AI Regulatory Research & Models

As the advent of large language models (LLMs) and frontier AI systems is recent, the literature that exists regarding the governance and regulation of it is burgeoning. The existing research is focused on two different regulatory approaches: oversight and safety standards for frontier AI and sectoral risk-based regulation, akin to what California and the EU have implemented, respectively. Research has also been conducted on legal liability surrounding AI platforms and algorithmic bias, as lawsuits on these issues pre-date the release of large language models and frontier AI platforms. Included here are reports that helped define or is relevant to existing policy frameworks.

Policy Research

The California Report on Frontier AI Policy: Joint California Policy Working Group on AI Frontier Models

California’s recently passed legislation, Senate Bill 53, takes a different approach than Colorado’s, focusing on very large frontier models as opposed to almost any AI system that makes a consequential decision regarding consumers’ lives (employment, healthcare, etc.). California commissioned a report[15] produced by scholars at the University of California system, Stanford University, the Carnegie Endowment for International Peace, and others. This report only addresses how to regulate and advance AI foundation models and does not address specific sectoral or risk-based approaches.

The report provides background on the current policy landscape, the regulation of other industries as case studies (the Internet, the tobacco industry, and the energy industry), and the lessons learned from initial attempts at mitigating potential harms caused by all three. The takeaways from these case studies, as well as others, are synthesized into several recommendations:

• Governance structures should balance the benefits and risks of AI;

• Early policy decisions can help set the trajectory that shape the evolution of the systems;

• Industry expertise can help policymakers establish clear transparency standards and independent ways to verify safety claims and risk assessments;

• Ensuring there is greater transparency can help AI system accountability, competition, and in building public trust;

• Achieving transparency requires whistleblower protections, safe-harbors for third-party evaluators, and sufficient public-facing information;

• Requiring adverse event reporting will allow for the monitoring of AI system impacts and adaptation of regulations to the evolving risks; and

• Setting thresholds for which firms or models are regulated is helpful in the implementation of policies set and should adapt over time to the evolving technology; policymakers should monitor the efficacy of the thresholds and whether others should be selected.

More specific takeaways from the report apply directly to the policies enacted in Colorado.  These include:

1. The authors highlight the potential problems associated with regulatory thresholds based on risk evaluations. They can help better manage safety risks but choosing which risk evaluation framework to use is difficult. They urge alignment with industry consensus around selecting which risks to track and how to measure them. The developers may be unaware of potential downstream impacts, so a better policy option would be to monitor the market over time.

2. The report highlights the challenges using developer thresholds for regulation, especially head count. AI firms may be able to develop large and impactful foundation models with few developers.

3. Existing regulatory frameworks could be used to regulate AI risks.

4. Ensure there is a plan of action for how to analyze and adapt policy to transparency disclosures.

5. Align regulations and transparency reporting with industry standard practices to not create a dual reporting system (internal and external).

6. Reporting requirements should consider freedom of speech, intellectual property, and trade secrets rights.

7. Ensure clarity and specificity of regulations to ensure the industry can thrive economically.

Frontier AI Regulation: Managing Emerging Risks to Public Safety

This 2023 report authored by more than a dozen researchers including some from Google DeepMind, OpenAI, and Microsoft and academic institutions, lays out regulatory recommendations for frontier AI models. The report begins by making the case for why regulation of these models is needed and states that self-regulation will not be sufficient to ensure public safety with these rapidly evolving models and argues that government intervention is needed. It also provides a list of recommendations and safety standards for policymakers to balance the risks and benefits.

Regulating frontier AI is difficult at this nascent stage of its development. The authors point out three challenges posed by these models:

1. The unexpected capabilities problem, which can arise quickly and unexpectedly.

2. The deployment public safety problem, which will be an ongoing challenge.

3. The proliferation problem, since proliferation will outpace regulation.

Three facets are needed to address these challenges:

1. Safety standard setting processes that can help identify the appropriate requirements for frontier AI developers.

2. Reporting requirements that can be determined through setting standards for the appropriate level of disclosure and monitoring, as well as whistleblower protections to provide regulators insight into frontier AI development processes.

3. Mechanisms to ensure compliance with safety standards for the development and deployment of frontier AI models including enforcement by authorities and licensing bodies.

Despite the need for this oversight, the authors caution that regulation could inhibit innovation in the field. Any regulations implemented early on would need to be monitored and updated to keep up with advances in the technology.

Once the standards have been set, the following are the authors’ recommended safety standards:

1. Risk assessments: Developers should conduct thorough pre-deployment assessments of dangerous capabilities and make deployment decisions based on assessed risk.

2. External oversight: Independent audits or expert review of models is recommended to improve accountability and unveil potential risks.

3. Dynamic monitoring: Post-deployment monitoring should be required so that if new capabilities or risks emerge, the model’s deployment status and safeguards can be adjusted.

4. Pro-innovation balancing: The recommendations attempt to balance safety and regulation with innovation.

Recommended regulations should align with the level of risk a system poses. An educational chatbot does not typically pose the same risk as a general-purpose assistant with human-level capabilities. The report lists the following questions as potential limitations and issues that had yet to be answered at the time of publication:

• How should frontier AI be defined for regulatory purposes?

• What is the potential danger from foundation AI models?

• Will training advanced AI models continue to require significant resources?

• How effectively can we anticipate and mitigate risks from frontier AI?

• How can regulatory flight be avoided?

• How can reductions in innovation be avoided?

• How can the centralization of power in AI development be avoided?

• How can it be ensured that government will not abuse its regulatory powers?

• How can regulatory capture be avoided?

• What is the appropriate regulatory body or agency?

• How will the regulations relate to other AI regulation?

• How do we move toward international cooperation?

Artificial Intelligence Regulatory Models: Advances in the European Union and Recommendations for the United States and Evolving Global Markets

This report explains that the European Union Artificial Intelligence Act (AIA) adopts a four-tier risk-based approach to AI regulation:

1. Unacceptable-risk systems (banned)

2. High-risk systems (strict regulation and conformity assessments)

3. Limited-risk systems (some transparency obligations)

4. Minimal-risk systems (largely unregulated beyond existing law)

In contrast, the U.S. regulatory landscape remains sectoral and fragmented. Executive orders provide guidance to federal agencies to identify AI risks, but there is no comprehensive federal law. In this light, the EU model prioritizes uniform, cross-sector regulation, while the U.S. model emphasizes innovation, minimal regulation, and sector-by-sector oversight.

The proposed AI Integrative Risk-Based model and recommendations bridge the gap and help move toward global regulatory coherence. This risk-based model consists of five steps:

• Identify Risk – catalog AI risks, such as bias, privacy, etc.

• Sectoral Analysis – apply those risks to specific sectors to determine where to focus oversight.

• Prioritize Risk – grade or tier the risks, similar to the EU’s four-tier model, in terms of severity and potential impact.

• Sectoral Comparison – compare risk across sectors and identify common regulatory approaches or uniform standards.

• Draft Responsive Regulation – design regulation tailored to the risk level, balancing public protection with innovation. The report argues that this would allow the U.S. and other jurisdictions to develop regulations that are risk-appropriate, sector-specific, and aligned with the EU’s approach, creating a streamlined regulatory framework.

This report and framework do not address accountability mechanisms.

Legal Research

U.S. Tort Liability for Large-Scale Artificial Intelligence Damages: A Primer for Developers and Policymakers

This report reviews tort law, how it varies by state, and how it applies to legal cases involving artificial intelligence. Tort law, stemming from common law, is described as “jurisdictionally specific,” with any set precedents only applying in the same jurisdiction. Under existing law, AI developers are already subject to tort liability because tort laws apply to any entity whose activities create risks of physical injury or property damage. Developers face exposure under negligence, product liability, and public nuisance theories, and this risk is greatest for companies that fail to follow industry-leading safety practices. Tort law therefore serves as an existing incentive structure that pushes developers to exercise caution in designing, testing, and deploying advanced AI systems to reduce the likelihood of harm and liability.

Despite this, courts have not yet fully clarified how existing doctrines apply to harms caused by third-party misuse of AI systems or how constitutional and statutory protections might limit liability. Policymakers could intervene by defining duties of care, specifying how best practices affect liability, adjusting causation standards, or clarifying responsibility for downstream misuse. Yet the common law’s flexibility is also a strength: it incorporates generations of experience managing safety risks and can adapt more readily than rigid statutes to fast-changing technologies. As AI advances, careful deliberation will be needed to determine whether legislative reforms should supplement or simply allow the evolving common law to shape the boundaries of developer liability.

Key recommendations drawn from the report include:

• The AI industry should adopt standardized best practices to reduce harm and exposure to liability;

• Policymakers at the state and federal levels could enact statutes or regulations to clarify guidelines for AI developers to reduce risk and promote transparency and documentation; and

• Any statutory changes made should supplement and reinforce instead of displace existing common laws.

The legal doctrine that will be key to preventing AI discrimination

Artificial intelligence systems are increasingly being used in hiring, lending, health care, public benefits, and criminal justice, and these systems have repeatedly shown the capacity to produce discriminatory outcomes. Algorithms trained on historical or biased data have the possibility to intensify existing inequalities. Examples include facial recognition tools that misidentify people of color more frequently, hiring algorithms that favor applicants similar to past employees, and financial lending models that disproportionately reject certain racial groups. These risks are heightened because many modern AI systems are trained on very large datasets and operate in ways that are difficult to interpret, making it challenging to identify or correct the sources of bias.

U.S. discrimination law generally relies on two frameworks: disparate treatment, which focuses on intentional discrimination, and disparate impact, which focuses on policies or practices that disproportionately harm protected groups regardless of intent. Traditional anti-discrimination protections often require proof of intent, which is difficult to apply to algorithmic systems because AI models do not have conscious motives and often make decisions through opaque, complex processes. Disparate impact doctrine is thus better aligned with algorithmic bias because it allows plaintiffs to challenge harmful outcomes without having to prove the designer’s intent to discriminate.

However, disparate impact protections in the United States are limited and inconsistent across sectors. Some statutes, such as the Fair Housing Act and Title VII, provide clear pathways for disparate impact claims, while other areas including health care, public services, and emerging uses of AI have no comparable protection. Judicial decisions have also narrowed the doctrine in recent years, making enforcement more difficult. The article argues that Congress should adopt a federal disparate impact law that applies broadly to AI and automated decision making, includes a private right of action for individuals affected by discriminatory outcomes, and strengthens the capacity of enforcement agencies. Such a framework would help ensure that AI systems operate fairly and that individuals have meaningful recourse when automated tools create inequitable results.

Algorithmic discrimination: examining its types and regulatory measures with emphasis on US legal practices

This report reviews how algorithmic discrimination takes several distinct but similar forms, which reflects how automated decision systems may inadvertently introduce bias into their output. The literature commonly identifies five main types:

1. Bias by algorithmic agents arises when systems are trained on historical data that reflect past discrimination or are designed by humans whose assumptions shape outcomes.

2. Discrimination based on feature selection occurs when designers choose variables that systematically disadvantage certain groups, even if those variables appear neutral.

3. Proxy discrimination involves the use of indirect indicators, such as ZIP code or browsing behavior, that correlate strongly with protected characteristics like race or income.

4. Disparate impact refers to facially neutral algorithms that produce disproportionately harmful outcomes for protected groups without explicit intent.

5. Targeted advertising and pricing discrimination occurs when algorithms segment users and selectively show opportunities, information, or prices in ways that exclude or burden specific populations.

To address these risks, regulators have developed a mix of legal and policy approaches rather than a single framework. In the U.S., existing civil rights and consumer protection laws are applied to algorithmic systems through equal protection and anti-discrimination doctrines. Sector-specific rules, such as those governing employment, credit, housing, and education, provide more specific frameworks. Preventive measures focus on algorithmic audits, impact assessments, transparency requirements, and data governance rules. Consequential liability regimes rely on enforcement, holding organizations accountable when algorithmic decisions result in discriminatory harm through disparate impact frameworks under civil rights law.

In addition, self-regulation, which includes industry standards, professional codes of ethics, and voluntary commitments to fairness, transparency, and auditability, is beginning to play a larger role. Combining public oversight with private compliance, similar to what the EEOC and FTC have provided guidance on, provide some accountability for algorithmic outcomes. Other jurisdictions, particularly the European Union and Canada, place greater emphasis on proactive obligations such as mandatory risk assessments, rights related to automated decision making, and stronger transparency requirements. Together, these regulatory measures aim to balance innovation with fairness by combining legal liability, preventive oversight, and ongoing monitoring of algorithmic systems.