Washington’s struggle to regulate artificial intelligence has begun to look a lot like trying to nail Jell-O to the wall. The latest evidence came in the form of draft guidelines from the U.S. AI Safety Institute, a newly minted office under the National Institute of Standards and Technology (NIST). This effort, born out of President Biden’s 2023 Executive Order on AI, is intended to tame the risks of rapidly advancing technology. But as so often happens with government cures, this one risks being worse than the disease.
NIST’s Influence and Overreach
To be clear, NIST is not a lightweight. For decades, the agency has been a trusted arbiter of technical standards in industries ranging from manufacturing to cybersecurity. Its work often forms the backbone of regulations that ripple through the economy. That is why policymakers, industry leaders, and academics take notice when NIST puts out guidance—even if the guidance is, on paper, “non-binding.” California’s SB 1047 already codifies NIST language into law, and other states are circling to do the same. What begins as advice can quickly harden into mandates.
A Narrow—and Misguided—Focus
The AI Safety Institute’s draft, titled Managing Misuse Risks in Dual-Use Foundation Models, sets out seven objectives for managing misuse. Yet, it places the weight almost exclusively on foundation model developers. This approach is as shortsighted as it is impractical. The AI ecosystem is not a single-lane highway—it is a complex network of developers, deployers, integrators, and end-users. To pin the entire burden on the initial model creators is to ignore how responsibility must be shared downstream.
An Impossible Task for Developers
The guidelines openly admit that anticipating every conceivable misuse is essentially impossible, yet they still demand developers attempt precisely that. The expectation borders on fantasy. Even national security agencies, with entire intelligence networks and decades of experience, struggle to forecast malicious behavior with any consistency. Asking a model developer in Silicon Valley or Boston to chart detailed threat profiles for every possible bad actor is bureaucratic theater—not serious policy.
The Labyrinth of Risk Analysis
Perhaps the most concerning piece is the proposed risk measurement framework. Developers would be required to create elaborate profiles of potential threats, assess how frequently and at what scale misuse might occur, and evaluate the impacts of each hypothetical. This is not only speculative; it is paralyzing. If taken seriously, it would slow AI development to a crawl, forcing companies to spend more time filling out paperwork than building safe, innovative products.
We’ve seen this pattern before. Environmental policies like the National Environmental Policy Act (NEPA) were designed to protect ecosystems but often ended up bogging down infrastructure projects for years. The same “precautionary principle” is creeping into AI, where the fear of potential harm outweighs recognition of potential progress.
Regulatory Overreach Waiting to Happen
Because these guidelines can migrate into law, they hand regulators a lever to enforce an overly cautious posture. That might sound comforting to risk-averse politicians, but it creates a chilling effect on innovation. Countries that embrace experimentation will race ahead, while the United States trips over its own red tape. In the name of safety, we could end up sidelining our own competitive edge.
Ignoring Distributed Risk Management
The draft further fails by overlooking how risk management naturally distributes across the AI lifecycle. Some risks—such as model poisoning—are best handled at the developer stage. Others, like ensuring responsible deployment, fall on intermediaries or enterprise users. And when harms do occur, traditional ex-post tools like civil liability or contract law can be powerful mechanisms for accountability. Pretending one group can—or should—do it all is a recipe for regulatory failure.
The Core Danger
If finalized without significant revision, the NIST guidelines will do two things: stifle innovation and misallocate responsibility. By overburdening developers while ignoring downstream actors, Washington risks creating a brittle system where accountability is misplaced and progress is delayed. The irony is that in the name of “safety,” we may actually create greater risk—handing global leadership in AI to others while tying ourselves in knots.
Artificial intelligence is not going to wait for NIST to perfect its paperwork. Neither should policymakers. The right path forward is to recognize that AI risk is shared, dynamic, and best managed with flexible tools—not rigid, top-down dictates. Otherwise, we’ll be left with all the bureaucracy in the world and none of the innovation we need.
Endnotes
- National Institute of Standards and Technology, Managing Misuse Risks in Dual-Use Foundation Models (Draft Guidelines, 2025).
- Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, The White House, October 30, 2023.
- California Senate Bill 1047, “Safe and Secure Innovation for Frontier Artificial Intelligence Models Act,” 2024.
- National Environmental Policy Act of 1969, Pub.L. 91–190, 83 Stat. 852.
- U.S. AI Safety Institute, “Challenges in Anticipating AI Misuse,” Draft Guidelines, 2025.
Andrew McConnell is a Contributor for Direct Line News. Contact Andrew at Andrew.McConnell@mcgopclub.com
Direct Line News is a Maryland-based free-access publication committed to the Republican reform tradition.
About The Author
