I was reading about the EU AI Act a few weeks ago. Specifically, the part where the compliance deadline for high-risk AI systems, originally set for 2026, got pushed to late 2027 or 2028. The reason: the technical standards needed to define what compliance actually looks like were not ready yet. The regulation was written, voted on, celebrated as a landmark, and then effectively paused because the technology had already moved past what the drafters had in mind.
That is not a failure of the EU specifically. It is a structural problem baked into how legislation works. Laws are drafted in consultation cycles. They move through committees, reviews, amendments, translations. They get debated, compromised on, delayed by elections, stalled by lobbying. By the time a regulation takes effect, the technology it was designed to govern has often changed shape entirely. Six months in AI is a geological era. Legislators are writing rules for a landscape that no longer exists by the time the ink dries.
The people who build it get to set the defaults
When regulation is perpetually six to nine months behind the technology, the defaults get set by whoever ships first. Not by elected officials, not by public debate, not by anyone with a democratic mandate. By engineers, product managers, and founders who are optimizing for growth, market share, and investor returns.
That is not necessarily malicious. Most of the people building AI tools are not sitting in a room cackling about societal damage. They are solving problems, shipping products, responding to competitive pressure. But the incentive structure does not require them to think about the second-order effects of what they build. And the regulatory vacuum means nobody else is thinking about it either, at least not fast enough to matter.
Meta's early motto was "move fast and break things." They dropped it eventually. The philosophy persists across the industry. Ship it, see what happens, deal with the fallout later. The problem is that "later" means after millions are already using the product, after the behaviour patterns are set, after the business model is locked in.
Social media is the clearest example. Algorithmic feeds, engagement optimization, targeted advertising, data harvesting at scale. None of these were designed with public input or regulatory oversight. They were product decisions made by small teams inside private companies. By the time legislators understood what was happening, billions of people were already inside the system. Regulation became a game of catching up to damage already done.
The knowledge gap makes it worse
There is another layer. The people writing the laws often do not fully understand the technology they are trying to regulate. That is not an insult. AI is moving fast enough that people working inside the field struggle to keep up. Expecting legislators to have current, nuanced understanding of how large language models work, how agentic systems make decisions, or how training data flows through inference pipelines is not realistic.
The result is legislation that is either too vague to be enforceable or too specific to survive the next product cycle. The EU AI Act's risk-based framework is thoughtful in principle, but defining what constitutes a "high-risk" AI system is already outdated when capabilities change quarterly. The US has largely left it to individual states, creating a patchwork that is effectively no regulation at all for companies operating nationally.
California's governor vetoed a bill designed to make AI chatbots safer for children after the tech industry campaigned against it, arguing it would harm innovation. The pattern is consistent: the people with the deepest understanding of the technology are the ones building it, and they have a financial interest in regulation arriving late and arriving weak.
Defaults become norms, norms become culture
This is the mechanism that gets underappreciated. When technology ships without regulatory guardrails, the design choices made by product teams become the de facto rules. Users adapt to them. Businesses build on top of them. Entire industries form around them. And by the time regulation does arrive, it faces an installed base of behaviour that is extremely resistant to change.
Think about cookie consent banners. GDPR required them, but the implementation was largely designed by the companies being regulated, resulting in dark patterns that make it easier to accept all cookies than to opt out. The regulation existed. The spirit of the regulation was undermined by the defaults the industry chose.
Whoever ships first writes the rules, and everyone else spends years trying to rewrite them.
Now apply that to AI. The defaults being set right now about what data AI systems can collect, how they personalize, whether users can export their context, how agentic systems make purchasing decisions on your behalf are being decided by product teams inside a handful of companies. There is no public consultation. There is no democratic process. There is a shipping deadline and a growth target.
What would actually help
I am not anti-regulation. Good regulation is necessary and overdue. But the current model of writing comprehensive laws that take years to implement is structurally unable to keep pace with technology that iterates in weeks.
What might work better: smaller, faster regulatory interventions that target specific behaviours rather than classifying entire technologies. Mandatory transparency about how AI systems use personal data, enforced with real penalties, not fines that amount to two days of revenue. Portability requirements that prevent lock-in before it forms. And genuine technical literacy programmes for the people writing the laws, not one-hour briefings from the companies being regulated.
The OECD has started talking about "agile regulatory governance" and "anticipatory regulation." Those are the right concepts. They need to be more than concepts. They need to be operational practice, with the funding and institutional support to match.
The uncomfortable truth
None of this is going to be easy, and none of it is going to happen as fast as we need it to. Technology companies have the money, the talent, and the lobbying power to keep regulation at arm's length. Governments have electoral cycles, budget constraints, and a hundred other priorities competing for attention.
But the alternative, which is what we have now, is a world where the rules governing some of the most consequential technology in human history are set by default by whoever ships fastest. And those people, talented as they may be, are not optimizing for the public interest. They are optimizing for quarterly results, user growth, and competitive positioning.
The gap between technology and regulation is not a timing problem. It is a power problem. The lag is not a bug in the system. It is a feature of how we have chosen to organize the relationship between innovation and governance.
We could choose differently. We have just not yet decided that the stakes are high enough. I suspect, as with social media, we will decide too late.