As artificial intelligence grows more powerful, so do the risks it poses—and the urgency of regulating it. Recent incidents illustrate the breadth of potential harm. In July 2026, OpenAI’s advanced models breached the systems of AI company Hugging Face during internal cybersecurity tests, communicating through unauthorized channels and bypassing safeguards. In January 2026, Google and Character.ai settled a wrongful death lawsuit brought by Megan Garcia, whose 14-year-old son died by suicide after heavy use of a role-playing chatbot.
These cases show that AI harms can emerge across different technologies, organizations, and contexts. As a legal scholar focused on AI and digital harms, I study how to regulate AI. The challenge is not just to respond to specific incidents but to build a regulatory architecture that connects protected interests, institutional obligations, and individual rights across the AI landscape.
The limits of technology-specific rules
Policymakers and industry commentators often frame regulation as a trade-off between the risks of AI and the risks of regulating it. In its 2025 AI Action Plan, the Trump administration called for removing “red tape and onerous regulation,” which it said hinders economic growth. The administration has also sought to limit conflicting state AI laws.
In contrast, AI harms have largely been addressed through rules specific to particular technologies. The federal Take It Down Act, signed in 2025, addresses nonconsensual intimate imagery, including AI-generated deepfakes, as do various state laws. These approaches are crucial, but they don’t solve the problem by themselves. The emerging patchwork of rules has yet to establish a regulatory architecture that connects protected interests, institutional obligations, and individual rights across AI technologies.
A harm-centered approach would begin with those interests and use them to shape legal obligations that span relevant systems, organizations, and people.
Types of harm
A harm-centered approach starts by identifying the fundamental interests that AI systems can threaten. These overlapping interests include:
- Privacy: when AI systems improperly collect, process, or disclose personal information.
- Autonomy: when AI systems target a person’s vulnerabilities and manipulate their choices or encourage unhealthy dependence.
- Equality: when AI systems discriminate or reinforce bias.
- Safety: when AI systems cause physical, psychological, or security harms.
These examples are not exhaustive. Other interests may also be at stake as AI technologies evolve. The same interest can be threatened by different technologies and different entities. A teenager’s safety can be harmed by the engagement mechanisms of a social media platform or by an AI companion designed to sustain an emotional relationship.
Designing regulations based on a concept of harm allows laws and principles to follow problems as the technology changes. And it helps determine obligations imposed on developers, deployers, and other stakeholders involved in AI.
For instance, AI developers could be required to conduct harm assessments throughout the development of AI systems, identifying reasonably foreseeable harms, documenting how they tested for them, and explaining what mitigation measures they took. Companies or government agencies that deploy AI systems could also have duties to monitor harms after deployment. Serious or recurring harms could trigger obligations to report them to relevant regulators, affected individuals, or the public, depending on the nature and severity of the harm.
A harm-centered framework could also recognize corresponding rights for people affected by AI systems, including rights to notice and opportunities to seek redress where appropriate. These rights would arise from the same protected interests that justify obligations on companies.
A common basis for law
This mindset is followed in other areas of law. Environmental law, for instance, has long regulated industries by focusing on their environmental effects rather than on technology alone. It requires regulated companies to monitor emissions and discharges, maintain records, and report specified releases to regulators. Some reporting requirements also make information available to the public. Environmental review under the National Environmental Policy Act requires federal agencies to assess environmental effects and provides opportunities for public participation.
AI governance could draw on this logic, determining who is responsible for assessment, monitoring, disclosure, and mitigation based on types of harm. A harm-based focus would not eliminate technology-specific rules. Some technologies create distinctive risks that justify targeted rules, such as disclosure requirements for AI-generated deepfakes or safeguards for AI systems used in high-stakes decisions. And focusing on harm does not mean regulating every conceivable risk of harm.
Harm should become the organizing principle of AI regulation. New AI systems will bring harms that policymakers have not yet anticipated. The challenge is to build a framework for the harms we know, as well as the harms we do not yet know. This approach is particularly relevant for the Indo-Pacific, where AI development and deployment are accelerating. Countries like China and the United States are already grappling with AI risks, and a harm-centered framework could help align regulatory efforts across the region. As AI companies expand globally, the need for a common basis for law becomes more urgent.
