AI: we're regulating a quantity nobody measures

The quantity nobody measures

This filing named a test in advance: if no national instrument measures AI deployment in consequential decisions, that finding becomes the headline. It does not exist. The EEOC withdrew its AI hiring guidance in January 2025 and collects no AI-use data; the CFPB withdrew sixty-seven guidance documents including its AI circulars in May 2025, and the national mortgage dataset has no AI-use field. New York City's hiring-AI audit law is the closest working instrument in the country — one city, and a December 2025 state comptroller audit found its enforcement ineffective, with three-quarters of complaint calls misrouted. Healthcare is the partial exception that proves the rule: federal certification requires health-IT vendors to make source-attribute descriptions of their predictive algorithms available to a limited set of identified users — not to the public — at the 96% of hospitals reporting a certified EHR, but not how often those algorithms drive a decision, and a pending rule proposes removing the requirement entirely.

The one real federal instrument that does exist measures something adjacent: the Census Bureau's biweekly survey of business AI adoption, which this project pulled directly and committed as a pipeline. It shows use climbing from 17.3% to 21.5% over eight months, with a three-fold spread across states. That is a real number, and it is not the number the policy debate needs. Knowing that a fifth of businesses use AI somewhere tells you nothing about whether an algorithm screened out your job application.

The harms that actually reach a court are the boring ones

Against the measurement blackout, the adjudicated record is small but legible — and it is not where the discourse looks. Discrimination cases have produced actual settlements (the EEOC's first AI hiring settlement; a $2.3M tenant-screening settlement). Fraud and synthetic child sexual abuse material dominate by sheer volume. The novel, catastrophic scenarios that organize most AI-policy attention have produced essentially no adjudicated American cases at all. Two different metrics, pointing the same way: whatever is generating legal consequences today is mundane.

The obvious fix — let courts sort it out under existing law — is cheaper than a new regulatory regime, and it half-works. The evidence shows two distinct obstacles, not one. The first is access: in one 2026 case a magistrate judge refused to compel a vendor's AI bias-testing data as privileged; in another, a judge ordered broad discovery into a health insurer's coverage algorithm over its objection. Access is genuinely contested terrain, with real wins on both sides. The second obstacle is doctrinal and discovery reform would not touch it: product liability asks whether a product was defective as designed and sold, and a model that is retrained every few weeks has no fixed design to interrogate. And the case law is not accumulating the way a liability-first strategy needs — the leading generative-AI harm case settled in January 2026 before any ruling, which is a pattern, not an accident.

Nobody can check the safety homework

Every major lab publishes a safety framework. Every one of those frameworks is self-assessed. The US AI Safety Institute was renamed in June 2025 to the Center for AI Standards and Innovation, its charter narrowed from broad safety to "demonstrable risks," and its evaluations remain voluntary — labs opt in. Independent technical evaluators do real work, but their access in the US is negotiated per engagement: API keys and compute credits, never standing rights to weights, training data, or internal deployment logs. The compute-reporting mandate that existed under the 2023 executive order was rescinded in 2025 and not replaced. No case was found, anywhere in the record, of an outside body catching a lab's published safety claim as false — not because labs are necessarily lying, but because no American body is positioned to check.

Correction, and it is the largest of this pass. This filing published that sentence with no country attached, and a Phase 2 steelman refuted the unqualified version out of the statute book. The EU AI Act's Article 92 lets the AI Office evaluate a general-purpose model, lets the Commission "appoint independent experts to carry out evaluations on its behalf," and lets it "request access to the general-purpose AI model concerned through APIs or further appropriate technical means and tools, including source code" — with fines of 3% of worldwide turnover, or €15 million, for refusing. Article 91 and Annex XI reach the other two items: training-data provenance, and "the computational resources used to train the model (e.g. number of floating point operations)." It binds the American labs named above, because they sell general-purpose models into Europe. Those powers became applicable on 2 August 2026. This filing was filed on 4 August 2026. What is still true: no exercise of that power is documented anywhere this pass could reach — no evaluation, no access request, no fine — and the provision names source code, not model weights. And in the United States nothing of the kind exists: California's SB 53 and New York's RAISE Act — the only two American frontier statutes on the books — were read in full at primary tier and neither contains the word "audit" or grants access to anything. RAISE does not take effect until 1 January 2027, so on this filing's date SB 53 was the only one of the two actually in force. (That RAISE reading was itself corrected after this pass: the operative statute is Ch. 96 of the Laws of 2026, which repealed and replaced the Ch. 699 version an earlier draft of this correction had read. See the corrections page.)

The most useful evidence here is adversarial to the whole regime and comes from outside it: an independent index grades every major lab C+ or below and concludes — of Google DeepMind, OpenAI and xAI specifically — that stated commitments are an unreliable proxy for actual safety practice. That is not this desk's opinion — it is an outside body reaching the same conclusion this filing's hypothesis predicted. On the catastrophic-risk question itself, this filing declines to issue a verdict, and says why: expert estimates span from near-zero to near-certainty with no standardized elicitation method, and the surveys disagree partly because they are different instruments, not only because experts disagree. What the filing publishes instead is a ledger of what would change the assessment.

Your power bill is AI policy, and nobody files it that way

The most consequential measurable AI-policy question in America right now is being decided in state utility proceedings, under a name nobody recognizes as AI policy. Georgia's commission certified nearly 9,900 MW of new generation with roughly 80% serving AI data centers, at an estimated $50–60 billion in ratepayer cost over the assets' life — then froze base rates through 2028, an implicit admission the cost-shift risk was real enough to need a countermeasure. In the mid-Atlantic grid, PJM's own independent market monitor attributes $29.4 billion across four capacity auctions to data-center load, including $6.2 billion tied to data centers that have not been built.

Utilities are building the fix: large-load tariffs in Georgia, Ohio, and Virginia now require data centers to commit to minimum charges of up to 85% of contracted capacity, with multi-year terms and exit fees. These are real cost-causer-pays mechanisms. They are also prospective only — they do not reach the generation already built and already in the rate base — and none has been tested against a large data center going bankrupt or never materializing. The comparison this filing had to assemble itself, because no source makes it: ratepayer exposure in Georgia and the PJM region alone ($79–89B combined) far exceeds federal AI spending on the obligated reading ($3–8B) and approaches it on the contract-ceiling reading ($91.8B).

The jobs numbers have two parents

Trace the circulating "X% of jobs will be automated" numbers to their roots and they collapse into two families: the 2013 Frey-Osborne occupation-scoring method, now widely criticized and largely superseded, and the 2023 OpenAI-authored task-exposure method that underlies or partly underlies the IMF's headline figure and the major consultancies' frameworks. One genuinely independent instrument stands apart — the World Economic Forum's employer survey, a different kind of measurement entirely. Citing two of these as corroboration is citing one source twice. This filing therefore scores labor architectures against measured displacement only, with forecasts quarantined.

What the measurement shows is narrower and sharper than either the alarm or the dismissal. National employment shows no AI-attributable break; a New York Fed study found exposed and unexposed occupations already diverging before ChatGPT's release, with no additional break after. In freelance marketplaces, two independent research teams find real declines in writing and translation work. And one finding does not fit the calm aggregate picture: early-career workers aged 22–25 in the most AI-exposed occupations show a 13–16% relative employment decline in payroll microdata (16% in the paper's current version, 13% in its first), with software developers in that age band down about 20% from their late-2022 peak. That is narrow, real, and precisely targetable — and no architecture in the standard debate targets it.

Washington blocks; it doesn't build

Congress has twice tried to stop states from regulating AI and twice failed — a ten-year moratorium stripped from the 2025 reconciliation bill by a 99–1 Senate vote, and a similar rider dropped from the defense authorization after eighty-one House members objected. Having lost legislatively, the executive branch shifted to litigation: a December 2025 order created a Justice Department AI Litigation Task Force, which in April 2026 intervened against Colorado's algorithmic-discrimination law — the first time the federal government has gone to court to invalidate a state AI statute. Colorado's enforcement is suspended pending that case.

One correction this filing owes its own first draft: the DOJ's actual theory is narrower than "the federal government opposes state AI regulation." Its complaint presses Equal Protection claims only — not the First Amendment, dormant Commerce Clause or vagueness theories the private plaintiff is arguing, and neither party pleads preemption at all. The remedy it seeks is not narrow, though: DOJ pleads the statute's duties inseverable and asks the court to declare all of SB24-205 invalid and enjoin its enforcement. And California's frontier-AI transparency law, Texas's TRAIGA, and Utah's amended act are all in force with no federal action against them. Colorado is so far the exception, not the pattern. What holds is the shape: federal activity to date has been aimed at stopping state law, not at replacing it with a federal rule that binds anyone.

The coalition math: which fixes can actually pass

Four camps organize AI politics — safety organizations, acceleration advocates, civil-rights groups, and labor — and the standard assumption is that they deadlock everything. They don't, quite. Two architectures draw support from three of the four: protecting state-law primacy, and disclosure and transparency mandates. Only the acceleration camp sits outside both coalitions — opposed on state-law primacy, mixed on disclosure. But the safety camp's signature instrument, licensing frontier labs against compute thresholds, is genuinely isolated — the civil-rights and labor organizations have no located position on it at all, which is harder to build a coalition from than opposition would be.

One structural fact belongs in the open rather than in a footnote. The frontier labs fund a material share of the ecosystem that studies and evaluates them: an industry-funded safety fund makes grants to researchers who evaluate the funders' own models; the largest US AI-policy research center was built on a founding philanthropic grant and has taken industry money since; one lab runs a $200 million fund for external research on AI's labor effects — one of this filing's own subjects. This is recorded as a disclosure column, not an accusation of capture. One evaluator's practice is worth naming as the contrast: it accepts model access but no cash from the labs it assesses.

What the old regimes teach — including the part that hurts

Four precedents, each with its disanalogy stated as plainly as its analogy. FDA premarket review is the model most AI-licensing proposals borrow, and its risk-tiering does transfer — but it evaluates a frozen product for a stated purpose, at roughly $118 million per high-risk device and $2.6 billion per drug. NEPA is the cautionary case: environmental review averages 4.5 years and has become a delay point somewhat independent of environmental outcomes, though its enforcement hook binds federal agencies, not private firms, and an AI disclosure law would not inherit it. China's algorithm registry is a real existence proof that a state can compel disclosure of training-data provenance — with about 45% actual coverage, only successes published, and enforcement leverage no US constitution supplies.

Nuclear regulation is the one that cuts both ways, and this filing owed it an honest hearing because its own hypotheses leaned skeptical of governability. The Nuclear Regulatory Commission's oversight process — resident inspectors on site, continuous inspection against a published manual, mandatory event reporting — is a working existence proof that continuous, independently verified oversight of a high-consequence technology is achievable. It is also bound up with the cost ratchet that helped end American nuclear construction: requirements tightened mid-build and never loosened. The two halves share a mechanism. You cannot import the verification without confronting the ratchet, and AI iterates in weeks where reactors took a decade.

A pattern surfaced across three of these independently, and it is the filing's quietest real finding: FDA approval, product-liability doctrine, and environmental review all assume a fixed artifact assessed at a moment. Continuously retrained software breaks that assumption in the same way each time. That is not three unrelated doctrinal quirks — it is one structural mismatch that AI governance keeps hitting from different directions.

The scorecard, corrected

Nine architectures, five objectives, six weightings. The red team earned its keep: the draft's rankings table did not match its own raw scores in a single one of the six columns, and two cells were scoring the wrong kind of evidence — one credited a proposed statute for the size of the problem it would target rather than any demonstrated effect, the other quietly gave the do-nothing comparator a better harm score than the status quo its own text called identical. All of it is in the log, with the corrected table hand-verified twice.

Corrected twice — a red team, then an independent blind re-score that moved eleven more cells — state-law primacy and disclosure/transparency mandates now co-lead most weightings, state-law primacy carried by the only large, multiply-sourced harm-reduction evidence in the entire record, Illinois's biometric privacy law, which produced a $650 million settlement and a company-wide facial-recognition shutdown where no federal guidance has moved a firm at all. Frontier-lab licensure shares the floor with the voluntary status quo on four of the six weightings — though not on the catastrophic-risk weighting licensure exists to serve, where the voluntary status quo alone holds the bottom; the comprehensive federal statute lands mid-pack as an all-neutral row, because the implemented EU evidence was read as supporting nothing above or below neutral on any axis — a reading the correction in Part 3 now contradicts on the statute. Those placements need their reason stated or they will be misread: they reflect scoring proposals as actually drafted, and no US frontier instrument — enacted or pending — requires anyone outside the developer to evaluate the model. Nuclear regulation proves a verifiable version is possible. No American bill is that version. The score is measuring the gap in what has been proposed, not a verdict that the goal is wrong.

Three of the four results just stated turn on a single scorecard cell each. A Phase 2 steelman contested four cells and published both readings rather than re-scoring on its own authority; the arithmetic is in a committed script that reproduces all fifty-four published values before computing a variant. Move frontier licensure's concentration cell from 2 to 3 — the correction the blind re-score already applied to the identical unmeasured claim in the comprehensive-statute row, and never applied here — and "shares the floor on four of the six weightings" becomes true on none. Move disclosure's harm cell from 4 to 3, the same correction the red team applied when it stopped a row being credited for the size of the problem it would address, and the co-lead ends: state-law primacy leads alone on all six. Move the comprehensive statute's catastrophic-risk cell from 3 to 4 on the EU evaluation power in Part 3's correction, and the row this page calls mid-pack co-leads four weightings and takes the catastrophic-risk weighting outright at 3.4. One result held under every variant tested: the voluntary status quo still scores worse than doing nothing, on all six weightings, even after the quotation behind its lowest cell was corrected to the narrower scope its source actually states.