If an AI model can identify that a user is planning a violent act, the operating company should be legally required to notify authorities. This parallels existing liability laws for professionals like bartenders who observe imminent danger, applying a "duty to report" standard to AI platforms.

A responsible, iterative approach to AI regulation begins not with new frameworks, but by auditing existing laws. Domain experts should update current rules for professions like medicine or finance to ensure they explicitly cover actions performed by or with AI, addressing immediate gaps without stifling future innovation.

The most powerful AIs may never be released publicly due to their dangerous capabilities. As they are used internally, they pose significant risks that current transparency laws, which focus on public models, do not cover.

Recent model 'escapes' occurred during internal evaluations, revealing a major gap in proposed AI regulations that primarily focus on pre-release audits for public models. Policymakers must now grapple with how to monitor a larger, more proprietary set of models used exclusively for internal testing and development.

Creating a new regulatory framework for AI is premature because nearly all feared harms—from malpractice to non-consensual imagery—are already illegal under existing laws. The initial focus should be on applying these established laws to AI-assisted actions, not inventing a new regime from scratch.

Existing state-level AI laws have reporting thresholds so high—requiring bodily injury or catastrophic risk—that major security breaches like the OpenAI/Hugging Face incident likely don't qualify for mandatory reporting, rendering the laws ineffective for current threats.

Regulatory focus on publicly released AI models overlooks the significant dangers from risky research and "internal deployment" within AI labs. True oversight requires visibility into these internal activities, not just the final products.

Other scientific fields operate under a "precautionary principle," avoiding experiments with even a small chance of catastrophic outcomes (e.g., creating dangerous new lifeforms). The AI industry, however, proceeds with what Bengio calls "crazy risks," ignoring this fundamental safety doctrine.

Drawing from aviation safety, AI incident reports should be submitted to an entity that lacks direct enforcement authority. This separation reduces companies' fear that reporting will lead directly to penalties, thus encouraging more honest and complete disclosures.