not affectionately — the physics are fairly simple. You bend, or you break.
I bent considerably. Then I fought back.
During that same stretch I was somehow being celebrated and investigated at once, which is a peculiarly American experience. Magazines wrote me up as the man who came from nothing and succeeded beyond belief. In 1997 I was a finalist for the KPMG Entrepreneur of the Year award, losing to Michael Saylor of MicroStrategy — a man who went on to build a billion-dollar company and later became famous for buying Bitcoin with corporate treasury funds. I want the record to show that I was right there behind him. Not in the Bitcoin department, but in the came-from-nothing-and-built-something department, which I maintain is the more important category.
"It is one thing to fail. It is another to fail honorably."— From the manuscript
By the time I had finished defending myself, I had spent every penny I had, and I folded the company. But I paid every debt in full. That is a distinction I still wear.
I tell this story in an issue about AI governance for a reason. The rules that caught me were written for real villains — contractors who genuinely defraud the taxpayer, and there are plenty. The rules were not wrong. But a rule is a blunt instrument aimed at a category, and it lands on whoever happens to be standing in the category when it swings. Nobody writing that statute imagined an immigrant with a rack of Navy computers and a very angry ex-employee. The law did not care what I was. It cared what I looked like on paper.
Then I built FedMine — a company whose entire business was the gap between the government's rules and its reality. Federal spending data came from more than twenty sources, each coded by different agencies under different regulations, all meant to describe the same dollars and almost none of them agreeing with each other. The rules said the data was consistent. The data said otherwise. I made a living in the space between the two.
So when I read that the EU's AI law has postponed itself, or that the one national AI bill with momentum was a bill to stop other people's AI laws, I do not feel outrage. I feel recognition. This is what rules always do when reality outruns them. They get stretched over things they were never designed to cover, and the people underneath them discover the shape of the law by being bruised by it.
Looking Ahead · Three Governance Trajectories for 2027–2030
Governments stop trying to write the perfect statute and invest instead in testing capacity — national evaluation institutes that examine frontier models before release, sharing results across allies. Laws become shorter, versioned, and scheduled for review. Pre-release testing becomes routine, the way crash tests are for cars.
Possible. The institutions exist in embryo. The budgets do not.
No comprehensive U.S. law passes. Europe's rules arrive in 2027 and 2028, already partly obsolete. Real decisions keep being made by executive order, court injunction, and state attorney general — fast, inconsistent, and reversible. Companies learn to negotiate with governments the way they once negotiated with suppliers.
Most likely. It is, more or less, a description of 2026.
A serious AI-enabled incident — a cyberattack, a financial cascade, a synthetic-media crisis in an election — produces sweeping legislation drafted in weeks. It is aimed at the last incident, not the next one, and it lands hardest on the small, the open, and the honest, while the largest players absorb the compliance cost.
Plausible. Most of the laws we regret were written the week after something went wrong.
What I'm Reading This Week · Three on the Nightstand, One Just Finished
I have just closed the last page of this one. Suleyman, a co-founder of DeepMind, argues that the defining challenge of this century is "containment" — keeping powerful, cheap, endlessly copyable technologies within human control. It is the right companion to this issue, because containment is simply governance under another name, and he is candid that no institution on Earth is currently built for it. What makes the book worth your time is who wrote it: not a critic on the outside, but a builder worried about the thing he helped build.
Rivlin, a Pulitzer Prize–winning journalist, spent more than a year inside the founder-and-investor world of Silicon Valley as the generative-AI gold rush took off. Suleyman turns up here too, this time as an entrepreneur at Inflection AI rather than an author issuing warnings, and reading the two books back to back is its own education: the same man, seen first from the inside of his own conscience and then from the inside of a funding round. If The Coming Wave is the case for rules, AI Valley is a portrait of the money moving faster than any rule could.
The odd one out, and deliberately so. Stephenson's novel gave us the word "Metaverse" more than thirty years before Silicon Valley tried to sell it back to us. It imagines an America where government has shrunk to a franchise, private companies run what is left, and the most important territory is virtual. I am reading it now as satire that has aged into something closer to a forecast. After a week spent studying how governments are failing to govern AI, a novel about a world where they simply stopped trying felt uncomfortably on topic. For the longer version of where the Metaverse may be taking us, see my essay Welcome to the Machine.
Shanahan, a professor of cognitive robotics at Imperial College London, has written a clear, compact guide to the idea my own book is named for. In a slim volume he walks through the routes to human-level AI, what might happen once machines can improve themselves, and why the outcome depends so heavily on what those machines are built to value. It is a sober book about an unsober subject. Read it alongside this issue and the governance question sharpens: if the singularity arrives on a schedule of years, the law's schedule of decades is not a detail.
Why institutions built for the speed of paper cannot govern a technology that improves on the speed of silicon.
Essay 011: On the Vagaries of Optimism →The longer memoir — SMAC, the lawsuits that arrived like buses, and the road to FedMine's sale.
The Global AI Power Index →Who holds the compute that every one of these regimes is trying to govern.
Sources & Further Reading