“We need AI laws” sounds like a request to be regulated. Listen again.
Every few months a technology executive sits in front of a congressional committee and asks for regulation. Sure, some of the asks are sincere, and the committee usually takes them as a sign of good faith. But the request carries a second claim underneath it, and the second claim is the one doing the work: until those laws pass, the field is open. No rule reaches us yet. Write one, and we’ll follow it.
Kirsten Martin, who runs Notre Dame’s technology ethics center, took that claim apart this month at the annual conference of NASPAA, the body that accredits MPA programs like mine. Her answer was short. The claim comes from one place, the tech industry and the computer science departments that feed it, and it is wrong on the facts. Who goes to prison, who gets arrested, who qualifies for welfare, housing, or credit: every one of those is a decision with a statute attached, with an agency attached, with due process rights attached, with decades of case law attached. Swapping the person making the decision for a model repeals none of it. The gap is in enforcement. Nobody, in Martin’s telling, is asking them to follow it.
The law attaches to the decision
Lending is the cleanest case. The Equal Credit Opportunity Act and Regulation B require a creditor who denies you credit to tell you the specific principal reasons why. That requirement is from 1974. It does not say “unless the decision was made by a model you don’t understand.”
In 2022 the Consumer Financial Protection Bureau issued a circular saying exactly that: a creditor cannot excuse noncompliance because its model is “too complicated, too opaque in its decision-making, or too new.” Interpretability is a research problem in computer science. In lending it has been a legal requirement for fifty years. John Friedman, the Brown economist behind Opportunity Insights, made the point on the same panel without naming the statute: lending is a corner of policy nobody thinks of as being about AI, and it already has the rule the AI debate keeps asking for.
The CFPB withdrew that circular in May 2025, along with sixty-six other guidance documents, on the stated ground that the Bureau was pulling back from enforcement. The circular is gone. The statute and the regulation stand. A creditor using a model that cannot produce reasons is in the same legal position it was in before the circular existed, which is the position of a creditor breaking the law. The guidance only ever restated what the law already said. Its withdrawal changes who is watching, not what is required.
The same logic runs across the rest of the panel’s examples:
- In April 2023 the FTC, CFPB, the Justice Department’s Civil Rights Division, and the EEOC issued a joint statement committing to enforce existing law against automated systems. Lina Khan’s line from the release: “There is no AI exemption to the laws on the books.”
- Volkswagen’s defeat device was software. It was prosecuted under the Clean Air Act as written, and nobody waited for a software-emissions statute. Martin called it an early AI regulation case. It wasn’t AI, and it makes the point better for that.
- Automated license plate readers of the kind Flock sells go up in city after city as though procurement were the only question. Existing law already governs whether a police department can collect that data and what it may do with it. The purchase order gets treated as the policy decision.
- Friedman’s test for a model judging SNAP eligibility is to ask how we would judge a caseworker doing the same thing. We have those standards. We’ve had them since the first caseworker.
Why the move works anyway
None of this is new, of course. Anyone who has worked in environmental policy recognizes the move from steel and autos, and anyone who has sat through a rate case has heard “regulate us and we go out of business.” What the novelty claim adds to the old repertoire is a waiting period. A call for bespoke legislation concedes regulation in principle while deferring it in practice, and the deferral is the whole prize.
Two things follow, and I’ll own both as my inferences rather than the panel’s. First, the industry asking for the new law will be at the table when the new law is drafted. That is a better seat than the one a defendant gets in an enforcement action under the old law. Second, the claim works on the regulator more than on the public. Courts, the CFPB, the EPA, state public utility commissions, among others: the forums exist and have jurisdiction. The novelty claim succeeds when it persuades a forum that it lacks jurisdiction, because then the actor never has to explain itself at all.
The test
But does the argument travel? Does it hold for the robotaxi, the warehouse robot, the camera on the doorbell? And what about the weapon? The same move shows up wherever an AI company asks for rules, and the way I sort the claims is to ask what the law attaches to. Where it attaches to the decision, the novelty claim fails. Where it attaches to the person making the decision, the claim has something to it.
Autonomous vehicles are the first kind. When a Cruise robotaxi dragged a pedestrian in San Francisco in October 2023, the California DMV suspended the company’s permit under authority it already had, and NHTSA opened a defect investigation under the Safety Act—the same statute it uses on a bad brake line—with no new law, no new agency, and no waiting period. Nobody asked for one. Smart devices are the same. The FTC has used Section 5 of the FTC Act against connected cameras since TRENDnet in 2013, and Ring’s 2023 settlement over employees watching customer video was an ordinary deception case with an unusual defendant. The device was new. The deception was not.
Weapons are the second kind. The law of armed conflict attaches to the decision to kill, and Article 36 of Additional Protocol I already requires states to review any new weapon for legality, so the formal structure is in place. But every part of that law assumes a human who can form intent and bear responsibility. To put a finer point on it: a credit model hides the creditor, and the creditor still exists and can still be fined; an autonomous weapon removes the soldier, and there is nobody left to court-martial. The drone rules the FAA finally wrote in 2016 are the smaller version of the same thing: aviation law assumed a pilot aboard, and no amount of enforcement could put one in a quadcopter.
So the question to put to any “we need new law” claim is which part of the old law assumed a human in the loop, and whether the new system removes that human or just hides them. Most of what the industry asks for sits on the credit side of that line and borrows the weapons argument for cover.
The pair
The claim has a twin, and I keep seeing both in the same fights. Data center developers rarely argue that their facility is unprecedented. They argue the opposite: it’s a warehouse, it’s a light industrial use, the zoning already covers it, the planning commission has seen this before. Novelty when old law would bind. Familiarity when old law would permit.
Watch for the pair. A firm that says “this is unprecedented, you need new rules” to the consumer protection agency and “this is an ordinary industrial use” to the county planning commission knows exactly what it is building. It has read both rulebooks and is choosing the one that reads shortest.