In the first week of June 2026, Anthropic released its most capable A.I. models, Claude Mythos and Claude Fable, to a small group of vetted organizations under a new safety program called Project Glasswing. Within days, the U.S. Department of Commerce suspended access to both models to comply with export controls. Three weeks later, the Department lifted those controls, and access was restored. For most of June, the most advanced A.I. systems in the world were governed less by a written statute than by an agency’s judgment call, made and adjusted within the same month.
That sequence matters because it exposes something the A.I. industry has been slow to reckon with: the United States relies less on a codified regulatory regime and more on a set of fast-acting executive tools. Export controls, national security reviews and executive memoranda can turn access to a frontier model on or off without a new law. All it takes is an agency deciding, in a given week, that something warrants action.
That instability hasn’t gone unnoticed inside the industry. In mid-July, Demis Hassabis, the London-based CEO of Google DeepMind, published a proposal for a U.S. standards body modeled on FINRA, the industry-funded group that polices Wall Street under SEC oversight. Hassabis has said the improvised handling of the Mythos and Fable suspensions last month convinced him Washington needs a standing structure, not one-off fixes. His plan starts modestly: labs submit frontier models for voluntary review before release, with the arrangement hardening into a market requirement once the process proves itself. Hassabis runs one of the three labs racing hardest toward the frontier, and he’s making this case from London, a city that regulates A.I. through existing sector regulators rather than a dedicated law of its own. His proposal is a vote for predictability.
Now consider what was happening in Brussels over that same stretch. The EU AI Act, passed in 2024, spent much of 2026 relitigating its own start date. High-risk obligations under the AI Act, originally scheduled to take effect on Aug. 2, were delayed until December 2027 following months of negotiations among the Council, the Parliament and the Commission over the Digital Omnibus package. The requirement that member states stand up national A.I. regulatory sandboxes slipped by a full year, to August 2027. The E.U. wrote the most comprehensive A.I. law in the world, then spent two years discovering it couldn’t meet its own implementation timeline.
In London, there’s effectively no A.I. law at all. The U.K. never passed the A.I. bill rumored since the first AI Safety Summit in 2023. Instead, A.I. gets regulated the way British regulators tend to handle most things: sector by sector, through whichever existing body already has jurisdiction. The Financial Conduct Authority covers finance. The Information Commissioner’s Office covers personal data. Ofcom folds A.I. risk into telecoms security obligations. There’s no single statute to point to, and the government’s current answer to whether one should exist is a supervised sandbox, the AI Growth Lab, that lets companies test products under temporary, case-by-case exemptions rather than fixed rules.
Three governments, with three fundamentally different theories of how to govern a technology that changes nearly every day.
The American approach treats A.I. primarily as a national security and industrial policy question, governed through discretionary executive tools that move at the speed of a memo. That gives Washington enormous flexibility: it can act on a Tuesday in response to a threat nobody had written a rule for on Monday. But the rules a company operates under can shift with each administration’s read of the moment, and the same tools that suspend one company’s access could, in principle, be applied to another’s.
The European approach treats A.I. primarily as a risk to individual rights and social structures, governed through comprehensive, codified law that tries to specify in advance what counts as high risk and what happens when a company gets it wrong. That gives companies something the American system doesn’t: a text a lawyer can read and interpret. But specifying the future in a statute means amending it every time reality outpaces the legislature, which is most of the time. The Digital Omnibus reflects the challenge of applying comprehensive legislation to a technology that evolves on an eighteen-month cycle. The AI Act provides a clear legal framework, but keeping that framework aligned with rapid technological change requires continual updates.
The British approach treats A.I. as a familiar set of problems wearing a new coat, better handled by regulators who already understand financial harm, data misuse and telecoms risk than by a fresh A.I.-specific bureaucracy. That’s defensible, and cheaper to run than either alternative. But a company’s obligations end up depending on which regulator has the more plausible claim to a given use case, and that boundary remains unsettled. Nobody in London can yet say where agentic systems that don’t fit an existing regulator’s remit will land.
None of these approaches is wrong exactly; they answer different questions. Washington asks who controls the most powerful technology in the world and how quickly it can act if that control slips. Brussels asks how to keep the technology from reproducing discrimination and harm at scale, and how to put it in writing so courts can enforce it. London asks whether existing tools already suffice, and whether it’s worth building an expensive new regulator before knowing it’s needed.
A company selling A.I. to governments has to answer all three questions at once, even though the answers don’t add up to a coherent whole. A system that clears a U.K. regulator’s principles-based test can still trip the E.U.’s high-risk classification. A partnership that passes every safety review a company runs can still be paused by an export control decision shaped by geopolitics rather than the model’s performance. There’s no unified compliance target, because there’s no unified theory of what’s being protected against.
This has an effect on where innovation goes, and it isn’t the effect either side of the regulate-more-or-less debate usually predicts. Stricter regimes don’t simply drive companies away, and looser regimes don’t simply attract them. Predictability itself has become a competitive input, separate from any rule’s strictness. A founder can build a compliance program around a fixed law, even a demanding one. It’s harder to build one around a discretionary power that sits dormant for years and then gets exercised overnight, or around a sector boundary nobody has drawn yet. Companies are sorting themselves by which kind of uncertainty they can tolerate, not by which country has the friendliest rules on paper.
No single philosophy of A.I. governance offers the definitive answer, because no such answer exists. What matters is whether companies can understand the system well enough to make long-term decisions, whether that system is discretionary and fast, comprehensive and slow, or sector-based and improvised. In A.I., clarity has become a competitive advantage in its own right. The countries that most reliably provide it may shape the next decade of innovation more than the countries that promise either the toughest controls or the lightest touch.
