Governments across the world are still trying to figure out how artificial intelligence should be regulated. But according to a new study, getting those rules wrong could actually make AI systems less safe, not more. Researchers from Cornell University and Carnegie Mellon University say regulations that place most of the responsibility on companies using AI, instead of the firms building the technology itself, may have unintended consequences. Their findings, published in the Proceedings of the National Academy of Sciences (PNAS), suggest that a poorly designed regulatory framework could leave important safety gaps rather than close them.
Researchers Say The Focus Is On The Wrong Companies
The study argues that policymakers should pay more attention to the developers behind foundation AI models instead of regulating only the businesses that integrate AI into products like chatbots, healthcare tools or online shopping platforms. If AI companies know that app developers will ultimately be held responsible for deploying systems safely, they may gradually reduce their own investment in safety work. Things like independent safety testing or third-party audits could become less of a priority because someone else is expected to deal with the risks later. To reach this conclusion, the researchers used economic modelling and game theory to examine how companies react under different regulatory approaches. Their analysis found that the way rules are written can directly influence how much effort AI developers put into safety.
The ‘Free-Riding’ Risk
The researchers describe this behaviour as “free-riding.” In simple terms, it means one group starts relying on another to carry the burden.
In this case, foundation model developers could assume that companies building AI-powered applications will take care of safety issues. Those application developers, meanwhile, may not have the same level of visibility or control over the underlying model. The result is an accountability gap where critical safety measures risk falling through the cracks.
The findings arrive as governments continue debating how strict AI regulation should be. While some policymakers believe lighter rules are necessary to keep innovation moving and remain competitive globally, others argue that stronger guardrails are essential to tackle challenges ranging from misinformation to job losses and privacy concerns.
The researchers don’t see those goals as mutually exclusive. Their study suggests that regulations work best when responsibility is shared. In other words, both the companies creating powerful AI models and those deploying them should be expected to invest in safety, rather than leaving the job to one side alone.
