Artificial intelligence has become the subject of a heated debate over whether it could cause catastrophic harm, and how soon. Those closest to its development are pulling in three directions. The first camp, whose best-known voices are Sam Altman (OpenAI) and Dario Amodei (Anthropic), argues that safeguards and international coordination must catch up with the most capable systems before those systems outrun them. Their case rests on asymmetry: developers see new capabilities long before governments do, and commercial pressure punishes any laboratory that slows down alone.

The sharpest technical challenge comes from Yann LeCun, formerly Meta’s chief AI scientist and now the founder of AMI Labs. Today’s systems, he argues, remain brittle: they lack durable understanding and cannot truly plan. To regulate them as though speculative future capabilities already existed would be a mistake. Those who share his view favour rules aimed at demonstrated harms and specific uses. Premature licensing, they warn, would lock mistaken assumptions into law and entrench the incumbents best placed to comply.

The third camp champions openness and speed. Its most prominent advocate, Jensen Huang (Nvidia), argues that AI should spread as widely and quickly as possible. Open models, in his view, let more researchers, start-ups and countries build on the technology, and every nation should develop its own “sovereign AI” rather than depend on a few providers. The deeper claim is that concentrating foundational capability in a handful of firms is a risk in itself.

Each camp has put its finger on a real danger. The cautious fear failure that cannot be undone; the sceptics, speculative rules and regulatory capture; the advocates of openness, power concentrated in too few hands. Yet each tends to treat its own danger as the one that matters most.

What matters more, to my mind, is not which camp has read the future correctly—no one yet can—but whether a failure, once it happens, can be prevented, contained or corrected. Governance should be calibrated accordingly: light where mistakes can be managed, strict where they cannot.

Leadership begins before compliance

Regulation is necessary. Rules are what keep a society, an organisation, even an individual, fit to operate within it: no game can be played fairly if its players do not all know them. Yet regulation is no substitute for leadership. Law is, by its nature, slower than the technology it governs, and compliance alone says little about whether an organisation is behaving responsibly.

Colombia—where I experienced the recent devastating earthquake in August—offers an instructive parallel. Responsible builders do not merely satisfy minimum code; they feel a duty to those inside when the ground shakes. Regulation sets the floor society tolerates; leadership decides how far above it duty demands. AI leadership should be held to the same standard: knowing in advance how far beyond the regulatory floor one's duty extends.

In practice, that duty resolves into four things AI leaders and teams must be accountable for: knowing what they are building, knowing how errors or misuse will be caught, deciding who has the authority to pull the plug, and—above all—ensuring the business keeps running if the system can no longer be trusted.

Freedom should follow control

Knowing when to pull the plug, in turn, depends on knowing how much room there was to experiment in the first place. Innovation needs room to try bold ideas, occasionally including dangerous capabilities that are needed to build effective defences. Medical research offers an imperfect but instructive parallel: sometimes a hazard must be studied in order to be stopped. What makes such work legitimate is containment, competence and oversight.

Lean management already supplies a simple rule: experiment freely where failure can be contained; regulate strictly where it can escape.

Call it proportional freedom. Low-risk productivity tools and self-contained administrative workflows warrant a light touch. Systems that bear on people’s finances, physical safety, legal rights or access to essential services do not. They should be rigorously assessed before launch and monitored continuously afterwards, as is already routine in medicine and other sensitive industries. We are social creatures, and society itself is a system: like any unconstrained system, left without governing parameters it drifts toward disorder—that is entropy, not politics. History confirms it: unchecked liberty has never produced fair freedom, only anarchy fighting for power.

Responsibility must outlive its release

Proportional freedom, however, assumes someone remains in a position to tighten the reins once a system leaves the lab. That assumption does not always hold. Open and closed models pose different problems. A model hosted by its developer can be monitored, adjusted, restricted or withdrawn. A downloadable open-source model cannot: once released, it can be copied, altered and passed on far beyond its creator’s reach.

Such a model is, after all, a digital asset, and I would argue that the law should require audit trails recording when it is copied, modified and redistributed. Since no developer can track code once it is downloaded and run offline or on decentralised infrastructure, the practical expectation must sit with whoever deploys it: when enterprises adopt open-weight models internally, they must maintain their own provenance records, audit logs and access controls—even if the original creator cannot. That would not make the original developer liable for everything that follows. It would ensure that accountability does not vanish simply because control has been surrendered.

The principle should apply to open and closed systems alike once they cross defined risk thresholds. Developers and hosting platforms should keep reliable records of a model’s provenance, its material modifications and who was authorised to distribute it. Where that traceability cannot be maintained, the gap should weigh against unrestricted release, and against those responsible when misuse follows.

Societies need rules that let them develop in a healthy and orderly way, for everyone’s benefit. Reckless use of these systems should therefore carry penalties and, where the harm to society is serious, criminal liability.

A layered architecture of accountability

Provenance and audit trails only work, though, if every actor along the chain knows which part of the duty is theirs. AI governance must distribute responsibility across all levels of society. Accountability should follow proximity—aligning technical knowledge, political mandate, and legal authority to effectively manage risk at every tier.

License capability, audit consequence

A single licensing regime for the entire AI ecosystem would be excessive, I agree. But organisations building foundation models above a defined risk threshold should be identifiable, registered and bound by enforceable duties. That threshold should be set by international principles and written into national law. High-risk activities, such as unrestricted release, should require a documented safety case and independent review.

Adoption calls for a different tool. As I see it, licenses belong to the building of models and audits to their use, with the emphasis on consequential use. Any deployment with moderate or serious effects on people, institutions or infrastructure should face mandatory audits, scaled to the risk, both before and during operation.

Institutions before certainty

Uncertainty is often invoked as a reason to delay governance. It is better understood as a reason to design it carefully. Unreliable forecasts argue against rigid rules that treat speculation as fact. They argue just as strongly for building the machinery of scientific assessment, common testing methods, incident reporting and emergency coordination before a crisis strikes.

Governance should not trail innovation the way an inquiry trails an accident. It should be part of the infrastructure that makes innovation sustainable.

International non-proliferation regimes offer useful principles, if not a template. AI is informational, fast-moving and trivially easy to copy. The transferable lesson is that capabilities with global, dual-use consequences need shared boundaries, independent evidence, differentiated duties and verification that does not rest on trust alone.

Nor need strict oversight be permanent. Regulation should lighten as institutions mature: as independent bodies learn to evaluate advanced systems, regulators learn to coordinate, serious misuse becomes detectable and common rules become enforceable. Trust should be earned through demonstrated competence, not presumed because a regulator exists.

The executive test

That same discipline of earned trust applies inside any single organisation, long before regulators ever ask. For boards and senior executives, the test is not whether an AI system is impressive, nor whether a vendor vouches for its safety. It is whether the organisation, through its own independent review, can answer four questions:

• Do we understand our AI systems and the data that feeds them?
• Can we detect errors or unexpected behaviour?
• Can we reconstruct consequential decisions?
• If the system fails or is misused, can we still recover?

Leaders must also recognize that developing AI and deploying it are distinct undertakings—each carrying unique risks and requiring its own distinct safeguards. Bringing these four questions to both stages of the lifecycle is how governance moves out of boardroom debate and becomes an operational habit.

My final thoughts

This is a complex, many-layered subject with no ready-made solution, and my own vantage point is limited: a consultant sees only part of what AI is doing to society. The aim here is not to lecture but to offer one perspective and invite others to test it. If it helps sharpen the conversation about fair and workable AI governance, it will have done its job.

AI governance is not a tug-of-war between hope and fear—it is a matter of risk management. We must measure, understand, and regulate AI's hazards relative to our ability to contain serious failure. Innovation should expand only where safety guarantees can follow; accountability must tighten as risks grow irreversible. Governance doesn't need to predict the future perfectly. It just needs to guarantee that when we get it wrong, we can still recover.

Moving from these governing principles to daily practice is often the hardest step, but it is precisely where strategy turns into organizational confidence.

References

The research paper draws on public materials from the United Nations, IAEA, EU AI Act, NIST, OpenAI, Anthropic, Meta and public reporting on frontier AI governance. Opinions and proposed principles are the author’s own.