big companies → regulation → big companies win

What regulation? Which companies? (Apparently it’s a secret)

But “the biggest donor in the midterm elections” and the rest of the Patagonia Patrol keep repeating “regulatory capture” over and over like it’s a complete thought.

You Keep Using this Word…

The concept of regulatory capture is simple enough, as shown in George Stigler’s canonical 1971 article. Using a public choice framework he shows how and why inefficient market regulation persists to the benefit of some and cost to others.

It’s possible they mean to imply some other accepted theoretical basis and meaning for “regulatory capture,” separate from the Nobel Laureate who birthed a whole new literature in economics. If that’s the case, I’ll withdraw my complaint and see myself out.

But for now I limit the explanation to Stigler’s article. These are not necessarily my views though. I’m happy to go beyond that if only one of these people starts by reading the damn Stigler article and using the phrase correctly.

Regulation is Captured by Industries, Not Individuals

Stigler’s analysis does not explain one or a few companies erecting barriers to entry. While they do act as an implicit barrier, his culprit is an existing “industry or occupation” benefitting at the expense of consumers, not individual competitors. Oil, trucking, airlines, and banks are among his examples.

Poor Little Guy

And it doesn’t show up as big vs. small, as per the tedious Little Tech chorus. In fact, the cartelizing effect of regulation is better for small producers:

The political decisions take account also of the political strength of the various firms, so small firms have a larger influence than they would possess in an unregulated industry. Thus, when quotas are given to firms, the small firms will almost always receive larger quotas than cost-minimizing practices would allow.

—George Stigler, “Theory of Economic Regulation,” The Bell Journal of Economics and Management Science, Vol. 2, No. 1 (1971)

It’s funny because this is not unique to this regulatory capture case. It’s just how cartels work. I say it’s funny because it’s this same guy Stigler who explained it six years earlier,1 along with Mancur Olson,2 with direct extensions of Stigler by Sam Peltzman3 and Gary Becker.4

The Little Tech’s story goes: BIG GUY uses regulation to keep out LITTLE GUY. That may be true, but you’ll have to look elsewhere to explain how.

In a privately-enforced cartel (no legal constraint):

• small producers evade detection easier and more likely to defect, and

• a given proportionate increase in production → less impact on market price AND higher return to the small firm.

In a government regulation cartel:

• a public interest message needs as close to unanimity as possible to maintain political support (Stigler).

• smaller firms are proportionately larger political constituency even within the cartel for a political-maximizing regulator (Peltzman) which is why you DON’T often see conferring monopoly benefit on a single firm. Which would be easier but not politically optimal.

• small/new firms (at some margin) are cheaper to buy off by large incumbents vs. deadweight political cost of losing coalitional support (Becker).

Price Floors for AI?

Stigler’s policy mechanisms — the tools the captured regulators use to prop up their industry friends — are a curious choice to point to as a concern for the American Innovators Network.5

Tariffs & import quotas, price floors, and occupational licensing: Do any of these seem like a particular concern for AI companies? Licensing, okay has the same word as some of the regulatory proposals. I’ll let you work out amongst yourselves why licensing for lawyers and physicians ain’t the same thing as for frontier models.6

Addendum

Don’t get me started on the rhetorical corruption of the Bootleggers-and-Baptists theory, not the least of which by the guy who thinks introspection is overrated.7

I swear…

To appreciate how quickly the ground is shifting, consider the volume of state activity in 2026 alone. States have introduced more than 1,500 AI-related bills. In the first six months of 2026, 84 measures became law across 27 states, with several others still pending or expected to be reintroduced in 2027.

—a16z Policy Brief

To see why this is either meaningless or indefensible, let me put it in different terms:

Imagine the Golden State Warriors went 78-4 on the season and then fans couldn’t shut up about how the NBA is biased against them and constantly preventing them from winning. (Maybe a better example is Patriots fans ca. 2001-2019)

If this feels like the “ground is shifting” you might want to get your inner ears checked for equilibrium issues.

Less than six percent is the passage rate within this “volume of state activity.”

84 is still a lot of new laws though my dude!2

Indeed. So let’s dispense with the drive-by about 1,500+ bills as if it says anything.

The 84 actual passed laws isn’t even the meaningful policy change. About one-third of those have no effect on AI companies or any other tangible outcome (ex: Alabama HJR 51—establish a commission to study AI and children; report due in November).3

So we’re left with 56. Please don’t dig into the specifics of the remaining 56 bills. I’m begging you.

Okay, fine (don’t say I didn’t warn you).4 Here's the first 27:

• CO SB 26-189: In 2024, Colorado passed a first-in-the-nation comprehensive AI law. As I understand, it required impact assessments, notices, disclosures, all the things.5 It never took effect. This 2026 law is a repeal-and-replace eliminating most of the requirements. For those keeping score, this new bill LOWERED the compliance obligation from the status quo ante.

• 9 healthcare laws: Seven are prior auth and insurer-facing, such as requiring a physician to make the final decision re: a denial of coverage. The liability nexus is the health insurer and not the vendor selling AI-assisted claims review software. One law is specifically on downcoding. Two are patient consent and scope of practice.

• 13 extensions of existing criminal/tort laws: they take existing crimes, and update or expand accordingly, like modifying the definition of sexual extortion, CSAM, NCI, libel, and identity theft (via penalty increase). In other words, “we have felonies in this state - don’t use AI to commit one.”

• 4 pertaining to elections: disclosure in campaign calls and materials.

Okay then. To wit:

None of this is an argument against protecting children, promoting transparency, or addressing the genuine risks that AI presents. States are responding to real concerns….But perpetually shifting, state-by-state development mandates will impose costs on Little Tech that will have corresponding costs to competition in AI markets.

…States would retain their essential and robust authority to police harmful uses of AI within their borders through their consumer protection, criminal, and civil rights laws

So we’re in agreement. Of the 1,500+ bill patchwork threat:

• > 94% aren’t “perpetually shifting” anything because they aren’t law

• < 6% ARE law

• ≈ 4% are the ones we should be concerned about

Heard.

That’s 29 remaining, conceding these bills do impose some compliance and market-limiting burdens on AI companies—

• 17 chatbot safety: real disclosure and safety requirements for developers. Non-trivial. A real place for debate and calibration.

• 12 misc.: everything from training data requirements, provenance, algorithmic pricing, employment restrictions, and the Illinois law which is a real frontier safety auditing regime. Again, real things, that real developers need to accommodate or work around.

For sake of argument let’s assume all 29 apply to all AI companies—that these are all broad-based and generally applicable (keeping in mind the CO law significantly eliminated a bunch of regulatory burdens).

Is this really “one of the biggest challenges facing AI startups?”

If so they could use some kind of state AI legislation tracker to follow it all.

Fortunately I made one and available for free (link below). Happy to share the JSON file, but I assume AI startup people are way better at this than me.

Mine’s pretty simple and incomplete, but it does the basic job. I’m not sure it solves what a16z says is the problem, because apparently AI startups need to:

1. "reconcile conflicting obligations….[for] competing and potentially contradictory requirements”

2. and simultaneously “always build to the most restrictive law.”

Nothing can help with these because they are categorically mutually exclusive. Having to build a ladder to get over the tallest wall does not also require building a series of shorter ones. That’s not how superlatives work.

3

Probably they should’ve leaned more heavily on AI to analyze all those bills.

…computational (i.e., in silico) research that may include development of computational models…to design novel forms of biological agents, is not prohibited.

—“United States Government Policy for Stopping High-Risk Life Sciences Research,” July 20, 2026

…for the first time, an explicit prohibition on dangerous gain-of-function research.

—”U.S. Government Policy for Stopping High-Risk Life Sciences Research,” statement of Jay Bhattacharya (NIH Director), July 28, 2026

Last month the federal government announced a replacement of the old regime for funding and oversight of potentially risky gain-of-function and other biological research. A “paradigm shift in federal oversight” in their telling.

Welcome to the Main Event

The mostly hysterical takes on the recent Rand Paul v. Anthony Fauci (Round ??) reminded me of something I completely forgot.

At that same committee in 2019, we sat down with representatives from NIH and other federal offices1 to discuss policies around federal funding for gain-of-function research (GOFR). Those policies were collectively called Potential Pandemic Pathogen Care and Oversight (P3CO), which is what the Trump admin replaced.

A brief timeline leading to today is below, but the proximate concern at the time was the status of and compliance with the government's GOFR policy.

To this day I don't hold a categorical position on this, and certainly didn’t then. As I understood, GOFR is an avenue of inquiry that presents risks and has also provided useful epidemiological and medical insights.2

So how did we get here?

To the degree anything did, what went wrong with the P3CO in 2019-20? Our conversation with the Executive Branch officials was less about whether unacceptable risks were being undertaken by the federal government, than how the government was making such determinations.

Lipsitch/Inglesby had two criticisms: (1) a prudential one about the actual funded research itself; and (2) a procedural one about the anonymous and opaque nature of the funding review.

The core of our 2019 inquiry was about the second complaint, about whether de facto policy deviated from prior practice without public notice. To the degree we could tell, the criteria for review remained unchanged but of course anonymity didn’t help.

Remember, Lipsitch /Inglesby are not crank subreddit lurkers. They had in fact convened the most credible and transparent assemblage of experts on this topic, and the resulting government policy was significantly informed by their recommendations.

Whatever the justifiability of the policy regime, its structure ensured there was no broad constituency invested in defending it. And when an outbreak had even the appearance of a policy failure, the reaction was never going to be proportionate.

An anonymous, expert-only body was making a societal risk tradeoff on the public’s behalf without the public in the room. Expert consensus bought scientific credibility; it never bought durable political legitimacy.

Policy advocates, especially those who believe they have identified the proper structural and institutional design would benefit from humility and an intense study of political economy.3

What to make of it?

The new policy establishes an Independent Third-Party Review Body. All reporting and my review of the policy statement indicates the body will be made up of federal agency officials, though I’m unclear if that’s explicitly binding. But…

A government advisory body → made up of government employees

≠

independent or third-party review

so this nomenclature is internally contradictory. It’s making me verklempt.

The quality of the criteria is important, but should anything go wrong, it won’t protect you from full on public outcry. Transparency, of the reviewers and reviews, is a necessary condition. It may still be insufficient, but without it you’re already cooked.

What’s AI got to do with it?

Let’s clarify: I’m not predicting a SARS-COVID-19 scale AI “lab leak” (or whatever the wet market equivalent is). I’m not a catastrophist but I suppose it’s possible.

But secret White House AI cybersecurity evaluation ain’t helping political durability. It’s sustainable until something goes wrong. Something moderately disruptive, like say a medium-sized municipal water system shutdown. Something that makes the risk salient, the cause of which the public will incorrectly overdetermine, even if it stays shy of DEFCON 3 level freakout.

Because without the feeling of being in the room, the public will reject whatever results. Regulations can only instill confidence if people think they exist.

In 1979, Three Mile Island Reactor 2 overheated. Public support for nuclear energy collapsed and the U.S. spent 40+ years debating whether to try again. Before you think that reaction could happen anywhere, France’s robust regulatory regime managed to support ongoing nuclear energy infrastructure that whole time.

Whatever ought to be the right level of risky bio-research, AI frontier capability, or quantum-something, it won’t matter unless you get public buy-in.

The author is nonresident senior fellow at

Cool Beans

Google’s newest AI app Dreambeans described as everything from silly to creepy.

Sandbox Irregularities

Remember a couple weeks ago when OpenAI’s new model broke containment and went all rumspringa with the Hugging Face townies? Well OpenAI wants to come clean about some other incidents.

They work with third-party testers, and one of them committed a “testing-environment misconfiguration” (the software equivalent of a wardrobe malfunction). OpenAI wants to make sure you know it was totally not OpenAI’s fault. Instead Irregular (yah, that’s the contractor’s name) simulated a target that:

“unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment. This did not involve a sophisticated sandbox escape.”

So that sounds like two mistakes to me. BUT DON'T WORRY. EVERYTHING’S COOL - IT WASN’T ONE OF THOSE SANDBOX THINGS YOU’VE ALL BEEN HEARING ABOUT. (ed. Whew that’s a relief)

Look, it's not any major new risk—it’s the kind of thing that happens all the time. But it ought to be relevant for all the people advocating strongly for “independent verification organizations” (IVOs) as a solution to risk mitigation (e.g., Fathom).1 Because while that approach is plausible, and one I generally support, their blind spots mean they shouldn’t be driving at night. In this case even if we ignore incentive misalignment, it assumes an available supply of sufficient expertise.

OAI and the leading labs don’t collaborate with tech bumpkins—these are among the most credible testers and evaluators in the world. And even they make mistakes. What happens when an IVO working in good faith misses the “Internet OFF” button but still slaps an Inspected by IVO No. 3 sticker on it and it goes full send? That’s not fatal, and no system is without mistakes, but it’s foreseeable and already quite real.

+ OpenAI’s post is quite deliberate in deflecting blame…why would that change in the future? How would us mere mortals even know if they’re right?

Microfoundations for Macro AI

The above is why I’ve become obsessed in modeling among other things simple scenarios of AI performance. Which I intend to do more of, pending funding.

The point is to use well-established economic machinery to model, predict, and test, what happens when humans be human-ing but now they have AI sidekicks: in their job, in the market, wherever.

SO MUCH of AI and related policy chatter is so obtuse, so unfalsifiable, and yet so incredibly confident. It’s vague claims and extreme conclusions based on what the French call a certain I don’t know what. Certainly not policy experience.

Nerds can be pretty insightful, but the annoying thing about this particular vintage is it comes cloaked in completely un-self-aware hubris. And that would normally be off-putting but apparently makes you a “thought leader” [*gag me*].

The worst offenders are the types. Running around yelling Regulatory capture! Regulatory capture! but think George Stigler is the guy who works at the corner deli.2

Because lots of otherwise worthwhile ideas are built on a heroic amount of hand-waving:

Someone will write the specific law or regulation to implement this. Someone will negotiate around political opposition. The needed data will appear. Right?

Those are Atlas-level load-bearing assumptions.

Trust me: none of that shit just works itself out. But it can be done, and a useable playbook assembled ahead of time. An offensive coordinator doesn’t say “The wideout gets downfield then touchdown. The offense will figure out the rest.” But that’s what ya’ll sound like.

Claude FLASH SALE!⚡

Elsewhere I flagged what I thought would be a bigger deal: a product the US government flagged as a significant “supply-chain risk” is still available for sale to federal agencies. Not just for sale, but for “$1 from now until September.” Pretty smokin’ deal for software banned “to protect national security.”

As a reminder, Anthropic’s court challenge to the Trump Admin.’s security ban is ongoing, and a federal judge asked the government how many agencies are still using the AI software. To which the gov’t lawyers basically put their hands in their pockets, looked sheepishly at their shoes, and said, “um, we would totally tell you, but it’s, like, super sensitive security info and stuff.”

Maybe GSA can answer. Funny because it’s sad. (ed. the word you’re looking for is “tragicomic”).

Etc.

From The Grand Resign

• Notice & Comment (Yale Journal on Regulation) where I recently returned as contributor:

  • Void Where Prohibited - the Catch-22 in the Federal Vacancies Reform Act (the law governing “acting” officials).

  • The Regulatory Three-Body Problem - how do administrations actually make regulatory decisions?

• Hey ChatGPT-5, you good? - follow-up to an essay describing why an improving AI agent at work isn’t what it looks like. Validated by this story that Microsoft’s own programming is being weighed down by “AI-assisted coding and agentic workflows” leading to major outages. It turns out, as the model predicts, human coders aren’t reviewing the AI closely enough.

• Infrastructure Permitting Reform finally arrives! - in 2016, that is. But it saved $53 billion!

Ho-hum

3.7M patients had their medical records stolen in data breach. “CareCloud handles a large amount of patient data and billing information on behalf of hospitals, doctor’s offices, and other medical practices.”

Tell me again how I’m a doomer.

They Only Need Once

and Sebastian Mallaby () over at ChinaTalk reminded me of a totally remarkable event I think most of us forgot. In ‘84, an IRA bomb would've killed Prime Minister Thatcher at her Brighton hotel, but for her working late and walking to the bathroom (still 5 killed, 30 injured).

Afterwards the attackers noted she was lucky but they only had to be “lucky once.” The asymmetry of cyberattacks versus defenses….it’s structurally the same.

The author is nonresident senior fellow at

I promise there’s a valid and unimpeachable point here, nothing to do with autism. A new Executive Order changed something regarding childhood vaccines, and the recently benched Senator from Louisiana isn’t a fan:

As Sen. Bill Cassidy, a Louisiana Republican and physician, wrote on social media on Monday, ‘This executive order is wrong. The President does not have the expertise to make these changes.’

This declaration is both true and irrelevant.

Sen. Cassidy may be one of the few members of Congress who is an expert on childhood vaccines. And 99 percent of what has ever been decided, by every President ever, is outside any colorable expertise. Maybe Eisenhower, since defense is roughly half the federal budget, wrecks the curve. But good, bad, indifferent, expertise isn’t what put them in the chair.

It’s not what people vote on. College transcripts may be a subject of fascination, but nobody voted for JFK over Nixon because he graduated cum laude from a fancy school.

They look to proxies for effectiveness. For example, people believe, I think rightly, military service indicates a degree of leadership and character. But not mastery of the thousands of topics on which the government plays a meaningful role.

It’s true of the political appointees reporting to POTUS too. The breadth of modern agencies and their various components means even an honest-to-god MIT nuclear physicist doesn’t have the wherewithal to know everything done at the Department of Energy. No one does—you’d be surprised how that applies to even highly specialized functions.

Unless it’s the Clark R. Bavin National Fish and Wildlife Forensics Laboratory and you’re the forensic scientist, crime scene investigator, and NYT bestselling crime thriller author who runs it.

No, from the President on down, expertise is distributed throughout thousands and thousands of feds, many of them career employees, and those in positions of authority need to be good at receiving and synthesizing that knowledge.

I know from experience.

Look, I ain’t just whistlin’ Dixie when I say I’m one of the most expert federal regulatory nerds in the country, and even I don’t know a stitch about hemp cultivation (my first day on the job). You gotta rely on specialists all around you—maybe you’re the one that hires them. A good leader encourages frank and expert advice to make it through to them, and then they decide how to weigh various views and considerations. If anything, that’s supposed to be their skill.

Voters are allowed to choose whatever criteria they want, but there’s never been an “expert in everything” on the ballot. A candidate may have credibility as a successful businessman, and that’s important to some people. Perfectly reasonable, but no one thinks they must also be a scholar of antiterrorism or master of affordable housing. The implication is that they are decisive, knows how to hire good people, hears out multiple opinions, etc. and that’ll be what works in the job.

And it can be done, gathering all that technical expertise by a non-expert.

Former colleague Paul Ray wrote a whole paper about it with a super esoteric title (he’s the kind of person who can, like, quote Plotinus on the fly in an affordable housing discussion).

Of course voters don’t get a direct say on cabinet officials, and subcabinet secretaries, and sub-bureau deputy whatevers….literally every Executive Branch official except POTUS. Some 4,000 politicals on a good day. The ones supposed to give the President advice, themselves receivers of distributed knowledge.

So no. No childhood inoculation regimen expert is he, the President.

Sen. Cassidy happens to be though. And in his expert judgment, considering all the things he thought salient and important, he voiced his judgment about those who would be in a position to advise the President. In the case of a HHS Secretary, one making no secret about a long-time advocacy for the policy on which Cassidy is now upset, he concluded “aye.”

I have no strong opinion one way or the other on the topic; that’s not what this is about. I’m not an expert. But Sen. Cassidy’s protest about lacking expertise is curious. Because it’s both true and totally besides the point.

The most effective time for him to worry about expertise, and to apply his own, was some point last year. Really the frustration, understandable, is that he lacked sufficient expertise to see this coming.

[Still he’s not the least self-aware member of the YOLO Caucus]

• It’s always infrastructure week!

• A winning political issue!

• Insects move faster than bureaucrats!1

And why not? From housing to hyperscalers, pundits to podcasters, the abundance agenda is IN.

This is a good thing. But I will say, as in all trends, the newbies Columbus-ing in think they’re the first to arrive, and the old-time scenesters like me can’t wait to get all “back in my day…” with it.

Background

In 2015 we passed S. 280 (Federal Permitting Improvement Act),2 better known as FAST-41 (i.e., Title 41 of a larger transportation bill). I don’t see it get mentioned much. Folks over at have been doing yeoman’s work on this, especially state reforms, but even there a recent report gets a single mention on p. 7 in a table.

That said, I hope it was meaningful and wanted to know if we could claim any impact. The primary delay in federal permits is sequential reviews across multiple agencies. Among other things, we established a presumption of concurrent review with a “lead agency” responsible for keeping it moving.

(ed. Cut to the chase. Did it help?)

Results

I used Gemini heavily to gather/organize data, draw estimates for that data, test refinements, and iterate the best way to categorize results. Assumptions are mine built on that data.

These are strictly back-of-the-envelope calculations of the economic gains.

The intuition: reform benefits infrastructure investment (capital expenditures) through a Weighted Average Cost of Capital (WACC). Every month of delay reduces the potential return on investment by prolonging the beginning of it’s productive deployment. Inflation is effectively chipping away at the net present value of a given investment so every month you shave, it goes sooner to the return-generating use it is intended.

Of course FAST-41 did not operate in a stick-and-hold policy environment. I further attempted to break down the role of follow-on and other factors during the ten-year period.

Methodology

Assumptions:

• Baseline drag (11%): Even if the risk-free interest rate is 0, there’s still opportunity and liquidity costs of standing idle.

  • First there’s some equity risk premium you need to clear. If I can make as much or more as an equity investment elsewhere the project is infeasible. ~6.5%3

  • Second, major projects are not start-stop in nature. I have to contract out for major equipment, expert and specialized labor, property deals, etc. (certainly lawyers on retainer, hah!). There’s some non-zero cost to all that. I put it, somewhat arbitrarily at ~3.0%.4

  • There’s a liquidity cost/friction where capital is booked as intended to be deployed in some given period, but now has to push back. There could be direct marginal borrowing costs, portfolio reallocations, normal cash flow stuff. ~1.5%

• Financing Multiplier (1.75): A constant reflecting the scaling costs of borrowing. Some equity financing is often present, but financing is almost always primarily debt instruments. A multiplier of 1.0 would mean the project is financed at strictly the risk-free rate, which if it is, great! But no one’s lending at that price because of course there’s risk! So every increase in the risk-free rate shows up additionally here: credit spreads, rate swaps, and debt service terms all increase faster than the baseline rate.

The rest is verifiable from available data. The cost estimation looks like this:

C: Capital expenditure for covered projects = $200B based on the federal project dashboard.

t: net reduction in permitting delay (years) = 1.5 based on permit council data, McKinsey report, and recent GWU Reg Studies Center study.

R_f: risk-free cost of capital. Treated as one rate each over two periods: Low - 1.75% (2016-2021) and High - 4.10% (2022-2026).

Discussion

As I mentioned, the law established a presumption of concurrent reviews when possible. I’m skipping the specific incentives because it’s boring. The tweet-length version is the law did two major things:

• A public federal project permitting dashboard w/ public data

• A mechanism for interagency coordination, with accountability for a “lead agency” to drive the process

Before there was a lot of benign patience where one agency would wait for another to finish and then pick up there. Say a DOT project will abut a BLM property — both have to sign off or it’s not approved. What it didn’t do is change anything in the review standards (NEPA’s environmental impact studies). But there was a clear arbitrage opportunity where multiple agencies have overlapping data and analytical needs. One task imported to multiple destinations.

Additional Points

It also reduced a statute of limitations for challenges from 7 years to 2. Most importantly it established a proof-of-concept infrastructure within the government to build on. The law did not cover every project permitting need or category. But over time other laws expanded the scope and fed more opportunities into an efficiency machine, as in the second table.

Ultimately the interest rate environment is the single biggest proximate driver of economic gains, but remember it’s the costs saved from shorter approval time in that environment that is the ultimate driver.

My assumptions lean conservative but fairly easy to adjust accordingly. Though any benefits are justified because they come at essentially zero cost. The delays are deadweight loss: they do not benefit the investors, builders, local users, or even the environment. Essentially vaporized opportunity.

The author is nonresident senior fellow at the Foundation for American Innovation.

Thomas Berry recently flagged the Federal Vacancies Reform Act‘s front-end problem: eligibility so broad that “more than 350 federal officials [can] fill any vacant office, regardless of qualifications.” That’s a sufficient condition to amend the law, and Berry’s suggestion that “all acting officers, including those from the category of Senate-confirmed officials, must be from the same department or agency as the vacant office they temporarily fill” meets the need.

But there’s a bigger back-end problem. The FVRA’s enforcement mechanism stipulates “an action taken by any person” serving in violation of the law’s requirements “shall have no force or effect” (5 USC § 3348(d)(1)), but affords no actionable remedy for parties who could bear a meaningful cost from those actions. Ordinary APA vacatur asks a court to set aside a thing that is, until then, arguably valid. Under the FVRA the thing didn’t exist in the first place.

A CRS report from April gives a thorough breakdown of the statute’s mechanisms (including the handful of specific exemptions). For our purposes, we can forgo most of the nooks and crannies proscribing limits on the selection of and conditions of eligibility for acting officials if we stipulate generally the law imposes time limits on officials exercising duties in an acting capacity, outside of which the above provision applies. We focus here on those cases where an acting official serves beyond their permitted duration, the particulars of which are immaterial.

Available data on the numerative scope of violations is spotty. GAO is the only dedicated federal office tasked with tracking, but their work is by no means comprehensive. Their findings of violation are sporadic (and sometimes even land after the offending official left). Nonetheless we do have evidence of fairly recent and significant violations:

• DOJ OLP, Jan.-Mar. 2024 (GAO, Jan. 2025)

• FEMA (GAO, May 2026)

• OIRA, ongoing (Public Employees for Environmental Responsibility, Nov. 2025)

• USDA (GAO, Jul. 2024)

And a larger point is violations, even those otherwise flagrant and obvious, are not systematically identified. GAO’s reports largely depend on the agencies themselves providing notices of appointments, nominations, and official position changes. It’s not a stretch to conclude the total surface area of shadow violations is fairly large.

A 2019 student note in the Harvard Journal on Legislation argues the FVRA doesn’t authorize acting service which fills a vacancy created by a firing. No court has considered this reading, but if correct, some acting appointments never had valid authority full stop. The time elapse between T-minus-invalid-service and dispositive determination thereof could be measured in month (maybe years). That’s not a trivial conundrum.

The articulable boundaries aren’t always obvious. In 2022 in Notice & Comment, Nina Mendelson argues there is some jurisprudence that could appear to permit Administrations to “bypass the FVRA” in response to questions around the specifics of agency practice. But the broader point stands. The law establishes some finite limits in time and scope thereby establishing there are verifiable conditions of circumstance defining when persons operate beyond them.

The Final Act(ion)

So if someone performs official duties in demonstrable violation anyway, the action is void by operation of law. But it’s operative effect can still be costly in practice.

Imagine a covered regulated party taking notice of a substantive rulemaking overseen by that official. The final rulemaking may even be signed by the official. A clear cut case of an invalid regulation, no binding effect. But the diligent general counsel for, say a large corporation, takes note that yes it shouldn’t be enforceable but the official’s removal is indeterminate. It could require Congress to flex on the Administration, a narrow political mechanism on a very specific issue. This could be a legal liability. While the FVRA precludes a compliant successor from ratifying the same thing (Sec. 3348(d)(2)), it does not prevent them from undertaking the requisite steps toward the same policy outcome. In the mean time, an aggressive Administration very well could initiate enforcement actions. Or where a private right of action attaches to noncompliance (like an employee), that’s a whole other headache.

“As your counsel, I have to tell you there’s no great options on what we should do here.”

The CEO, themself an astute attorney, replies: “yes, but this is demonstratively invalid by virtue of an official issuing it in violation of the FVRA. It’s void upon examination. And why did I hire a general counsel, anyway?” The GC, wanting to avoid appearing didactic, subtly indicates to the part of his memo noting the law does not provide a standalone right of action, only as adjunct to another corridor of judicial review.

Like under the APA. The CEO soon recalls on their own this FVRA limitation, but suggests under APA’s Sec. 704 basis of review, that should be sufficient. But whereas a credible showing of demonstrable harm for a regulation that is legally disputable presents a clear question of law before the court, a rulemaking auto-voided by virtue of the FVRA is a little more slippery.

Fortunately, Supreme Court precedent provides an express lane to declaratory judgment – while still not costless – obviating the need for a full on merits ordeal. In theory it should apply to just this kind of situation. At one point this poor GC walks through the “final agency action” test under Bennett v. Spear. Under which an action is final if it:

• marks the “consummation” of the agency’s decision-making process, and

• is one from which “legal consequences will flow.” 520 U.S. 154, 177–78 (1997) (citations omitted).

But what are the legal consequences of a regulatory chimera? A federal evanescence, a Schrödinger’s rulemaking to which there is no invoice billing code? In theory a court doesn’t have to weigh reliance interests or confront unwinding anything under FVRA, because the statute says there was never anything to unwind. Hence NLRB v. SW General, invalidating an unfair labor practice complaint issued by an official ineligible under Sec. 3345(b)(1). But the invalidation is neither self-executing and in this case applied to a tangible regulatory artifact (the labor practice complaint). Our hypothetical CEO/GC interlocutors are facing a shadow regulatory cost, and trying to understand wherein is the relief. They don’t have an enforcement notice to wave before the court.

NLRB v. SW General, Inc., 580 U.S. 288 (2017), L.M.-M. v. Cuccinelli, 442 F. Supp. 3d 1 (D.D.C. 2020), and Bullock v. United States Bureau of Land Management, (D. Mont. Sept. 25, 2020) all provide pertinent recent vintages of courts favorable to pre-enforcement petitioner FVRA claims.

And yet, all three still had to proceed to merits, and further in Bullock had a whole secondary question regarding scope after establishing the invalidity condition. None make up a syllabus of reducing transaction costs where obviousness is a precondition.

• Comply now: compliance costs are sunk regardless of the validity question eventually, hopefully resolves. There’s no recovery path even when it does.

• Challenge proactively: even a presumptive win is a non-trivial cost. Moreover a thing may appear obvious (the calendar) but establishing dispositively when an official began and ended their acting term, coeval nominations and whatnot, in what capacity and duties they were performing – even committees of jurisdiction have trouble sorting this all out.

• Do nothing: the FVRA defect doesn’t disappear. It relocates into whatever enforcement action the agency may eventually bring, where it’s a reactive defense. Legal risk remains.

Fortunately the courthouse door is open. The cost of entry is the point, and means a violative administrative action – even an egregious and intentional one – does not in the wash end up as “no harm no foul.”

a16z AI Policy Brief

The Political Economy of Little Tech

Policymakers across party lines say they support startups. The bills they propose say otherwise. Across sectors, from manufacturing to crypto to AI, we have seen proposed legislation that makes it harder for startups to build, innovate, and compete…

Listen now

2 months ago · 7 likes · Collin McCune and Matt Perault

[Responses given after each direct quote passage]

Member Meeting

Ah, it must be Rep. Epic Strawman. His constituency in East Fakeington is famous for supporting any policy at any moment.1

Overwhelming

Consider the challenge of simply knowing what is coming. A startup building an AI-powered medical imaging tool needs to understand not only the technology it is developing but also the policy environment in which it will operate. That requires monitoring legislation, tracking regulatory proposals, interpreting agency guidance, and anticipating political shifts.

…External resources that could fill this gap, including law firms, policy consultants, and trade association memberships, are expensive, and the budget to retain them is difficult to justify when the same capital could extend the company’s runway or accelerate product development.

Directionally this is correct and taken with the below is really talking about the state level—there’s not a ton happening at the federal level legislatively, which incidentally is what facilitates ad hoc highly restrictive actions showing up for the frontier models.2

Further the list of tasks is disunified:

• “monitoring legislation” and “tracking regulatory proposals” are distinct but I’ll grant the most salient, though the means of following them are largely the same.

• “interpreting agency guidance” is a distinct task - important though not radically variable over a legislative cycle. Strictly speaking interpretation is something else. Taken with the following paragraph it’s made explicit the real concern is (proposed) state legislation anyway.

• “anticipating political shifts” is something almost no one (big or small company) does well, neither is it a necessary condition to understanding the operative policy environment. It is altogether a distinct input, much broader and differing time-horizon, but has the passing resemblance to “policy” tasks.

Does this hypothetical startup need to understand “the policy environment?” Probably. In the same way this startup needs to understand HR systems, and office leasing, and candidate recruiting, and equity market conditions, and… Every startup presumably sets out to fix a narrow problem while along the way contending with a bunch of things they have zero interest in, but that’s running a business. It’s why there are various permutations of law firms, consultants, and associations for every one of those needs. In fact tons of the Silicon Valley startups are SaaS versions of those things, they’d argue are better and cheaper.

The non-zero cost of policy monitoring is not ipso facto a meaningful barrier insofar as it’s universal for anything outside the startup’s core mission. Tradeoffs are everywhere.

The burden of regulatory intelligence is only increasing. In 2025, more than 1,000 state-level AI bills were introduced across all 50 states. In 2026, the pace has accelerated: as of May, lawmakers in 46 states had already introduced over 1,779 AI-related bills,3 surpassing the total for all of 2024. Tracking and assessing these proposals requires a level of institutional capacity that is difficult for most startups to build.

Here one presumes “burden” means cost (money and time). And generously I read it inferring an increasing burden results from increasing legislative activity. That seems obvious but it assumes the marginal unit-price of “regulatory intelligence” is fixed or increasing. Does that seem right?

Well they concede the point later on that AI and new technologies are a solution. It’s actually easier than ever to track large dynamic categories like this. So I gave it a shot.

CASE STUDY: Legislation Tracker

Problem: A hypothetical medical imaging AI startup needs to stay abreast of potential policy changes across 50 states. But the skeleton staff doesn’t have the capacity (funding or labor) to dedicate to the task in traditional ways: outside lobbying/advisory services; high cost bespoke subscription services; real-time ‘manual’ searches.

Need: A low-effort, low-cost way to track the current state of affairs and changes as they occur, allowing product development, GTM, and executive teams to efficiently determine when and where a policy risk exists. As automated as possible.

Solution: Build an auto-updating dashboard

Execution:

• secure LegisScan API passkey (free w/ registration)

• use base consumer version of Claude Sonnet 5 (“medium effort”) to write an html code for a basic dashboard.

• create a naive “risk weighting” to score items for likelihood of passing (also Claude).

  • The display separates out policy most likely to directly affect the AI/medical imaging space, as well as the full universe of AI-related bills.

[Note: I did not build an auto-updating data call script for this illustration, but Claude produced a code addendum to do so]

Total labor/time: One person, < 30 mins.

• Direct Cost: monthly Claude subscription; computer; internet service

Plenty of opportunities for refinement/improvement/customization which I did not pursue since I don’t actually have VC funding for this hypothetical company.

Further there’s no plausible reason to have to actively track the entire corpus of AI-related state legislation.4 Even if you wanted to it’s fairly straightforward. And some startups and publishers offer off-the-shelf AI/ML tools for doing so: some limited but free all the way to expensive (almost as if it’s a whole market serving lots of different needs).

Being Heard

Both federal and state policymaking are relevant here, but require different scopes and at various times they emphasize one over the other so it’s hard to pin down. Federal is actually much easier (read: low cost) to monitor with a more extensive set of available tools to do so, but expensive to directly engage (read: lobby, influence); states are the reverse.

Note: this is separate from “monitoring the policy environment.” Reading the paper everyday doesn’t mean getting your op-ed published.

Impact

Regulation imposes fixed costs: legal teams, audit processes, reporting systems, compliance infrastructure. For a large company, these represent a modest share of revenue. For a small company, the same absolute cost consumes a much larger share of its resources. The result is that regulation can function as a barrier to entry, even when that is not the intent. (emphasis added)

Again directionally true,5 but not exclusively nor universally so. Regulation sometimes imposes fixed costs, but let’s stipulate it’s always the case. What is not true is that regulation is limited to fixed costs—some costs are quite variable. Import duties, copyright and data licensing, indeed audit costs for things like KYC and AML rules all scale according to scope and users. To be sure these stack on top of fixed costs (but incidentally the unit-cost economics drives increasing marginal production as much as possible, especially for smaller firms).

But there’s a couple examples given: GDPR and NY’s RAISE Act.

GDPR:

I don’t know from GDPR so concede the point—notwithstanding the implication thus far is that large firms lobbied for it at the expense of smaller ones? And we’ve so far only considered monitoring and lobbying for state and federal legislation—now global policy is the scope. Heard chef!

RAISE Act:

New York’s original RAISE Act, as passed by the legislature last June, would have imposed penalties of up to $10 million for a first violation and $30 million for subsequent violations, with coverage triggered by compute-cost thresholds that could have reached companies with significant venture investment but little or no revenue.

It continues that a key major flaw with the law is now corrected ($500M revenue threshold). It’s not irrelevant: the argument is an actual law, for a time, exhibited a policy framework they reasonably argue was acutely burdensome on startups. But the premise of this entire article is that startups are systematically biased against. Then how did this get corrected? If large incumbents overwhelm potential competitors with resources, relationships, and capacity, where was the impulse to make the eventual change? This advisory from a fancy law firm asserts the change also aligns with California law, which may itself be an awful law for startups, but it works against the heterogeneous state laws critique.

Applicability

The ecosystem is extraordinarily heterogeneous. A startup building AI for autonomous vehicles and a startup using AI to streamline medical billing face very different regulatory concerns, yet both are swept into the same “AI company” category in the policy debate. When a bill proposes new obligations for “AI systems,” these companies need different things from the legislative process, making it difficult to form unified positions or build the kind of durable coalitions that are effective in Washington. (emphasis added)

Absolutely. And without specific reference it’s impossible to go deeper. But note: imprecise terminology and definitions are a symmetric policy risk for older laws as well, themselves just as likely to overly burden startups (according to the obtuse version of public choice/Mancur Olsen gospel sang so far).

• Previously codified definitions for “revenge porn” and “CSAM” are not necessarily forward-compatible to AI-generated examples, so at least some of the thousands of proposed laws address this.6 I assume the medical imaging co. is fine there.

• Similarly extant laws may unintentionally preclude AI systems from competing on equal footing with older technologies so at least some of the thousands of laws of concern are favorable to their interests.

Since Washington is specifically recognized in this claim, let’s not forget the single widely-applicable federal legislation to get close to passing was a 10-year moratorium on AI state legislation. I suppose one could argue that favors large incumbents over startups, though odd then authors’ colleagues lobbied in favor.7 It’s one or the other guys.

Etc.

There’s additional descriptions of large incumbent advantages in the article that I’ll broadly concede as accurate, if overstated.

• Broad market participation means larger firms have more opportunities for coalitions. I’d politely suggest brushing up on your Bertrand competition model before next class.

• Longstanding participation means larger firms have more familiarity with the infrastructure of policy-adjacent institutions (think tanks, etc.8)

There’s also an extensive passage going through much of the theoretical cases for an incumbent-favoring policymaking production function. On the terms in which it’s presented I don’t dispute any of it. But it’s also tautological. The “invisible costs” of regulation smothering or aborting startups don’t get considered in policy impacts. Well, yes, but it doesn’t tell us anything instructive.

For instance it’s empirically possible particular regulatory schemes slow the rate of new firm formation, which over time eliminates fewer large incumbents. But as far as I can tell all the mechanisms of regulatory production and incidence are not specific to recent history—an arrangement of incentives and institutions true decades ago as they are now. What’s the evidence it’s worse now? Still worth countering but a fuller exploration would acknowledge how new entrants have ever been able to compete given this overwhelming disadvantage. Citing a friend of mine in a paper published by a place I used to work, they do not distinguish between a snapshot in time and a historical explanatory variable.

Proposed Improvements

A few of their suggestions to more favorably account for the startup perspective below:

[T]he Congressional Budget Office could be directed to conduct cost-benefit analyses that incorporate differential impacts on startups versus large platforms.

• CBO doesn’t do any of these kinds of assessments, so this is not an extension of an existing capacity, it’s a categorical reorientation (0 to 1?). For bills subject to committee reporting or some leadership-requested legislation, CBO focuses on fiscal budget impacts, costs to the government. This may include private sector considerations to the degree tax revenue impacts are significant and tractable. But to the degree regulatory impacts are considered it’s to explicitly acknowledge that the bill imposes a new regulatory requirement or not. Certainly not quantifying benefits and costs.

• Still a good idea? Sure. But in the extensive discussion prior to this, the consistent theme is the difficulty of the startup view to be heard. Further that structural incentives are such that large incumbents systematically drive policy anyway. Changes to CBO rules would be commendable and an oddly misappropriated use of the startup’s limited resources.

The Office of Information and Regulatory Affairs could similarly ensure that its regulatory reviews include an assessment of disproportionate costs on smaller firms.

• OIRA’s reviews are just that, reviews. They help consider regulatory impact assessments (RIAs) written by agencies on rules they are promulgating and don’t produce analyses, BCA or otherwise. But I’m being precious.

• RIAs do include small firms impacts, much of which is done pursuant to statutory requirements. The Small Business Administration also weighs in to improve this assessment and “lobby” that this impact receives maximum consideration in developing the final policy. Could these be done for a wider scope of rules? Sure. Could they be better? Absolutely. I’m not sure what operable policy change, certainly as lobbied by a startup coalition, would meaningfully accomplish this. Also, somewhat inconsistently applied, but consideration on innovation and firm entry by startups is an explicit criteria for the biggest rulemakings, especially when evaluating alternative regulatory approaches.

  If they wanted to find a place to push in this direction where it may actually have an impact, they could consider any of the several regulatory/APA reform bills I was quarterbacking years ago.

Federal agencies conducting notice-and-comment rulemaking should affirmatively solicit the startup perspective.

• No argument, but if they are in fact referring to the “notice” stage of rulemaking and that which follows, agencies don’t solicit or suppress perspectives. The notices are publicly published on the same central website, available simultaneously to anyone (and API yadda yadda). Yes individuals within an agency might call their allies to remind them of the posting—possibly extraneous effort since the large firms already have the infrastructure and resources to continually monitor I suppose—but doing so institutionally is not typically consistent with good form, not only because it’s a legal risk in later litigation. Though they could be thinking of formal rulemaking, which are rare but incredibly fulsome, and do require inviting parties to directly participate in the process.

Like much of what comes before it, these suggestions are not offensive and likely productive as far as they go. Unfortunately they are facile or betray a misunderstanding of the processes they seek to improve.

All that said, as they helpfully point out (and I was able to verify) low and no cost AI tools give startups a credible way to keep track of the policy arena without having to sacrifice time on their core mission.

So monitor on startups!

QED

1

Setting the table…

• In probably the most deregulatory Administration in history, I worked in the White House reg. office.

• As an abstract maxim, I have for a long time believed minimizing the aggregate costs of regulations is a necessary condition for maximizing economic growth—for prudential and institutional incentive reasons.

• My office used to be down the hall from the guy who coined “Bootleggers and Baptists.”

All of which is to explain this article’s title is meant to be mildly provocative. And also to hint it is a view arrived at from a very distant ideological origin. But what I mean “regulatory costs” is only within a specific category or condition, which I explain below—not a blanket advocacy for regulatory takeover of the economy. lol

Okay, How Much for a Single Toilet Seat?

For good reason we expect the government to economize wherever possible. Not that we believe it is good at doing so, but given the choice between the Defense Department buying $600 toilet seats and $7,600 coffeemakers or cheaper ones, the American public has a pretty obvious preference.

The infamous coffeemaker was the kind that goes on antisubmarine aircraft and akin to what commercial airlines pay because “you can’t just put Mr. Coffee in an airline.” The price of the other, not actually a toilet seat, was partly an artifact of government budgeting.

So it’s understandable that for years our military industrial base (MIB) defaulted to the cheapest options when it came to telecom equipment and security cameras. After all, they were still fairly high quality and got the job done.

Unfortunately the “price” does not reflect the “cost.” Just ask the victims of 2025’s DC mid-air crash advocating for mandatory ADS-B systems against concerns about the price.

Can You Hear Me Now?

As wireless communications, mobile phones, 5G, and wifi became a necessary part of the economy, DoD had to source all the equipment that makes that possible. When you’re talking about DoD-wide needs, you’re really talking about the broader MIB. Bases, dual-use airports, duty stations, commissaries, and all the contractors and vendors intertwined needed this communications infrastructure.

Except in highly-specialized, unusually sensitive settings it made sense to buy the lowest cost item that does what you need. Which is fairly simple in most cases.

Turned out the equipment best satisfying both conditions by far was all made in China. Chinese companies Huawei and ZTE (and various subsidiaries) ended up supplying most of the telecom tech for this purpose. Why?

• notwithstanding what we know now, they tended to be pretty high quality

• they priced 30-50 percent lower than anyone else

Base stations, routers, switches and much of the adjunct equipment used by our MIB came from these companies—as it does for much of the world. Outside of the MIB context, many rural areas which rely on a few or one wireless carrier were dependent on Chinese tech. Moreover many of these areas are adjacent to bases so it’s a double whammy. Of course it’s not limited to the domestic footprint: we have bases located across the world. Beyond the same integrated Chinese tech, Huawei phones and the like, quite popular in much of the world, were sold in on/near-base retailers. And why not? They were cheap and reliable.

As you may know we eventually learned that much of this technology permitted “backdoors” allowing outside parties to compromise security conditions even to the point of fully taking control.

All because we wanted to save on costs.

Some of these risks were known early on, but not widely accepted and far from universally understood. But cybersecurity risks are not conceptually new, and as I’ve written elsewhere, the specific nature leads to systematic deprioritization in both private and public sectors.

But that’s not regulatory, right?

Rip-and-Replace

Years on with the vulnerability now well-documented, savings or no this could not go on. Something had to be done.

For the government (including military) and all its contractors, the 2019 NDAA’s Sec. 889 mandated a regulation to address this. All federal acquisition is subject to a specific area of the federal regulatory code called appropriately Federal Acquisition Regulation. This is an incredibly dense, unintuitive, specialized body of rules that technically governs all government purchases.1

Most small vendors don’t ever immerse themselves in it because most sub-agencies and offices focus on particular sections of the code and make those available to the types of businesses focused on their specialty. But these rules also include government-wide conditions—things that should be applicable no matter what the product or use. There are security requirements in there for sure, including cases requiring domestic-based vendors.

The thing is…when it came to cameras, the kind used for perimeter monitoring and the like, used at bases and civilian federal buildings, we almost exclusively used equipment from Chinese company Hikvision, with the same backdoor vulnerabilities as the telecom equipment. But they didn’t have that name on the box. Hikvision is an OEM which makes essential components in cameras sold throughout the world by US and European companies like Honeywell, Carrier, and Bosch. Even some of those components don’t have giveaway brandingj, as they’re made for intermediaries and end-sellers using blank or custom branding. Many companies didn’t even know they were selling Chinese-originated products.

So along with the NDAA provision, which required through a rulemaking that all MIB contractors certify they have removed any elements from a list of blacklisted companies from their government-nexus footprint, Congress appropriated $1.9 billion to aid rural and small carriers in replacing their telecom stack. Collectively we call this process rip-and-replace. And it’s as disruptive as it sounds.

In theory the regulation means a contractor could violate federal law, or at least risk blacklisting, by falsely certifying compliance. But there’s no operative enforcement mechanism and no meaningful way to audit. The largest vendors risk a lot so they probably complied in good faith, but smaller ones bear less risk and may be ignorant of the rule.

One shouldn’t hazard a guess as to the degree of remaining exposure of our defense infrastructure, not to speak of the whole government. It’s unknowable. Confidently claiming full compliance would probably come at a nearly infinite cost.

To date there isn’t a fully domestic end-to-end telecommunications stack. The closest is Nokia and Ericsson so defaulting to “American providers” isn’t an option.

Just Own Up to It

I posit a defense of regulatory costs because all of this would have been feasible, and waaaay cheaper, if applied ex ante. The point is that these security costs are real and borne one way or another, either in the explicit recognition in policies including regulatory benefit-cost accounting, or later in painful retro-correction. More costly correction.

Fortunately some of the universal security risks like cybersecurity have become more salient but only quite recently. The story of Anthropic/Mythos - which BTW is still designated a “supply-chain risk” by the Pentagon - is about AI yes but cybersecurity risk in particular. And in an odd way it’s fortunate the risk framing isn’t about a specific vulnerability but a more global notion of cybersecurity risk. That’s a necessary condition for more earnest accounting for it in policy generally.

• It means Congress as it appropriates acknowledges the trade-off of getting less of what they want because they’re actually paying a “cybersecurity markup.” Again, they’ll be getting less either way, and costing it up front is cheaper.2

• It means regulatory analyses face up to the difficult truth of full cost accounting when developing rulemakings. Part of this process involves considering then deciding among multiple approaches (e.g., performance standards vs. design rules) and this should absolutely continue to favor the least costly option that accomplishes the policy aim. But “least costly” still applies when fulsomely acknowledging security risks.

Going forward this is absolutely germane to AI specifically. Mythos and Fable and the ensuing fallout finally took aim at the illusion of gob-smacking innovative AI capabilities will self-correct latent risks like cybersecurity. It could! But it’s not axiomatic. Markets are incredible at arriving at optimal solutions along multiple dimensions: costs, price, availability, aesthetics, and indeed safety. Further, many regulations as designed lead to consumer/business responses which actually inverts the purpose. Think of drivers being more reckless in response to safety features. But some externalities exist and are not foreseeably addressable through market mechanisms. At risk of tedious repetition: the resultant costs are borne somewhere at some point—consumer prices, national security, fiscal costs,…

There’s been a vocal and highly influential cadre of AI policy voices who exhort a kind of knee-jerk rejection of regulation in terms of imposing unnecessary costs on innovators. [Insert misapplication of “regulatory capture” here as one vector of this argumentation] Beyond the demonstrative internal contradictions, fallacies, and logical incoherence in much of this, these risks (read: costs) are already imposed. So think of it as displacing those costs with explicit regulatory costs if it makes it more palatable.

The author is Nonresident Senior Fellow at the Foundation for American Innovation

There’s an old joke about founders: “Big-picture thinker seeks detail-oriented doer to handle implementation.” That is, ideas overpopulate, execution a rare species.

Effective implementation, be it software or policy, is determinative of success. The “doers” have to solve actual problems - technical limitations, resource constraints, maybe marketing, and if it involves a sufficient number of people, inevitably boring organizational management (read: internal politics).

Ever true in government, this is what torpedoes even amazing ideas—failure to navigate the incentives, which we’ll return to shortly.

Data, Data Everywhere, Not a Bit to Sync

Consider data: the federal government relies on gobs and gobs of it from every corner of the country, from individual tax returns to niche corporate reporting in small industries. This data is both a necessary input to government functioning, hugely valuable output for the private sector, and every permutation thereof.

And it’s damn costly.

First off, it’s inefficient. Much of it is duplicative. Overlapping requirements mean the same data is reported to multiple nodes of the Fed. For example, a company hit with a major data breach may have to submit the same information to DHS, SEC, and DOD. Add in state authorities too, each having justifiable reasons to need it.

Pity this poor bank CIO amidst a Code Red hack, getting yelled at by the CEO, trying to make sure they don’t have to reverse a bunch of credit card charges, now also has to not get crosswise with multiple federal agencies. And it’s not like it’s the same form you can just photocopy. Each has a bespoke format and deadlines and so on.

The craziest part is all of this [gestures wildly] is advocated by literally no one.

No less true in more mundane contexts. Remember that old IRS meme?

Inconsistent data fields, duplicative reporting, and guess how all these stores of information get along. Completely seamlessly and without friction? No, of course not!

Every office in every agency has a statute (ideally, ignoring for now) that tells it what to do - or more often tells it to figure out what to do - and for the most part didn’t bother to check what laws and regulations applied elsewhere.

At some point a Congressional committee was ginned up about something and determined to handle it. Say, shark fin sales (H.R. 81 - Shark Conservation Act of 2009, passed as Pub. L. 111-348, codified at 16 USC 1801). Of course they don’t actually descend into the waters and monitor all the cartilaginous fish appendages. They tell NOAA to look into it (50 CFR 600). And if asked, and NOAA can’t provide the data showing progress, Congress might not move on just because the implication is gathering this data from private parties is costly.

Now multiply this over hundreds of times over multiple decades, each one deemed important and each one requiring data specific for that purpose.

The point is the solution is obvious: consolidate all the data across agencies, and make it available to them. So why hasn’t it been tried?

Oh it’s been tried.

There Oughta Be a Law

Congress even legislated it. The OPEN Government Data (2018) is one such example. There’s been some progress but it turned out implementation is more difficult than expected. It comes down a few roadblocks:

1. Everyone agrees the aims are laudable. No one objects. But things like this are simply a low priority, and frankly somewhat boring. From the senior political level, it’s almost never going to be top of their to-do list. Which is to say, they’ll task staff with moving the ball, but not at the expense of other goals. Inevitably this project will come at the expense of something else. At the career staff level, it’s rare this will be the most exciting use of their time.

2. Data fields a normie would identify as identical, at a granular level exist in slightly different forms across the government. Small differences in format, reporting method, estimation methodologies, even coding language make for large frictions to concatenation. The individual agency incentive is to insist: “you should adopt our format.”

3. It turns out privacy is a big deal in this country. Any information applicable to an individual or organization has to be considered in the context of how it was provided and what can be imputed when it’s combined with other information.1 The longstanding cultural bias in government is to err on the side of caution. That’s generally a good thing, but it does obstruct otherwise commendable efforts.

I observed this firsthand, especially #3 during my time in government. An effort to share Social Security Administration info on deceased beneficiaries with Treasury’s Do Not Pay list was stymied by among other things major privacy concerns. Not just risk aversion, real legal risks. The Privacy Act of 1974 and CIPSEA in particular. While the public reporting focused on IT interoperability and formatting, which were real, the behind-the-scenes conflicts were all privacy obligations.

Cybersecurity

As you can imagine, it gets harder when you add data to regulations, but the dilemma is structurally identical. As GAO pointed out recently, even in spite of clear Congressional direction on the matter, attempts to streamline compliance in the area of cybersecurity are met with resistance. I don’t dispute GAO’s findings, that fiscal costs are a friction to implementation. But whereas GAO is not in a position to opine on organizational incentives, I submit fiscal costs are merely a proxy for the interagency incentive alignment problem. Yes legacy computer systems are a real and discrete barrier but these are not the truly binding constraint–we know this because even when Congress provides additional funding the outcome is the same.

While colleagues and I were digging into these issues, cybersecurity in particular, this was a persistent issue. Bipartisan consensus is rare, but not on this. This was not an issue of more regulation vs. deregulation. This was widespread understanding that significant resources were going to a totally unproductive use.

And not for nothing, the country’s cybersecurity was (and remains) woefully inadequate, so this was no small thing to solve.

Who Let the DOGE Out?

Whither DOGE and what’ve they got to do with it?

Well, armed with a seeming disrespect for authority and big talk about technical prowess, on this one problem it was a combination particularly fit for purpose:

1. Data, IT, software, y’know computer stuff…this is supposed to be what they were not only skilled at, but among the best in the world.

2. Afforded a, how to say this, DGAF remit.

So I was in this one case optimistic about DOGE’s likelihood to meaningfully break through the status quo ante constraints, being armed with this combination of expertise and something resembling political immunity.

It’s possible there was some success in this space. But for now we haven’t seen it.

And yet I still maintain the diagnosis of the problem is accurate, and DOGE was conceptually the best chance to solve it. So how do I reconcile that with their failure?

Simple. DOGE didn’t actually understand the problem they were trying to solve. That and/or for all their superhuman pedantic posturing, they weren’t really as well-equipped as they said.

The author is Nonresident Senior Fellow at the Foundation for American Innovation

Didn’t you get the memo?

Last week a House committee hearing looked at AI assistance in the work of the Congressional Research Service (CRS). CRS is effectively a Congressional agency tasked with providing analysis, data, and in-person consultation to Congress-at-large, often prompted by individual (confidential) requests. But their most widely read outputs are the official bill summaries on Congress.gov.1

They’re straightforward, fairly neutral rundowns of a bill’s text used as the starting point for most of the public (and even Congressional offices) to ingest a proposal’s content. Malcontents can quibble, but there’s no implied editorializing or normative subtext to these summaries. And no analysis of budget or other impact.

And yet for some time now, there’s been a long and growing lag between a bill’s introduction and when it’s summary appears.

Sen. Blackburn’s S. 233 went over 520 days from intro to posted summary (not coincidentally the day it reported out of committee). In the AI space, Sen. Young’s CREATE AI Act is without a summary for about two months, but Rep. Obernolte’s version has one—though introduced earlier and now passed by committee (that fact also not yet reflected).

Some gap is forgivable — Congress introduces lots of bills,2 some very long and complicated. Even texts meant to be duplicative (“companion” in leg.-speak) require review before copy-pasting summaries.3 Also the chambers have their own steps to officially record and distribute official text before seen by CRS, and committees making changes are another bottleneck. But it hasn’t been getting better as you’d think with better tech.

In testimony on The Congressional Research Service and the Future of AI-Enabled Policy Analysis, the CRS Director noted:

[U]sing six different Large Language Models (LLMs)[] for drafting bill summaries…[they] failed to meet CRS standards for accuracy, coherence, relevance, and objectivity (less than 3% of 3000 summaries were acceptable).4

I’ll stipulate “CRS standards” are robust based on my direct and extensive experience.5 Regardless of characterization of the standards, 3% does not account for all the {null set} summaries. That is 3% can be accurate within the sample, but a human CRS summary is only any good if it exists, which it does not for much of legislative text.6 An ungenerous phrasing would be that all the missing summaries are 0% accurate.

If you wanted to evaluate a person’s productivity to, say, dig a tunnel by driving steel versus some new mechanized machine, you would need to measure along two dimensions: yes, the length of mountain bored in a given time, but also ability to dig accurately where you intend.

[data]

So granted, a 3% accurate summary isn’t much more useful than a blank page, likely less. But the key is whether it can be applied to speed up the “0%” (i.e., blank summaries) stack. The testimony doesn’t describe the methodology but with such a large sample I assume the AI outputs were compared to existing human-written summaries, not new ones. It was also done in FY24 so no doubt excludes an incredible amount of improvement and useability.

Going forward she notes:

in early fiscal 2026, CRS contracted to develop detailed requirements, technology options, and an implementation plan (including cost estimates and efficiency gains) for the integration of AI-enhanced tools into each step in the bill summary workflow. Based on that work, CRS has a prioritized implementation plan for seven unique AI use cases across the bill summary workflow that, if fully implemented, is expected to provide a significant increase in the number of bill summaries produced by current staff.

Breaking down the production workflow is the right idea. And they should be commended for the work thus far so I don’t want to be entirely hard on them. But they’ve got a lot of catching up to do.

Institutional roadblocks

There are however binding constraints outside of their immediate control slowing their progress.

The “IT guys”

Any legislative office - personal office, committee, CRS, etc. - is restricted in their access to software and other IT assets. The Sergeant-at-Arms (Senate) and Office of the Chief Administrative Officer (House) are responsible for whitelisting vendors and products, including today’s most popular LLMs. Entities within Congress for the most part can’t install or use applications, sometimes even visit certain websites, unless they’ve been cleared. Approved products might include modifications or fixed settings reflecting internal policies.

That some entity does this is understandable. Most of Congress is networked, and sensitive/classified or other high-value information exists throughout. Even non-sensitive information is valuable, and an aggressive DDoS or wiper attack could effectively shut down the country’s Article I branch.

Though it does mean a forward-thinking office is not at liberty to move at it’s own speed.7 Optimally balancing safety with speed (and other dimensions) isn’t easy. As I’ve written elsewhere when it comes to cybersecurity the incentives are biased against security.

Budget

Ever the case, and always boring, but lack of funding is a meaningful barrier here. And I don’t just mean for software licenses. Upstream at the IT evaluation itself, additional efficient and expert staff will accelerate evaluation, allow for more specialization - and because they have the most direct contact with vendors - tailor applications and use cases for legislative work.8

This applies to the legislative staff proper as well. I’ve seen first hand new capabilities actually made available to offices, but without any capacity to scale the learning curve let alone integrate in their own work structure. A super-fast security evaluation doesn’t mean anything if nobody takes advantage. For this and a bunch of other reasons, Congress needs more staff, a point I’ve stressed repeatedly, including in testimony before this very same committee.

In truth, to the degree staff adopt use of new tools and apps, it’s through private use, like at home or on their own smartphone which is most of the time used for work anyway. But again, the scaling up of overall efficiency of Congress only works if it’s widely interoperable. An agriculture L.A. might figure out a way to speed up their own work, which is great, but it’s ad hoc and can’t apply widely.

Norms

As you can imagine, as its a debate happening across schools and offices nationwide, it’s unclear in Congress what the “rules” are with respect to AI. Each Senator and Representative sets the internal rules for their office for most issues: pay, org structure, schedule, writing style, and on down. So they could certainly declare, subject to availability, extensive use of AI is perfectly okay for their staff. But when that work crosses into other offices or the chamber at large, it’s unclear whether this could result in serious issues.

Also there are “shared services” resources that are essential to the legislative process on which every office relies. For example the Legislative Counsel office.

While any member of Congress is free to draft a bill on their own saying whatever they like, they typically request this central counsel office to draft on their behalf. Beyond substantive policy reasons, there are peculiar formatting and syntax requirements which if not adhered to can jeopardize consideration of the bill. But say an office decides to draft it’s own anyway, using a leading LLM. What would the public think? Rep. Lieu actually did this, but it was a non-binding resolution and anyway never seriously considered.

Every bill requires some form of signature from the sponsoring member, so technically they are assuming ownership of the language regardless of origin. But this is not a settled question. The Leg. Counsel office itself would certainly benefit from affirmative use of AI tools as they are always working at capacity and forced to triage requests. But again, are offices comfortable with that?

Actually the largest unexploited opportunity for improvement through automation and AI is in constituent services. Every office devotes significant labor to this responsibility, core to the legislative prerogative. Much of the work is merely intake and info management. I wouldn’t be so offended if an AI agent for instance was the first point of contact for my constituent concern. I suspect most people wouldn’t be so forgiving. Further down the services process, even if a human is the intake vehicle, using AI to record, annotate, store, and distribute info is an obvious value-add of advanced software. Again, how much of the public would be okay with that if they knew, even if it improved service?

In my time I would’ve benefited enormously from auto- or semi-automated reconciliation of various drafts (including proposed drafts used for negotiation). Much of this, which took up a great deal of our time, is properly understood as part of substantive legislating, but it’s primarily the “pre-work” before people get into a room and try to come to a consensus based on their elected boss’s preferences. “I’m still going through the redlines” is a routine holdup to productive negotiation from going forward. While I wish I could offload that task to a computer, I also ponder the degree I would (or should) trust it. Small excerpts of text or a subtle contextual misinterpretation can make for a big effect in policy. If I had mistakenly accepted a proposed change because of software error, and it passed into law….well, I wouldn’t be fired because I’d have already quit out of shame.

[I know the folks at (POPVOX Foundation) and are more knowledgeable and have thoughts on this issue]

My proprietary advice

Don’t assume rules where they don’t exist

The only person that matters is your boss. It could be an LD, a Special Assistant, Chief of Staff, Congressman, or (Acting) Principal Deputy Assistant for Agricultural Whatever. Whatever person is designated as your immediate “boss,” that’s the only real constituent. Whenever you’re contemplating an action or an idea, they’re the only sign off you need.

Sure, sure, “everyone works on behalf of the [President/Congressman/the People]” but I’m telling you in terms of your actual job, not in conceptual toe-standing—the literal tasks as opposed to figurative poetic objectives, only a few of you will actually report to that person.

Why does that matter?

Because there’s no rules! Especially in Congress but even in much of an Administration (except at the very highest levels) particularly “politicals,” almost none of it is subject to hard rules agreed upon by everyone. In Congress, your office or committee may have a written job description (more often not) but that only applies internally. No other office is obligated to listen to or acknowledge you just because you’ve been designated “the office expert on technology issues.”

The incentives for others to pay attention are political1:

1. you happen to be in an office or committee important to them

2. they anticipate needing a favor from you

3. they want to avoid the appearance of a brushback leading to your bosses getting involved2

The flipside though, no other office can stop you from doing pretty much anything.

I’ve seen an extremely junior staffer successfully convene the top people on an important subject from across the institution (almost all more “senior”), facilitate a consensus, and push the policy forward. Why would they show up? Because he invited them, and designated the effort with an official-sounding name, and by implication himself as the leader. There is no officialness-granting body.3

• In Congress, leaderships have some affirmative control, mostly on what gets to the floor for the final, final steps. Anything prior go wild.4

• In agencies, Cabinet-level officials could direct you to halt, but they won’t really care unless it’s getting close to the actionable stage or becomes publicly embarrassing, and even then if it presents as consistent with the Administration’s priorities they’ll be appreciative.

If you can assemble who you think are the essential parties (by expertise, experience, or plain where they’re sit), present as credible and somewhat knowledgeable, and most of all leave an impression of not wasting people’s time, no one will care what your title is.5 And in the best cases, even those skeptical or annoyed by your assumed agency will come on board if it appears you’ve assembled a non-trivial coalitional mass.

But make sure your immediate supervisor is on board, or more likely indifferent/unconcerned. Doing that depends on the personality and specific relationship.

Where I Went Wrong

It’s so easy to assume everything you’re about to do in an organizational or structural sense has been done before. Surely something as important as [X]: has been addressed before/there’s a group of smart people already tackling it/isn’t handled in the way I assume? Often, no. The federal government seems so old and rigid I assumed procedures and formalities existed for everything. And they do for much it—the actual voting and objecting, and publication of a regulation, and….but not how words are put together into a draft bill or regulation. That’s open-ended and I missed many opportunities not wanting to figuratively step into a room and be told “we’re handling it.”

Then one time musing aloud to my Staff Director (i.e., my one actual boss) about “why isn’t there blah blah blah…” to which he laconically replied “do it yourself.” To be clear, he wasn’t giving me permission. He was perplexed I wasn’t able to answer my own question. From then on, I felt free to act independently, only hesitating if I really thought it would cause a headache for him (it never did).

Don’t assume knowledge where it isn’t (yet)

Intertwined with the above, some people by temperament concede too much to fear of looking dumb. I am, well was, one of them. Especially early on, it’s natural to believe other know more than you. They probably do! Yet most people don’t actually care what you don’t know, as long as you don’t present otherwise. Avoid overreliance on it, but simply saying “I’m not sure that means” does up to three things: (1) hopefully prompts the answer therefore increasing your knowledge; (2) puts others in a position to demonstrate expertise, which everyone loves; and (3) characterizes you as humble and transparent in contrast to a performative douche.

No one knows everything, and very few people can internalize disparate and arcane ideas into a cohesive whole. You may not possess all the details, but putting it all together is what makes you more valuable.

Though maybe you really are the foremost expert. No need to go full country dumb but no one likes a know-it-all.6 And you’d be surprised the number of situations where the most demonstrably knowledgeable person in the room is not nearly the most valuable. All of this [*gestures wildly*] is about marrying important issues with informed input and multiplied by the political ability to get others to go along. Interject your wisdom when it’s clearly relevant, or ought to be. Trust me but for a small few, people will quickly read that someone knows what they’re talking about.

Where I Went Wrong

Coming only slowly to this insight I missed scores of opportunities to catch up to the room, and therefore effectively apply the skills I do have. Unfortunately the older you are the easier it is to employ the kind of modesty this requires - the folly of youth is hard to overcome.

• If you are more experienced and established, lean on your personal security and know you are already fairly defined.

• If you are young, use that to your advantage. Nobody really expects you to know all the ins-and-outs of jargony legal speak and the intentionally arcane procedures of interagency deliberation. No one will think twice if you don’t know the practical limits of Senate Rule XIV or can’t off-hand remember the shortest submission-to-public display window for an expedited Federal Register publication.

Staying quiet bit in two ways. I also couldn’t as easily identify who (else) was the expert in the room.

Caution: there’s a calibration necessary here. Humility is never a bad look, but in any repeat game you want to demonstrate credibility. A habitual pattern of not knowing things eventually makes you out as someone of little value. Whatever station you’re at, go hard on this aspect early. The first month or so is like wearing an immunity cloak. This applies to names too: when someone wraps up a negotiation saying “I think we’ve got enough for an answer here, I’ll go run it by Jim Stansel,” ask who that is!

Even things where I was in fact the most expert, insecurity convinced me there was still some element I may get wrong and I’ll get corrected. Who cares? Avoid being the “well, actually” person and it’s fine. No one’s thinking about you as much as you’re thinking about you. The payoff will be positive.

Don’t take it personal

Less an issue for me, but saw it all the time. Someone disagreeing with you is not a personal attack. Someone failing to recognize your insight is not a personal attack. An empirical (or political) truth not in your favor is not a personal attack.

Almost tautological and yet so many people fall victim.

Passionate advocacy and diligent work are fully separable emotional internalization. No one is saying no because they don’t like you - or if they are, they’re doing a bad job, so there’s that.

I’d say a good strategy is be kind to everyone, which I believe, and it makes me a hypocrite. Most former colleagues would describe my professional demeanor as somewhere between “curt” and “a total dick.” The same former colleagues that to this day make up our incredibly close friend group, or were willing to put into writing the highest ratings on evaluations. Because the second-most likely descriptors would be “credible,” “straightforward”, "or “operates in good faith.” My version of kindness showed up as being reliable, scrupulous, and having a reputation of fairness.7

Meh, that can be costly. If you can just go with nice.

“Great, you’ve pinpointed it. Step 2 is washing it out.”

Not being a licensed law-talking guy, and deferring to my colleague James who is the foremost expert on Congressional procedural arcana, I’ll nonetheless outline here an idea for empowering some basic core strength in the ongoing Congressional/Executive tug-of-war. Congressmaxxing we are not.

Congressional Standing in the Courts

Justice Scalia was fond of pointing out that lots of Congress-President disputes are a political issue, not a strictly legal one. That is, the Constitution lays out a political structure whereby plenty of disagreements should (or will inevitably) be resolved by elections, oversight, nominations, heads-up negotiations, appropriations, and something called “impeachment.”

The implication is the Judiciary would do well not to weigh into policy fights that are after all the whole point of politics. “I don’t care if your sister’s bothering you because she thinks you stole her favorite Labubu” a parent might say, “you two work it out.” The court corollary may be something like: “Congress, you weren’t specific and explicit enough in your bill. But that’s not our problem. Pass another bill that’s clearer. We’ll check back in around October.”

By avoiding weighing in on a whole kind of dispute, it reduces the tendency for the Judiciary to become an entirely distinct policymaking machine. The prudential goal of the courts is to weigh in on legal questions proper, which empower the other branches to do their job of making and executing policy choices, through essentially establishing meta-rules which enhance predictability.

So what’s the problem? Sometimes you gotta get your parents’ attention. Or alternatively a third sibling who’s more chill.1

Name That Landmark

Take the edifying but literally nominal case of the National Cultural Center. In 1964 Congress passed a law establishing a national performing arts center named “John F. Kennedy Center for the Performing Arts.” I put it in quotes because it’s a direct quotation from Pub. L. 88-260. It’s not written as a suggestion, or a placeholder. There’s even some appropriations and governance structure.

Yet there seems to be some dispute about what the text of this bill, excuse me, law means. Pending court cases notwithstanding (back to that momentarily), the name above is not the current name of said performing arts center. Or it wasn’t for a spell? I dunno, I haven’t been invited back to perform there in a minute.2

This isn’t an issue of urgent national importance really. Except that it’s a symptom of a much larger problem that shouldn’t be ignored. Congress did its job, speaking in no uncertain terms about what was to be done. There’s no issues of ambiguity, textual this vs. intent that—no “best available” or “in the judgment of” or “based on a study to be issued within 120 days.” No vagueness from which to induce specificity. This is a glorified postal naming bill.

"All persons having business before this honourable court…"

And yet…who has standing to challenge this non-legislative renaming? As I understand it, standing requires a plausible demonstration of harm: that I, the petitioner, am among those injured by this action.

One supposes the Kennedy family maybe could make this case. But then you’re left with an aesthetic evaluation of whether an elongation and insertion of a conjunction to a name does “harm” to the original namesake. That can’t be it.

Some architects and preservationists sued, but that has to do with potential changes from an ensuing closure. As the kids might say, it’s giving side quest.

Rep. Joyce Beatty gets closest, in her filing which points out the renaming is an obvious violation of the law. But it’s actually her second alleged count, behind an allegation about the duties of the center’s trustees, of which she is one. Putting aside how her brief is written like an elongated press release, with all kinds of irrelevant and refutable verbiage, her argument is premised by her unique position as a board member.

What if the law didn't happen to require the board include a member of Congress?

No, the real harm is to Congress. If Congress can pass a law, about which literally no one argues is unconstitutional or interpretively open-ended, then failure to follow it damages the Article I prerogative. It damages the rule of law.

The thing courts are supposed to be most concerned with.

We can apply the same concern to more significant issues argued in other cases: Nebraska v. Biden, West Virginia v. EPA, Sierra Club v. Trump. More recently, one imagines the January 6 fund could be subject to litigation on these grounds–you’ll notice none of the plaintiffs are Congress.3

Wait, Who’s in Charge Here?

It turns out the legislative prerogative extends to the operations of the judiciary itself.

Therefore: Congress, if courts will not do so for itself, should explicitly impose a more permissive rule for standing to challenge Executive actions. No more courtly handwaving about “political domain” etc. (what, is Congress supposed to withhold appropriations…for a thing they’re trying to undo?).

One framework to do so shows promise but only applies to a specific set of authorities – whatever the mechanism it should apply universally. Broadly it would not need (nor would we want) to empower individual members to vindicate Congress’s prerogatives. But just as articles of impeachment are given privileged status (in the House any individual member can effectively force them to the floor, though the Speaker can intercede with a motion to table) so too should such a critical check on a metastasizing Executive power at the expense of an atrophying Congressional one.

Claim #1

Technological disruption has, in the aggregate and over the long run, consistently produced far greater human welfare gains than losses – and there’s no clear reason to expect AI to be the exception.

Every technology throughout history has involved some disruption. These disruptions can upset prior economic equilibriums, for example, but eventually result in (often remarkable) increases in human flourishing and standards of living.

The industrial revolution was met with resistance from some quarters facing the risk of losing their economic rents (particular occupations, perhaps political coalitions built around a specific economic ordering). Some of this resistance is understandable being that it stems from uncertain change to a known economic and social arrangement. Some jobs are inevitably lost; some patterns of behavior and lifestyles are overturned.

But we need to think in the aggregate and long-term. Every example of a productive technological innovation - unproductive ones eventually disappear without entrenchment - leads to increases in overall human welfare, sometimes incredible increases. Mechanizarion led to a collapse in value of some skills. But broadly led to better fed, longer-lived, more creative people through increasing productivity and flowering of specialization.

AI looks like a tsunami of change breaching our shores, but the history of proliferation of new ideas is overwhelmingly positive and we should (as a moral or utilitarian or democratic matter) want the most people to do the most well.1

Claim #2

Regulating AI now means legislating under a high degree of uncertainty about a still immature technology, risking that today’s incomplete understanding gets locked in as tomorrow’s obstinate steady state.

New policy tailored specifically toward addressing perceived risks of AI would be premature: we’re legislating in the dark. There is so much uncertainty about breakthroughs around the corner; we don’t know the implications. Attempting to structure policy schema based on what we know right now is effectively backwards-looking – under the best conditions it will wrap around yesterday’s understanding and choke off useful discovery, foreclosing maximal social benefits.

While we observe leaps in AI capacity and uses all the time right now, we are functionally at the adolescent stage of this technology. It would be as if 1970s biologists, confronting the then-totally novel recombinant DNA technique, had been locked into restrictive practices based on the most pessimistic risk assumptions – before anyone understood that those rules were unnecessary. Instead, the field governed itself first through evolving voluntary guidelines, with formal regulation following only once more was understood. Within a few years, that same technology produced synthetic human insulin, ending the reliance on animal-derived insulin and increasing access for millions of diabetics.2

Claim #3

Frontier model development draws on the same kind of openly available, generally applicable math and science that the US has always treated as basic research – and basic research is not something we regulate.

Regulating AI development at its core would effectively regulate fundamental scientific research. Discovery around models is a kind of basic research. Not basic in terms of simplicity, but as a term of art referring to the pursuit of intellectual curiosity which leads to the expansion of general knowledge. In US policy, we support this mode of research through favorable tax treatment and public funding. The reason is this kind of core scientific inquiry doesn’t always have obvious commercial applications but in the aggregate benefits everyone by expanding our base of knowledge – sometimes in fundamental ways.3

We regulate pharmaceuticals, but the process of developing specific medicines is built on basic research in biology and chemistry. Understanding protein structure, behavior of genes and genetic mapping, cell signaling pathways, all feed into eventual treatments for specific pathologies. But we do not regulate the former because it is generally applicable knowledge creation that benefits everyone.

The math behind frontier models is akin to this kind of discovery. Data science, linear algebra, information theory, physics…these are among the elements that feed into model development. And they’re all available to anyone (i.e., academic journals, public code repositories, etc.) even if not everyone would be able to understand them. We’d be, if even unintentionally, attempting to regulate “science” in a way that (1) we’ve never done before, for good reasons, and (2) could foreclose some of the most exciting and beneficial discoveries in human history.

Claim #4

AI models are general-purpose tools that only cause harm through a user’s malicious application of them, and existing law already governs that nexus of bad actor and bad act.

Technology is a tool–it is neither good nor bad. Uses are what we should be focused on. ChatGPT, Claude, et al. are general purpose in nature. They don’t intrinsically present a harm - new in type or otherwise. Like an internal combustion engine, which can be used to inflict horrific harm on others by a driver when assembled together with other parts into a car, the model itself is dependent on a dangerous user and harmful application to inflict harm.4

There is risk of misuse, and that concern is legitimate and deserves to be taken seriously. But that is a different consideration than attempting to reduce harms via development regulation. Even outputs that might appear suspect on the surface can be used by well-meaning users to prevent harm, by better understanding for instance cybersecurity vulnerabilities. It’s at the nexus of a malicious user and execution of a discrete act where laws are best understood to be appropriate.

Sub-Claim

Existing laws do more of the necessary work to deter harmful acts that involve AI than you think. The vectors of harm are not fundamentally changed by the existence of AI. Employing AI to commit fraud, theft, assault, or any other form of illegally harming another person are and should be equally prosecutable under the law as though they were committed by other means. There may be some tweaking of current law (consumer protection and so on) to ensure these acts are not excluded for technical legal reasons, but this is categorically different from adoption of a whole new legal regime allegedly addressing novel protections.

Claim #5

A fragmented, fast-growing patchwork of state AI laws is a more immediate threat to innovation than any AI harm itself, and only federal preemption can resolve the underlying collective action problem.

The most immediate and salient policy risk we should be concerned about is unrestricted proliferation of new state laws. Beyond the reasons stated above, even the best intentioned and knowledgeable legislatures leads to an unworkable morass of laws in the near- to medium-term. No innovators will be able to ensure compliance with all of them–already there are some 1,200+ bills pending in state capitals.5

The interest from state legislators is understandable, but there’s a collective action problem. Even broadly aligned policy goals between states will be undermined by the lack of incentive to reconcile granular details which may appear minor, but will result in significant regulatory costs when applied broadly. This is not even to speak of whether the laws themselves are well-designed.

The nature of software, the internet, and modern communication modes means there’s no practical way to withdraw from particular state jurisdictions where the legal structure is unworkable. An ill-informed law in one state becomes a problem for everyone.

We are at the takeoff phase of this incredible technology, but we risk throwing debris onto the runway if we do not address this problem. Which is why a federal law is necessary to solve the commons problem by preempting state AI law. It’s the only way to rationalize policy at a critical moment for this emergent technology.

I welcome thoughts on how I did.

I’ve omitted some other recurring arguments in the above direction, mostly for space and because I find them the least compelling. For example:

• Definitions and other technical elements of these laws, like the CA one, even for their own intent don’t capture the relevant aspects they want to. They are not informed by the most sophisticated practioners and end up using irrelevant, naive metrics. Further they are inflexible to a dynamic frontier.6

• Regulation, especially targeted at the model development layer, will only serve to support large incumbent entities, at the expense of newer, smaller, arguably more innovative startups. Regulatory capture takes hold, and the incidence of fixed regulatory costs disproportionately hits smaller innovative companies.7

I coudn’t bring myself to attempt an earnest defense of these because anything beyond a sentence or two become so obviously obtuse it felt like an unfair handicap to this exercise.8

In other words, it predictably backfired.

But one element I did not address, is with the stated policy goal itself which has now reared its head in the most obnoxious way in the form of the Fable export control intervention.

To catch up: the Department of Commerce insisted Fable be disabled for all foreign users based on a national security risk, which effectively required Anthropic to disable access for all users.

I didn’t predict this exactly, but directionally it's not surprising. Especially with this Administration. I did note:

Moratoire ≠ Laissez Le Bon Temps Roule

I characterize the pro-moratorium model as thus:

• The premise: advancements in AI are moving so fast, here and around the world, and innovation, if allowed to continue apace, can deliver incredible benefits for humanity.

• The problem: states are rushing ahead with thousands of misguided laws and regulations that impose unnecessary costs without commensurate benefits, further compounded by inconsistencies and complexities across the 50 jurisdictions. It’s impossible for innovators to maximally do good work while navigating this policy thicket.

• The solution: Congress should pass a law that prevents unproductive non-federal laws via Article I’s preemption authority to maintain a favorable national policy environment, for up to 10 years.

This is a simplified but I believe fair narrative characterization.1 I’ve omitted from the solution their call for an affirmative federal governance law. I’ve run through in the same earlier piece why an actual substantive policy framework was never legible, and therefore undermined its credibility. So it doesn’t need to be reckoned with here. I’ll add to earlier arguments though, there’s no structural reason an actual federal framework couldn’t pass alongside - in the same leg text - the moratorium language (of course obviating the need for the latter, so…).

Taking this premise/problem/solution structure at face value, the solution was never going to result in what they actually wanted, at least not fully. New laws, federal, state or otherwise, yes change the status quo and very often interfere with otherwise effective market institutions. Yet even poorly designed laws, when stable, can be adapted to by market participants in nearly optimal ways such that further changes should be very carefully considered because they are likely to make an imperfect situation worse.

But an absence of laws does not mean an absence of policy. As I noted in a testimony, using an overwrought metaphor: policy energy will move but rarely destroyed.

You Didn’t, So I Will

Administrations have always exercised their regulatory authority, increasingly in the last few, to apply old laws to new circumstances. This Admin in particular has been, let’s say, extremely creative, in squeezing new policy toothpaste from old tubes. This is a White House that apparently seriously considered widespread suspension of habeas corpus. Consider tariffs under IEEPA, removal orders under Alien Enemies Act, and others, some much more narrow in scope. And those are ones asserting substantively new authorities from extant law. You could multiply the list several-fold if you include potentially defensible authorities effected through categorical neglect of required procedural requirements (DoD’s designation of Anthropic as supply chain risk, also Commerce’s export control order for the same, fall into this category).

It didn’t start in 2025. Under Biden, some of the COVID actions (CDC’s eviction moratorium, OSHA’s vaccine mandate) and student loan forgiveness under HEROES Act, all resemble the same Executive application of laws beyond plausible authorities.

If you assume the current Executive is favorable to you, it’s not unreasonable to assume this isn’t a risk. But it’s always a non-zero risk. No one can say, “we had no way to know how mercurial this President is” – it’s a second term!

There’s no way to know the specific path of AI development, and therefore how different implications will assume salience or irrelevance. But again no reasonable person should credibly claim it will be predictably linear and therefore a straight extrapolation from the current moment. In fact the premise of both utopians and doomers is that this is a transformative technology, not repetitive to prior ones.

An affirmative law, or several which together make an effectively comprehensive federal governance framework, can mitigate much of the Knightian uncertainty of the policy environment. It won’t eliminate Executives from eisegetical statutory interpretation. But it can fill a negative space and simultaneously suppress prior law which almost certainly is less suitable.

In the absence of such a suited-for-purpose federal statutory framework, we have today’s latest contretemps. Even if Anthropic is able to seek remedy through court or negotiate a favorable resolution with the Admin - and I’ll be sympathetic to anyone arguing otherwise - this is a decidedly worse environment than most any plausible suboptimal Congressional deal.

Even with an affirmative statutory framework defining the sidelines of the policy space, could an impetuous executive still take the same action? Sure. But again it would reduce the likelihood and strengthen the argument for courts to overturn (which is admittedly not costless in any case).

We Find for the Plaintiff

The President and hyperactive Cabinet Secretaries are not the only risk. An emerging cohort of lawsuits are using existing law to assert harms. Under fairly plain vanilla state consumer protection laws and the like, leading labs may be eventually subject to really onerous precedent.

If the plaintiffs are successful, don’t assume it’ll be any easier to modify those laws in a more favorable way ex post. An already unpopular industry, having been characterized as the “new tobacco” by crusading state politicians or entrepreneurial trial lawyers will see to that. Constituencies will not find much sympathy for eye-popping jury awards, even if there is a compelling argument they are misguided.

Even if plaintiffs are unsuccessful, months or years of pernicious discovery will serve as an interim win. There’s no version of a case which gets past summary judgement that doesn’t disadvantage the reputation and possibly actual operations of the defendant. One does not have to jump to conspiratorial speculation about “smoking guns” or the fabled magic memo proving unscrupulous behavior. Good faith and free-flowing communication between employees will always reveal something exploitable as leverage in a future fight.

Nature Abhors a (Policy) Vacuum

Dean Ball characterizes the current policy node, the one reflecting the Fable 5 action, as effectively existential to the industry. He lays some contributory blame on Anthropic’s behavior, which he argues was avoidable. But he was down this road going back to the Pentagon action.2

So with the benefit of hindsight, if we accept Dean’s characterization, we ended up at a much worse non-stationary equilibrium, whereas we could have moved towards a suboptimal but better one with more stability with a broadly applicable sensible federal law. Almost any law that was not limited to “10 year moratorium.”

I say benefit of hindsight. Fully concede where we are today was not foreseeable ex ante. But that’s the point – to reduce the decision space, reduce the uncertainty, and try to drive toward a stable policy environment that, hey, may even be Pareto improving. And even industry responses to unproductive rules can be welfare-enhancing.3

“I can still hear you saying you would never break the chain”

Recently I got caught in a rabbit hole on the Fleetwood Mac album Rumours. One of many stories goes, while Mick Fleetwood was in the control room doing, uh, some important business accounting (your mileage may vary), Stevie Nicks wandered off to the “Sly Stone” room to noodle some ideas. There she assembled a rough version of “Dreams,” which would go on to be one of their biggest hits (back then, and again 48 years later because our pop culture engine stalled out and everything is recycled, and…nevermind).

Congress is like Ms. Nicks back then, before she got into the tex-mex restaurant game of course. She had proven her mettle as a singer, and already had respectable writing credits. The dynamics being what they were, the nominally co-equal women’s contributions were routinely sidelined. Nevertheless, she persisted, and asserted creative agency.1

Perhaps newly freed from her relationship with Lindsay, she wasn’t discovering creative power, she was re-discovering it.

Congress increasingly acts as if the Executive Branch is the bandleader and thems the rules. Quite the contrary, Congress is perfectly capable of grabbing the mic.

We treat statutes as the thing Congress does, and regulations the thing the Executive does, two distinct domains never the twain shall meet, each flowing from its own Constitutional wellspring. But one is theoretically begat by the other. It’s worse than that. News reports routinely speak of “a new law” when describing Executive actions, further conflating the direction of the policy birth order. Even worse is Executive Orders are now characterized by default as changes in law [sigh].

You did this to yourself, Congress. I’m not mad, just disappointed.

“Well, I’ve been afraid of changin’ / ’Cause I’ve built my life around you”

From the POV of most individuals and businesses this all tracks. Our Cali-cuisine restaurant doesn’t particularly care whether changes in healthcare requirements are the result of regulations or statute–I just know I better comply with “the law” (and maybe my HR company says they’re waiting on the “new rules” to update me).

The argument that Congress is not in fact co-equal with the Executive, that placement in Article I of the Constitution is an ordinal choice and not the result of drafting randomization, we can take as stipulated.

And we’ll forgo arguments around limits of delegation because wherever that line is, it won’t matter for the following: Congress should in-source agencies.

The whole conceit of delegating policymaking work to the Executive agencies is they have all the personnel and expertise. Well who do you think funded all that? In most cases, who do you think even created the dang agency?

That’s right: Congress, you should create your own Article I agencies.

Don’t be humble. You’ve done it before. We use different nomenclature: Office, Library, and Service. If you can routinely defer to entities in a whole other part of town, reporting to a whole other elected official, to “fill in the blanks” (i.e., substantive policy decisions that are binding on the public with the force of law), you can very well keep that work in house.

If you’re squeamish about “unelected bureaucrats” making decisions on behalf of the American people, fine, check the Congressional agencies’ work by having some approval mechanism, say this thing called “voting.” Codify their blank-filling exercise. Although again you seem perfectly fine with having little to no say of the same thing being done by people at arm’s length over whom you have no direct authority–only attenuated appropriation and occasional authorization acts.

So if you like, call it replacing their unelected bureaucrats with your own.

“How can I ever change things that I feel?”

Testifying in Congress a couple years ago2 I made the totally unoriginal point that they need more staff. Pick whatever baseline you want, by any measure Congress (personal office and committees) has fewer staff to do what literally no one would disagree is a more complex job. Whether it’s the novel issues now added to the old ones, the larger constituencies, or the impenetrable tech, the work is more difficult and Congress has less of the wherewithal to handle it.

The committee chair acknowledged this point but lamented that increasing funding for itself is a hard sell for Congress. Fair. But the funding doesn’t have to be additive: it should be a transfer from the Executive to Congress. It’ll take some explaining.3 If Mick Fleetwood can forgive the guy who had an affair with his wife, you can do this.

Let me anticipate three possible retorts (beyond the political sales job):

1. These existing Congressional “agencies” are not policymaking entities; they are advisory bodies.

   What’s the difference? Congress gave the Executive versions their mandate. And while I would, for instance, be clearer about GAO’s remit and proscription of duties, Congress in many cases laid out extensive functions, structures, restrictions, and funding for incredibly Byzantine organizations (personnel reaching into the hundreds of thousands, even omitting DOD and USPS). Personally I think very highly of much of the federal workforce, but there’s nothing magical about their dedication and expertise tied to where they sit (Constitutionally speaking). And if you don’t think so fondly of that workforce, well, leaving it for someone else to directly oversee won’t help.

2. Very complex, detailed regulations deserve public input, i.e. the APA, a fulsome public comment process, etc.

   Maybe this isn’t a likely objection. But in case it is, I should reply with “uh, what?” The APA in its very core is an endeavor to retrofit a legislative mechanism to a legislative function carried out by a non-legislative branch. The whole conceit is based on a syllogism: If we the lawmaking body are to hand over (delegate, in “law talking guy” terms) lawmaking authority to the Executive, then to do so they should follow a process (hopefully) approximating legislative input from the public. It’s all just a means to bootstrap constituent input and accountability – Congress is already built this way. There’s no need to scaffold an APA onto itself.

3. The Executive is supposed to administer the laws. This would usurp the Article II prerogative. Is Congress supposed to command the military?

   Not a modest proposal to be sure. But it does have its limits. Congress doesn’t have to assimilate the entire agency infrastructure.

• Printing and mailing Social Security checks subject to the rules set by Congress? That seems pretty administrative to me.

• Investigating and apprehending human traffickers, as defined and subject to penalties set by Congress? Again, squarely in the administrative purview. Nobody wants a Congressional FBI.

• Housing and preserving founding documents, while I never thought would invite political controversy, is otherwise fairly policy-invariant4

• National Arboretum? Knock yourself out.

But for example, determining the contours of the hemp legalization shouldn’t, and doesn’t require, Congress laying out bullet points and expecting the Department of Agriculture et. al. to figure out workable details (Chevron or no).5

“Yesterday’s gone, yesterday’s gone”

People much smarter than myself, inclusive of judges and scholars, have wrestled with this esoteric and complicated question of how to functionally delineate between and Article I and Article II authorities. I wouldn’t presume a practicable answer is an obvious one. Instead consider things were not always as we see them now. And there’s no convincing argument that Congress is precluded from taking (rather, reclaiming) more agency for itself. In limited ways we already see the evidence.

“Why don’t you tell me what’s going on?”

Much of administrative law, Chevron, Loper Bright, et. al, is an ongoing dialectic on the granular meaning of laws passed by Congress and the President’s interpretation thereof.

What’s implicit for all of it is that unless a statute convincingly conflicts with the Constitution, the lawmakers in fact get to write them.

It may feel unfamiliar, technical details and assuming ownership and all. It requires a start. I’m reminded of the weird title track from Fleetwood Mac's Tusk. What started as a four-bar soundcheck riff ended up a double album involving Dodger Stadium, tissue box percussion, and a $1.4 million production budget (ed. in that economy?!).

Perhaps not the best example. The point is “time makes you bolder, even children get older.”

It’s a time-honored tradition in Washington. When a politician of sufficient fame (modestly speaking, not like Hale Boggs fame) prepares to leave office voluntarily or not. There’s a rote press regimen premised on “[Insert Name] Finally Lets Loose.” These tend to be a little more nutritious than other political calories like the obligatory candidate memoir because the incentives are different. If the retiree intends to stay in town as a lobbyist, power broker, or media personality, they can calibrate up or down but it’s all a matter of degree.

In spite of knowing that, I had hoped for more from outgoing Sen. Thom Tillis (R-NC).

Good tsar, bad boyars

His outspokenness in the last year is part of what contributed to putting him on POTUS’s naughty list this cycle. His criticisms of the Administration having already been in fourth gear, one thought post-primary he could really redline the engine.

But what we got is more cruise control.

He previoisly yelled at a DHS Secretary, shaded a DOD Secretary, and otherwise criticized an Acting Attorney General and FHFA Director (all of whom he voted in favor of confirming, although not likely again).

Up to this point his very pointed complaints, including in-person confrontations, were limited to any official with the job description “not Commander-in-Chief.” And explicitly so, going so far as to clarify his beef is strictly not Presidential. In a recent exit interview, Tillis made clear he blames Hegseth and not Stephen Miller on misinforming the President on the Iran War, after calling for Miller’s firing [checks notes] two months prior.

Above all, he insists, he does not blame Trump. As he explains:

“Do you really believe that the CEO of a Fortune 50 company can possibly know everything that there is to know about running that company?”

Certainly not. The head of a large enterprise by necessity has to delegate. They can’t possibly stay on top of everything.

Like if the company undertakes a violent immigration crackdown, exfiltrates a foreign head of state, or declares war (excuse me, “a little excursion”) on Iran, the CEO can’t get bogged down in all that. That’s why you have middle management.

If an interim general counsel puts together a $1.776B compensation fund for victims of corporate malfeasance, you can’t assume the CEO knew anything about it (even if the boss is really big on semiquincentennial branding).

UPDATE 2: Fortunately Tillis’s “got a positive predisposition towards” that particular attorney.

UPDATE: On ODNI Acting Director Bill Pulte's reported firings: “it’s going to be another hot steaming pile of DOGE shit.” No mention of whether he believes this rises to the level of “CEO” needing to be made aware.

Or…we’ve got a good tsar, bad boyars problem. If you prefer, a “naive executive phenomenon” [derogatory]. This refers to the subterfuge insulating leaders of Russia to varying degrees for 500 years, whereby the “CEO’s” power and popularity is maintained by always blaming the advisors for the people’s suffering, of which Ivan the Terrible or Putin or whomever is unaware. It’s also the premise of the hilarious movie The Death of Stalin.

At some point you’ve got to realize your message isn’t saying what you think it’s saying. And if this is YOLO behavior, I’d suggest you need to increase your discount rate.

Drunken Master

I entertained the possibility that Tillis was employing some jiu-jitsu, drunken master kung fu move to criticize the President in a clever indirect way. Kinda like that “Everyone out!” scene from Austin Powers in Goldmember.

Please tell me that’s the case. I want to believe. A real-time Straussian reading of the text!

It’s unclear whether the press corp dutifully quoting his characterization of the J6 fund as a “payout pot for punks” and that he solely blames DOJ apparatchiks understand the irony or not. I’m resigned to think they’re just providing a “pusillanimous platform for…” what were we talking about?

The gloves come off

The idiom refers to boxers removing protective gear as a metaphor for a full on (figurative) fight. But boxers also take their gloves off when the fight is over and they exit the ring.

To be fair, there are justifiable political reasons to stop just short of direct confrontation with President Trump. To the degree there are still policy priorities worth fighting for, like state disaster funding, one wants to avoid doing any permanent damage.

But ad hominem attacks on wayward advisors, who by your own conceit have the President’s ear, have likely already done the damage. If you’re in your YOLO phase, might as well go hard in the paint because you won’t come back from this.

Unless you do.

All I could do is shrug and think, same as it ever was.

Companies market, tech bros gonna tech bro, and from the origin of myths themselves, thru Stanley “the Rattlesnake King” Clark (the originator of “Snake Oil”), to Lyle Lanley’s genuine, bona fide monorails, to today, outlandish or maximalist claims are a time-worn razzle-dazzle way to break through the din and move units. Especially in a product cycle with a high implied discount rate.

I don’t know whether the claims about Mythos are true, any or all of them. Multiple things can be true at once–and a person, say a frontier AI model developer, can honestly believe their latest model is a remarkable threat. That claim is neither refutable nor provable ex ante, so there’s some filling in the blanks from those best positioned to know. And maybe it doesn’t hurt that whether epistemically valid or marketing schtick, it all makes darn good copy.

And it’s all beside the point. I’ll return to this in a moment.

How to blow up a nuclear program

Couple years ago I took part in what we in DC called a “tabletop exercise” (what normies would call “a discussion”) on what the path of AI advancement tells about the likelihood of a weaponized nuclear Iran. It was convened by foreign policy, military strategy, and technology experts. Again this was a couple years ago, which might as well be decades in Trump Standard Time, or DOGE-years, or whatever. Since then…a few things have occurred.

However the exercise was useful in clarifying still pertinent questions for modeling this issue. Two in particular are worth mentioning. Knowing these two parameters go a long way to knowing whether AI would enable Iran’s nuclear capability faster than we could prevent it.

There’s a lot of other reasoning that explains how we got to these questions, arrived at decisions, gamed things out, and all laddered up to the macro question. There’s a paper somewhere I think that gets into it.

The only thing that can stop a bad guy with an AI, is a good guy with an AI

Faced with breathless exclamations of AI-midwifed doom, cries of “won’t someone please think of the children,” and general techno armageddon-ry, the e/acc crowd frequently retreat to the axiom, “Technology is a tool. It’s neither good nor bad.”2 I’ve said it in media interviews myself.

Except it’s not always true.3 Some technologies, well not bad per se, only have a purpose that runs one direction in the first order effect. A missile for instance has only a destructive purpose. There’s no benign ICBM program (unless it just doesn’t work). Of course we use that missile for a larger purpose, like deterring worse destruction by an evildoer. The point is not everything is so fully neutrum ex nihilo.4 (Woody Guthrie even accused his guitar of homicide)

But we don’t have to be so obtuse. Seemingly every frontier model release precedes stories of developers befuddled by some emergent capabilities and “behaviors”: new modes of deception, shutdown resistance, and so on. Sure these things are not altogether “bad” - deception has productive uses - but it’s akin to the contractor discovering their missiles actually fly further and are much more explosive than they planned.5

And it’s all because, getting back to the Mythos conundrum, the Iron Triangle of Painful Tradeoffs (second only to the Conjoined Triangles of Success in triangle-based business models). Whether we label one of the corners “safety,” “reliability,” “security,” or “predictability,” shortchanging that bucket results from plain old incentives.6 Indeed, “move fast and break things” is just a reflection of ignoring that corner of the triangle.

The stochastic nature of LLMs, those surprise discoveries, means potential vulnerabilities can remain unseen without investment (including time) into discovery. Notwithstanding the user’s intent, an otherwise neutral aspect of a model is effectively a vulnerability (ex: not testing the missile under certain conditions). A company doesn’t have to willfully ignore a bug, because it’s less profitable to discover if there even is one.

Safety in this case isn’t like putting a bigger bumper on a car–it’s not even knowing where the bumper goes.

You see it all the time.

When’s the last time you read through a data breach notification? Even noticed one? In the ante-ChatGPT world, the nation’s cybersecurity was already woefully inadequate to the degree that major and constant breaches are treated like the cosmic background radiation of modern commerce. Yes, yes, the optimal number of almost anything is not zero. So insurance structures emerge, tort law adapts, people die in car accidents, and the world keeps turning.

Besides, if it was really such a problem, says my imaginary male interlocutor made of straw, it would be a huge market opportunity for more secure software–the numbers may seem big but the market tells us they’re smaller than the unseen benefits. Plundering the info of 192 million UnitedHealth customers isn’t that big of a deal is it? – the IT department probably had other mission-critical priorities. Plus you can improve security through numerous services and products. Except now even those are hacked (see, Solarwinds, Okta, Crowdstrike).

Let’s not be so precious. You can spin a plausible story to explain almost all of it away that goes “...something something revealed preference” or “market discovery process yadda yadda.” But don’t tell me hacks disrupting over 40% of the East Coast’s fuel supply (Colonial Pipeline), leaving 240,000 people without power (Ukraine), disabling potentially every Windows computer (WannaCry, incidentally stopped by a 24-year-old who happened to check in during vacation, himself previously a malware-ist), or its reprise the next year that disabled TSMC (the world’s most important chip fabricator), are all part of a system working. Perhaps I tend to overindex the impact of compromising 22 million feds (OPM), having been one.7

I’ll concede the disruption at over 3,000 colleges “preventing” students from taking finals may be a net wash.

It’s not surprising. It’s the incentives.

Not mustache-twirling execu-villains plotting to release dangerous software on the unsuspecting people of Gotham. Not even an unscrupulous non-mastachioed executive. Just a product manager telling a normal executive, “given our time and manpower, there are no known vulnerabilities in this build.”

Because finding bugs is hard! And thus expensive! And super boring (probably, I failed Intro to BASIC).

Until Mythos, we are told.

Mythos and its successors don’t have to live up to the marketing hype. But very well could. It doesn’t matter either way for making our world safer.

Addendum: On that whole incentives thing, it’s also asymmetric with respect to the exploiters and the exploited. You see, if I’m the proverbial bad guy with the [weapon], the marginal expected return on my efforts to find exploits is almost always higher than the good guy to find and defend them. And if this AI is really as good as they say, the barrier to entry for bad guys just got much lower.

“[P]eople who have been unbelievably successful in one space, therefore thinking they have totally figured out another world that is totally different.”1
- Anonymous, reading Silicon Valley’s foray into politics

[Disclosure: I was previously a registered lobbyist on AI and related issues, including in-house for an advocacy group opposed to the proposed moratorium. Earlier I was involved in the first ever AI Executive Order as a White House employee.]

“All failure is failure to adapt, all success is successful adaptation”2

What would be the optimal strategy for a coalition of AI companies and investors seeking a national policy conducive to innovation? In the case of Little Tech/Leading the Future, the play was a single federal moratorium on non-federal laws.3 Having thus far been unsuccessful in codifying the first goal, though with intermediate success in an Executive Order to that effect, I was prepared to argue the optimal strategy would focus primarily on the state level.4

Turns out they agree. While drafting this piece, Politico published a feature outlining the explicit strategy to do just that. Nonetheless let’s explore how I and they got there.

Read the room because it gets a say

First they failed to realize their creatio ex nihilo policy may have been substantively optimal but strategically misaligned. They’d have to acknowledge that this is not a static environment but a dynamic one with multiple players. With some backward induction they’d anticipate that even “in war the loser gets a vote.” That is, the Silicon Valley mindset of “0 to 1” doesn’t account for naysayers and objectors, but politics does (to be fair, even sophisticated AI models have trouble with backward induction leading to the “turtle trap”).

Personally I discount the recent surveys and commencement speech theatrics indicating a strong resentment of AI proliferation. Like former colleague Evan’s point about distinguishing between stated and revealed preference, my guess is these data points also reflect an unresolved tension between the two. Still it’s a long leap to characterize the current popular sentiment as overwhelmingly positive. And after all, stated preferences feed into political incentives. So the strategy of coming off the top-rope with a decadelong Frankensteiner was not going to land in a receptive political arena, even with a friendly White House.

Which means arguments for such a law even if in good faith would meet significant resistance.

For instance, the core message that a “patchwork”5 of State laws risks an unworkable barrier to innovation may be true (I have doubts), but it’s incoherent alongside anecdotal evidence we see everyday. Again from Evan:

Here is what companies are doing under conditions they argue are an existential threat. AI hyperscalers are spending hundreds of billions on AI infrastructure. Venture capital into U.S. AI startups hit $211 billion in 2025, up 85% from the prior year. The total value of U.S. unicorns nearly doubled in 2025, from $2.4 trillion to $4.4 trillion, with AI startups driving the surge. OpenAI alone hit a $500 billion valuation in October, becoming the world’s most valuable private company. None of this is what an industry being strangled by state regulation looks like.

Weeks later, already out-of-date.

While drafting this sentence, another AI chip maker IPO’d to $5B+ market cap while the implied valuations of others continued to increase (SpaceX, OpenAI, and Anthropic all sprinting toward record-setting IPOs as well).

Of course in regulatory economics, one must acknowledge the invisible cost to future innovators: the garage-tinkerers (ok, WeWork vibe-coders) and college senior capstones, not just the big movers right in front of us.

[ed. This might be a good time to point out that at one time or another, the following companies officially identified as members of the Little Tech coalition contra Big Tech (Facebook, Google, et. al.): SpaceX ($1.75T), Palantir ($312B), Anduril ($61B), Scale AI ($29B after acqui-hire by Meta, unclear if they returned their decoder ring).6 Also funny, one of those companies ran ads against a Congressional candidate attacking him for…previously working for that company, which may be backfiring. Points for self-awareness?]

To the degree we observe binding constraints to AI development, it’s pushback on data center construction. That’s a knot a moratorium can’t easily untangle as it’s tied up in hyperlocal NIMBYism, zoning, energy costs, environmentalists, and so on. Not overzealous state AI laws. The other element that reads to me as significant are a growing number of lawsuits, again not attributable to new state AI laws. They certainly do not point toward lethargic deployment of technology.

“Say what you mean, mean what you say”

Let’s concede that it’s a sincerely held belief–state regs are existential–because of effort, cost, and political alienation. But it also tells us, because all policy is future-looking and there’s no apparent state-level binding constraint right now, that their optimal solution is moratorium full stop.

(ed. Brood X would be a pretty boss tech company name).

Nods toward a national framework after establishing a moratorium were never credible to most people.7 The decade-long window was also what we in the industry call “a tell.” This technology which they often characterize as transformational, world-altering, with major geostrategic and national security implications, hence the urgent need for a hothouse policy environment, simultaneously requires a 10-year window? That implies a fairly low discount rate in an industry more frequently characterized by more…hyperbolic rhetoric.

Before the fabled birth of the great god Mythos, it was difficult to parse specific elements making up a hypothetically workable national governance framework. For example, an identified onerous requirement of one state law (the big one) is compulsory incident reporting. At the risk of talking my book, one element they might consider is a federal AI incident reporting system - no patchwork necessary. Compliance still too onerous? Well you’re in luck because it’s totally voluntary (“...now 100% mandate-free!”). Let’s just say there was no purchase among the moratorium-ites when developing a legislative proposal with Congressional offices. If your starting point is: “many transparency proposals we think are probably unlawful, they probably violate the First Amendment, and are not particularly useful for consumers,” I wouldn’t expect there to be. I’ll concede he’s referencing mandatory safety assessments; the point remains - unwillingness to engage on even de minimis governance doesn’t buy you credibility.

Later in that same conversation, having insisted any new laws should regulate uses and not development and uses can be largely governed by existing laws, they explore an analogy to another frontier technological arena:

“it’s not okay to develop a virus that could cause a global pandemic and then release it into the world to cause a global pandemic….[M]y assumption is that is unlawful and should therefore be penalized.”

What does he suppose is the appropriate penalty? While I don’t worry too much about catastrophic risks, he’s opened a door to a particular syllogism leading to a specific policy problem.8

And by the way, gain-of-function research is closer to the “development” category than the “uses” one.

Suppose the same thing happened here, unintentionally. What’s the sufficient sanction for a mistake resulting in 7,000,000 deaths? (Hey, you brought it up). Whether an individual researcher, or an end user, or indeed a frontier AI lab, there’s an unavoidable judgment-proof problem. Tort law and the like ideally motivates parties to account for risk by undertaking optimal levels of special care and risk-reducing investments. But this doesn’t work when the expected cost of liability exceeds the total ability to pay it.

So sometimes we get around this problem through regulation (including transparency). Having hand-waved the COVID example as a real problem that’s already or easily resolved, he then sidesteps by distinguishing AI development as “just science[,] it’s math.” Plenty of biological researchers would bristle at the suggestion that their work is somehow not science.9 Plus someone may want to tell this guy.

Two advocates (both friends) concede on this general point, but also delineate a uniqueness between AI and more familiar articles of commerce (e.g., “AI is Not Pencils or Pork Bellies”).10 It is in fact that uniqueness that sometimes has to be explicitly incorporated into existing law. On the premise that existing law does much of the work already - fraud is fraud, stealing is stealing, restrictions and penalties already exist whether by analog or digital means - it’s simply not true in all cases. If originalism remains the primary mode of legal interpretation, some laws will not account for certain novelties of emerging technologies like AI. For example, when photoshop and later social networks were new, definitions applicable to CSAM, revenge porn, and libel required affirmative changes to account for new modes of harm. This is true now for AI. Terminology like “digital alteration” and “likeness” are not cleanly forward-compatible to all the new uses and implications.

We saw an actual case in the TAKE IT DOWN Act and state analogs. Prior federal law was not addressable to AI-generated revenge porn. I’ll assume advocates are not talking about these kinds of new laws as the problem. So maybe we can dispense with the “1200+ state AI bills” canard (for this and a bunch of other reasons11).

A patchwork, or a rug?

So back to the states as the dominant strategy. The revealed threat is not really 50 states, but a few, and really just one: California. Patchwork rhetoric notwithstanding, the “California effect,” whereby the world’s fifth largest economy becomes de facto national policy, is the real target. I’m ignoring that laments of a “regulatory floor” ought to largely dispense the patchwork concern–that’s not how floors work–both of which they simultaneously caution against. We can add a couple other states to this state strategy, say New York and Colorado (I presume ya’ll good with Texas).

Perhaps they feared California was already lost given the breathless complaints thereon.12 But DC was never going to be an easier lift. Even adjusting for a favorable Trump, the outcome volatility is so high it’s not obvious the risk-adjusted outcome is positive. As one of their fellow travelers noted, assessing their foray into the CA governors race, “This is first grade, second grade for me, personally. We won’t be first and second graders forever.”13 Noted. In later grades you’ll learn in politics it is exceedingly difficult to replace something with nothing, and success requires reading the room (even if you think you are correct and smarter than everyone).

So after commencement, the coalition should have walked off stage diploma in hand and straight into redoubling the effort to optimize the CA law to their purpose. It would still require significant resources, but inexorably less than an optimal federal law - though it would require more than “no rules for 10 years” type language - then use that success both as proof-of-concept and momentum elsewhere.

The sticking point, of course, would require acknowledging an affirmative policy scheme they are in favor of, and not just a negative one. Maybe that’s actually the binding constraint that prevented this strategy, because as I noted above, there never really was one beyond messaging.

But solving problems by building fast and an aggressive go-to-market strategy is supposed to be what y’all are good at.