By Nicole Junkermann
AI’s commercial capabilities are accelerating faster than the institutions meant to govern them. That’s not a reason for alarm. It’s a reason for the people closest to the technology to say so – and to act.
In Brussels last autumn, officials finalised the last major provisions of the EU AI Act. By the time the ink had dried, several of the models it sought to regulate had already been superseded. That isn’t a failure of the legislative process so much as a structural feature of it. Technology doesn’t wait for consensus.
The question is what follows from that observation. For some, it’s an argument against regulation altogether. For others, it’s a reason to legislate faster. Neither position is quite right. In truth, what it reveals is a deeper problem: the people who understand the technology best have largely stayed quiet in the governance conversation, and the people setting the rules have been writing them without enough input from those who’ve actually deployed the systems they’re describing.
That’s a gap worth closing – and closing quickly.
The legislation is real. So are its limits.
The EU AI Act is serious legislation. It establishes risk tiers, mandates transparency requirements, and creates liability frameworks that will shape how AI is built and deployed across the continent for years. It deserves credit for attempting something genuinely difficult.
But its architecture has a structural weakness. It categorises risk by application context rather than by model capability. A system that can cause serious harm in one deployment might clear the regulatory bar if it’s packaged differently. The categories are fixed; the technology isn’t. That gap will be exploited, not necessarily maliciously, but because the incentives point that way.
This isn’t a novel problem. Regulatory frameworks for pharmaceuticals, financial products, and nuclear technology all struggled with the same lag. What’s different with AI is the pace. A pharmaceutical takes years to move from lab to market. A new foundation model can be fine-tuned, deployed, and scaled within weeks. The window between capability and consequence is narrower than anything regulators have had to manage before.
Governance happens before the policy document.
There’s a version of this conversation that treats investor behaviour as separate from the governance question. It isn’t. The decisions that shape how AI develops – what gets funded, at what scale, with what constraints – are made long before a regulator sees a product. Capital allocation is where governance actually begins.
I’ve spent the last decade investing in technology at the infrastructure layer: the systems that other systems are built on. What I’ve observed is that the choices made earliest in the development cycle are the ones that are hardest to reverse. A model trained on poorly curated data, deployed at scale, and then post-hoc patched to behave more safely is a fundamentally different proposition from one where the constraints are part of the original design. The first approach is cheaper in the short run. It’s considerably more expensive in every other way.
Investors who understand this have leverage that regulators don’t: the ability to set terms before a product exists. What data governance standards apply? What does the company’s accountability structure look like if something goes wrong? Are the people building this system thinking about failure modes, or just product-market fit? These aren’t soft questions. They’re the questions that determine whether a company is building something durable or something that will eventually require an expensive intervention to fix.
The window is narrower than it looks.
None of this is an argument against regulation. It’s an argument that regulation and investor accountability have to run in parallel – and that the second has been moving too slowly relative to the first.
The honest reason for that is short-termism. Governance conversations are uncomfortable, time-consuming, and don’t show up in a fund’s quarterly numbers. It’s easier to invest in a capable team, trust that they’ll figure it out, and move on to the next deal. That logic has worked well enough when the consequences of getting things wrong were contained. It works less well when the systems in question are shaping how people find information, make decisions, and understand the world around them.
There’s also a reputational dynamic at play. Investors who push back on governance questions can find themselves deprioritised in competitive rounds. The social norms of the industry reward optimism and penalise friction. Changing that requires founders and investors to make the case – publicly, repeatedly – that governance questions aren’t obstacles to building good companies. They’re part of what building a good company means.
Some are making that case. Not enough are.
What responsible looks like in practice.
Concretely, this means a few things. It means due diligence that goes beyond technical performance to include questions about training data provenance, bias testing, and incident response protocols. It means term sheets that include accountability provisions, not as boilerplate, but as negotiated conditions. It means being willing to pass on deals where the answers to those questions aren’t satisfactory – and being transparent about why.
It also means engaging directly with the legislative process rather than treating it as an external constraint. The EU AI Act will be revised. The US will eventually produce federal AI legislation. The UK is still working out what its approach will be. These conversations are happening now, and the people with the most relevant operational knowledge are mostly watching from the sidelines.
That’s a choice, and it has consequences. Legislation written without substantive input from practitioners tends to regulate the last problem rather than the next one. The frameworks that actually shape how AI develops will be the ones built by people who understand what they’re shaping.
The technology doesn’t wait for consensus. But the people funding it could afford to be a little less patient about having the conversation.
