Writing another generic rulebook for software tools won't stop digital fraud. Governments are rushing to draft restrictions for artificial intelligence models, yet most lawmakers completely miss the foundational layer. If you want real safety, you have to look at the underlying information that trains these systems.
Law enforcement agencies and cybersecurity experts are sounding alarms as synthetic scams and digital identity fraud surge. Police forces have flagged synthetic media and deepfakes as major cyber threats, citing incidents where criminals fabricated identity documents to open fraudulent bank accounts for money laundering. When courts and legislators only chase surface-level applications, they fail. Technology evolves too fast for app-by-app bans to work.
Legislators need to shift focus toward data governance and structural safety standards. Without strict controls at the intake layer, every downstream rule becomes useless.
The Problem With Chasing Software Features
Trying to outlaw individual programs or specific chatbot behaviors is like trying to catch water with a net. By the time a bill passes through committee, the technology has already morphed into something new. Innovation moves at breakneck speed. Bureaucracy moves at a crawl.
Duncan Chiu, an innovation and technology sector lawmaker, pointed out that legislation cannot easily keep pace with individual application updates. Artificial intelligence only operates because of the underlying information fed into it. If you don't secure the pipeline, you don't secure anything.
This is why regulatory frameworks need a fundamental shift. Instead of policing how a specific model answers user questions, authorities should focus heavily on how information is collected, stored, and audited before it ever touches a training pipeline.
Taking Cues From Tiered Protection Systems
Look at how other major jurisdictions manage digital intake. Systems like mainland China's Data Security Law offer practical reference points for regional policymakers. That framework establishes a tiered protection structure. It requires organizations to implement differentiated management and protection measures based on the actual sensitivity and importance of the information.
Instead of applying a single blanket policy across the board, a tiered model makes sense for several reasons:
- Low-risk public data faces minimal administrative friction, keeping open innovation alive.
- Sensitive personal data triggers strict cryptographic checks and access logs.
- Critical infrastructure inputs require continuous security auditing by independent third parties.
When rules match the actual risk level of the information, compliance becomes manageable for startups while keeping malicious actors locked out.
Fixing Liability Boundaries
Another massive headache for modern legal systems is accountability when automated products fail. If an autonomous system causes financial damage or physical harm, who pays? Is it the developer who wrote the core algorithm, the corporation that deployed it, or the data broker who supplied the training sets?
A working group led by the Department of Justice is currently reviewing whether existing legal frameworks are adequate to address liability issues arising from artificial intelligence accidents and damage. Right now, courts are wrestling with a patchwork of outdated tort laws.
Clear liability boundaries will build public confidence far faster than vague ethical guidelines. People need to know that if a system goes rogue or gets weaponized by fraudsters, there is a clear, enforceable path to justice.
What Needs To Happen Right Now
If you are building products or drafting corporate compliance strategies, waiting for governments to figure out the rulebook is a losing game. You need to audit your information pipelines today. Map out every dataset your models touch, verify consent lineages, and implement strict tiered access controls internally.
Governments must stop treating artificial intelligence as a standalone gadget and start treating it as an information ecosystem. Fix the data governance layer, set clear liability boundaries, and public trust will follow naturally.
