A company can demand stricter rules for artificial intelligence and get precisely what it wants. Its customers may get what they want too. The difficulty begins when the two benefits cease to coincide: certification that reduces harm may be so expensive that only established suppliers can afford it. Consumers gain a safeguard and lose alternatives. Deciding whether the exchange is worthwhile requires more than counting pages of regulation or noticing who applauds at the end of a hearing.
Imagine two companies selling a system for sorting applications. The first spreads the cost of evaluating it across millions of transactions; the second has only just acquired its first customers. Both may need independent quality testing. Yet charging them the same for an assessment designed around the first company's architecture changes their prospects of competing. The apparently neutral standard has already chosen part of the commercial landscape. Safety need not be a pretext, but invoking it does not make every means of pursuing it harmless.
Public debate often presents two boxes: regulation and innovation. The first contains rights, forms and penalties; the second, patient inventors whom somebody is preventing from working. This account omits the way rules determine who can sell, what information they must reveal and how much it costs to leave a supplier. It also overlooks how a market lacking certain safeguards can drive out firms that invest in quality buyers cannot recognise. There are several ways to spoil competition, including some that require no legislation at all.
Rodrigo Castillo argues in his work on the foundations of regulation that identifying a failure is insufficient to choose an appropriate instrument: its mechanism must be explained and institutions that could actually work compared. In AI, that comparison requires examining who retains the technical benefit, who holds information and who bears the burdens. Rights provide independent reasons for protection; they do not thereby become another negotiable line in a spreadsheet.
Risk needs a description
Risk-based regulation helps concentrate resources where a failure matters most. A poor music recommendation and a classification that denies access to an essential service do not necessarily warrant identical requirements. Relevant differences include severity, duration, opportunities for correction and the people exposed. The system's particular function matters too: the same model might summarise a document for a professional or feed directly into a decision about someone who does not even know an assessment took place.
The word “risk” alone does not establish which consequences are acceptable. Calculating an expected loss requires deciding what counts as a loss, and to whom. If a rule reduces an institution's expenditure by transferring hours of complaint handling to citizens, the institution's accounts improve without the cost disappearing. If those citizens lack the time or money to complain, recorded harm may even fall. An absence of case files does not demonstrate an absence of problems; sometimes it describes the price of making them visible.
In a hypothetical example, a system wrongly rejects a small proportion of applications. The percentage might appear tolerable to an administrator handling thousands of cases. For someone excluded from an indispensable benefit, the relevant comparison includes how long exclusion lasts and whether another route is available. An authority needs to explain the protection each person is owed before deciding how much effort detecting errors deserves. An average helps organise supervision; it does not confer permission to ignore the individuals who make it up.
A law has a calendar too
European regulation shows why the structure of a law must be distinguished from obligations already applicable. According to the European Commission's official timetable, the AI Omnibus entered into force on 27 July 2026 and moved rules for certain high-risk uses to 2 December 2027; those for systems embedded in regulated products move to 2 August 2028. Other obligations retained their own timetables. Source: European Commission
Deadlines affect economic decisions before they arrive. A supplier needs to know when to test a product and what testing will be accepted. A purchaser must distinguish a future obligation from a safeguard available today. Announcing demanding controls without preparing the people who will administer them can create an odd combination: uncertainty during investment and weak verification when the deadline arrives. Delay may help adaptation; it may also prolong exposure to the problem that justified the rule. Its value depends on what happens during the interval.
The stability participants need does not mean freezing requirements indefinitely. When a new kind of harm emerges, retaining an unsuitable rule out of respect for a calendar may be costly. Reasonable predictability means knowing how obligations are reviewed, what evidence can trigger change and which transition arrangements apply. It allows investment in compliance without promising anybody that today's costs create a permanent entitlement to tomorrow's market. Predictability should attach to an intelligible process, not to the guaranteed survival of a particular commercial model.
Buyers do not always buy quality
Competition more readily disciplines what customers can observe. Comparing two tools that perform the same task appears straightforward when one costs less. Yet an application may economise on testing, preservation of records or protection for affected people without making its sales demonstration any worse. Buyers see speed; problems emerge months later, in another office or in the life of someone who was not a party to the contract.
Consider a clinic comparing systems that schedule appointments. The price per transaction is visible. It is harder to know whether a product will mishandle an unusual situation, whether the clinic will be able to investigate that failure or whether the next update will change its results. A firm investing in finding such problems has to persuade buyers that this quality exists. If it cannot substantiate the difference, a rival may look equally good for less money. Cost reduction then selects an inferior product in precisely the attribute nobody knows how to measure.
Independent assessment can help break that relationship. It makes a previously hidden quality visible and allows buyers to pay for it. Its usefulness depends on examining something connected to actual use, distinguishing levels of performance and remaining open to challenge. A seal certifying only that documents exist may make files easier to compare, but it does not distinguish which service will respond better when conditions change. Being easy to verify does not establish that a requirement matters to the user, or that satisfying it improves the decision being made.
Costs missing from the quotation
Externalities arise when a decision imposes consequences on third parties that the agreement between buyer and seller does not reflect. In AI, someone affected by a classification may be a customer of neither. An employer purchases a tool; an applicant bears an erroneous exclusion. An administration buys a solution; the person assessed bears the time needed to correct data. The price accepted by the contracting parties can omit part of the cost their transaction produces.
Urging everyone to be more careful does not resolve this problem. What participants can gain, lose or know has to change. Requiring tests before a sensitive use, mandating incident reports and making complaints accessible act through different mechanisms. Testing seeks to prevent harm; reporting helps reveal patterns; complaints may stop losses falling exclusively on those suffering them. The combination should address an identifiable problem, rather than a wish to display a well-stocked regulatory toolbox.
There are benefits a company cannot charge for in full, too. A shared test exposing a weakness may improve competing products. Open evaluation infrastructure may help developers who never financed its construction. If the private return on producing that knowledge is smaller than its social value, expecting every supplier to pay independently may lead to inadequate investment. Public intervention then has another possible function: producing evidence that enables competition in quality, rather than choosing the competitor that ought to win.
The form and the form factory
Fixed costs deserve attention because they do not grow at the same pace as sales. Preparing a dossier, commissioning legal review or configuring a test may require significant expenditure before the first payment arrives. A large company spreads the bill over many customers. A small company has to recover it from a handful of contracts. The effect on entry depends both on the amount and on opportunities to reuse evidence, share facilities or demonstrate equivalent protection through a less expensive procedure.
It does not follow that small firms should be allowed to cause harms forbidden to large ones. An affected person does not lose rights because a supplier is going through an entrepreneurial phase. Proportionality requires distinguishing the level of protection from the means of demonstrating it. A common format, technical assistance or a shared assessment can reduce costs without weakening the safeguard. An exemption removing the very test needed for protection does something different: it transfers part of the firm's financing to the public.
The design may also favour consultants, certifiers and vendors of compliance tools. Their work can provide indispensable expertise. But a requirement so complicated that nobody can understand the intended result creates demand for intermediaries even when it adds little protection. Before celebrating a new compliance industry, it is worth asking whether it resolves a technical difficulty or charges admission to a regulatory maze. The number of jobs created by the maze does not establish its usefulness.
Capture without caricature
Regulatory capture describes a diversion of public decision-making towards the interests of those who should be subject to it. It can work through selective information, unequal access to an authority or dependence on expertise that only one group can supply. Investigating these mechanisms requires no imaginary suitcase of money. Equally, finding a company that benefits is insufficient to prove capture: a sensible rule may reward a firm already meeting its requirements.
A more relevant signal appears when an alternative providing equivalent protection is rejected without adequate reason, while the chosen option matches incumbents' exclusive capabilities. Investigation should examine who defined the test, which evidence was accepted and who could challenge it. The outcome matters too: how many technically different solutions can demonstrate compliance? An extensive public consultation may receive many pages and few objections capable of changing the decision if meaningful participation demands resources available to only one side.
Independence therefore involves more than declaring an agency autonomous. It requires its own expertise, access to evidence and procedures compelling it to explain its choices. Financing participation by specialists without commercial ties to regulated firms can broaden the available information. Publishing arguments and responses helps reveal what was considered. Rotating personnel, on its own, achieves little if everyone depends on the same documents and nobody can test them.
When the supplier knows more
A company knows features of its product that the authority cannot directly observe. It may recognise a limitation yet fear that reporting it will bring penalties, lost customers or a disproportionate investigation. It may claim that an obligation is extraordinarily expensive because doing so secures an exemption. Regulators have to gather information without assuming that declarations describe the world disinterestedly. The information asymmetry examined by Castillo has that consequence: a rule also changes the reasons for revealing or concealing information.
A reporting system can protect early disclosure while retaining consequences for concealment or breaches of duty. To work, it must distinguish honestly discovering a failure from conduct that caused it or allowed it to persist. Punishing every disclosure as a confession of negligence may reduce the evidence available. Excusing any conduct whenever somebody files a report can make it attractive to take risks first and explain later. The precision of the arrangement matters more than the severity of its announcement.
A similar problem arises with payment metrics. A purchaser who rewards only the number of completed files encourages speed. Adding an error rate requires explaining how errors will be found; counting only successful complaints rewards those who make complaining difficult. Requiring exhaustive review of every case can destroy the advantage of automation. Choosing metrics means examining the decisions they encourage and the work they leave unrewarded, including cases that vanish before reaching the statistics.
Competition requires a way out
In July 2024, the European Commission and competition authorities in the United Kingdom and United States jointly identified risks to competition in generative AI: restrictions on essential inputs, the use of existing power to extend market positions and arrangements that may alter rivalry. This was a statement of concerns and enforcement principles, not a joint condemnation of every partnership between firms. Source: European Commission · CMA · DOJ · FTC
The commercial question does not end with allowing another supplier to exist. Switching requires a customer to move data, rebuild integrations and verify that an alternative preserves important capabilities. Such costs can make an initially cheap offer difficult to abandon. Poorly designed safety requirements may aggravate the problem: if compliance evidence belongs to the supplier and cannot accompany the customer's process, migration means buying the assessment all over again. A competitor's lower price becomes less persuasive once the customer adds the cost of escaping the first arrangement.
Useful portability involves more than exporting files. It requires identifying the information needed to reconstruct a service, which dependencies cannot move and what operating during the transition will cost. In some uses, documented formats or contractual access rights may be reasonable requirements. They must be technically specific: promising interoperability between every system and every other system could create enormous expense without supplying an effective alternative. The commercial question is what a real buyer needs in order to choose again, and which obstacles serve a legitimate function rather than merely securing retention.
Innovation under testable conditions
Supervised testing environments can enable learning before wider deployment is authorised. Their value lies in limiting exposure, identifying affected people and gathering evidence about a particular use. A testing environment should have entry conditions, stopping criteria and an identifiable decision at the end. If participants receive an indefinite exemption while the public faces ordinary consequences, describing the arrangement as experimental does not reduce risk. It merely improves the account offered by those accepting that risk on someone else's behalf.
That instrument should be distinguished from a voluntary management framework. NIST's AI Risk Management Framework 1.0, published in 2023, presents itself as voluntary guidance for diverse organisations and uses. It can organise work on risks; adopting it does not, by itself, constitute legal authorisation or demonstrate that a particular application is safe. Source: NIST
Innovation worth protecting includes better ways to test, review and document systems. A rule prescribing one technical solution may freeze known advantages and obstruct superior alternatives. Another demanding an outcome without establishing how to verify it may postpone the entire argument until after harm occurs. A functional standard requires acceptable tests, routes for submitting new methods and an authority capable of comparing them. Otherwise, “technological neutrality” becomes an elegant way of leaving unanswered who will evaluate the result and on what evidence their conclusion will rest.
Authorities need a budget as well
A regime may demand thousands of reports without employing people capable of separating the important from the trivial. Document production rises, the probability of discovering a problem remains low and firms learn that filing on time matters more than explaining clearly. The public cost of supervision belongs in the original decision. A law distributing obligations without financing their assessment offers protection on paper and purchases distrust when that protection is tested.
Prioritising inspections helps, provided new information can change the selection. An authority concentrating all its resources on firms reporting incidents may end up scrutinising the most transparent while leaving silent firms undisturbed. It needs alternative sources: sample-based checks, accessible complaints, technical investigation and comparisons across organisations. Each signal has to be interpreted in light of how it is produced. Numerous reports may indicate a dangerous product, careful monitoring or both; the figure alone cannot decide between them.
Institutional learning requires keeping what is needed to connect an intervention to its results. Did relevant failures decline? Did affected people receive answers sooner? Can different suppliers still enter? Did the rule create an unforeseen cost? Asking these questions at the outset allows the instrument to be reviewed against evidence. An assessment that merely counts penalties turns the supervisor's activity into the measure of its success, even if the problem it was meant to address remains unchanged.
Governments can buy better terms
Public procurement offers an opportunity that often enters the debate too late. An institution can require, at the tender stage, access to evaluation records, preservation of versions and assistance in moving the service to another supplier. Negotiating those conditions after signing a contract and integrating the system leaves it in a weaker position: switching already means redoing work, interrupting services or justifying additional expenditure. Purchasing power is more useful while saying no remains a practical option.
Contractual requirements must relate to the institution's needs. Demanding all intellectual property for a limited function may exclude useful offers and raise prices without improving the service. Asking only for a promise of cooperation may leave it helpless when a dispute arises. Specifying access, permitted uses, response times and assistance costs turns a general aspiration into a service that can be compared. It also allows a smaller firm to compete by offering better exit terms, even if it cannot match its rival's marketing budget. The contract then rewards a capability that matters beyond the sales presentation.
The complete bill
Choosing a rule requires comparing the benefit of preventing harm with the resources it consumes and the alternatives it excludes, while respecting the relevant duties of protection. The comparison needs a realistic baseline: what would happen with the institutions actually available if the measure were not adopted? Comparing an imperfect market with an omniscient regulator produces too easy a victory; setting a clumsy authority against unfailingly honest companies performs the same trick in the opposite direction.
A requirement can be expensive and fully justified. It can be cheap and useless. The judgement depends on whether it addresses the relevant mechanism and whether a practicable alternative would provide the protection owed with fewer sacrifices. When evidence is incomplete, limiting use, gathering information and revising conditions may be reasonable. Uncertainty is not free either: somebody lives with its consequences while somebody else decides that too little is known. A demand for better evidence needs to say how that evidence will be obtained and what happens in the meantime.
Return to the two companies at the beginning. The best regulation need not allow both to survive. If one sells a product unable to demonstrate adequate safety for its use, losing customers may be precisely the intended result. But if the other is protected because the procedure requires buying its architecture, matching its scale or hiring its own assessors, the public will have been charged twice: for the promised safeguard and for the competition lost. Before accepting the bill, it should demand an itemised account.