The Core Idea: A Risk-Based Approach
The central argument is that not all AI is created equal, and therefore, it shouldn't be regulated with a one-size-fits-all rulebook. Proponents of risk classification want to sort AI systems into different categories based on their potential for harm
before applying specific rules. This logic is already in practice in the European Union's landmark AI Act, which sorts systems into four tiers: unacceptable risk, high risk, limited risk, and minimal risk. The principle is straightforward: the greater the potential for an AI system to negatively impact people's safety, livelihoods, or fundamental rights, the stricter the safeguards and regulations that should govern it.
What Would a Risk-Tier System Look Like?
Drawing inspiration from the EU's model, a risk-based framework would place different AI applications on a spectrum. 'Unacceptable risk' applications would be banned entirely. These include systems that use manipulative techniques or enable mass social scoring by governments. 'High-risk' systems would face the most stringent requirements. This category would likely cover AI used in critical sectors like healthcare, employment, critical infrastructure, and law enforcement, where a malfunction or bias could have severe consequences. These systems would require rigorous testing, human oversight, and transparent documentation before they could be deployed. 'Limited risk' AI, like chatbots, would have lighter obligations, mainly centered on transparency—ensuring users know they are interacting with an AI. Finally, 'minimal risk' applications, such as AI in video games or spam filters, would be largely exempt from the rules, allowing innovation to flourish where the stakes are low.
The Argument for Classifying First
Advocates for this methodical approach, including many AI researchers and safety organizations, believe it is the only way to create sensible, effective, and durable regulation. They argue that broad, sweeping rules risk either being too weak to prevent catastrophic harms from the most powerful systems or too restrictive, stifling innovation in low-risk areas. By classifying risks, regulators can focus their resources on the applications that pose the most significant threats. This targeted approach prevents over-regulation of beneficial AI while establishing strong guardrails where they are needed most. It also provides much-needed clarity for businesses, allowing them to understand the compliance burden for a specific product before investing heavily in its development.
Challenges and Counterarguments
Not everyone is convinced that waiting to classify risks is the right move. A primary concern is speed. The rapid pace of AI development means that by the time a perfect classification system is agreed upon, the technology may have already created irreversible problems. Some critics argue that the 'patchwork' of state-level laws already being enacted in the U.S.—addressing everything from deepfakes to chatbot safety—is a necessary response to an urgent situation, even if it's not perfectly coordinated. Furthermore, classifying risk is difficult. The potential impact of a new AI system isn't always obvious before it is deployed at scale, and a system's risk profile can change depending on how it's used. There's a risk of getting the classifications wrong, creating a false sense of security or leaving dangerous loopholes.
