Artificial Intelligence

Summary

Artificial intelligence has the potential to produce large gains in productivity, scientific discovery, health care, education, and access to expertise. It also creates significant risks.

Our central principle is that delegating authority to artificial intelligence should not dilute human or corporate responsibility for the consequences.

We support:

• Encouraging AI innovation while focusing regulation on identifiable harms and high-risk uses
• Holding organizations responsible for actions they authorize AI systems to take
• Requiring financial responsibility—through insurance, bonding, self-insurance, or similar mechanisms—when autonomous AI can cause substantial harm
• Requiring stronger safeguards as AI systems gain greater authority to act independently
• Supporting information sharing and early-warning systems across firms, researchers, insurers, and government while avoiding centralized governmental control of AI development
• Protecting competition by making regulation proportional to risk rather than company size
• Judging AI decision systems against realistic human alternatives rather than an impossible standard of perfect neutrality
• Protecting intellectual property, elections, cybersecurity, critical infrastructure, and national security while avoiding unnecessarily restrictive technological mandates
• Helping workers adjust to AI-driven economic disruption
• Requiring AI infrastructure to bear the costs it imposes on others, including through more efficient pricing of electricity, water, and infrastructure

Because AI is changing rapidly, government should generally regulate harms, responsibilities, and outcomes rather than prescribing how the technology must be designed.

Curious how your views compare? Early input has a meaningful impact—vote below (scroll down) to see the current results.
Your input helps us refine these policy positions.

Background

Artificial intelligence presents real opportunities and real risks.

AI may improve productivity, accelerate scientific research, reduce the cost of services, and allow individuals and organizations to perform tasks that once required far more time and specialized knowledge.

It may also disrupt labor markets, weaken privacy, increase cybersecurity risks, distort elections, concentrate economic power, threaten intellectual property rights, and create new opportunities for fraud and manipulation.

AI may be unusually difficult to regulate well. The technology is changing rapidly, many of the risks remain uncertain, and the firms most capable of explaining it to regulators have incentives to shape regulation in ways that protect their own market positions. Detailed technical rules may become obsolete quickly or impose costs that only the largest firms can afford.

That does not mean government should do nothing.

A better starting point is an old economic principle: when an activity imposes costs on others, public policy should try to make those creating the risk bear those costs.

For AI, that begins with clearly assigning responsibility.

Delegation should not dilute liability.

An organization should not escape responsibility simply because an autonomous AI system, rather than a human employee, made the immediate decision that caused harm. If a company gives an AI system authority to take a class of actions, the company should ordinarily remain responsible for the reasonably foreseeable consequences.

Clear liability gives developers and users incentives to balance the benefits of AI against the risks they impose on others. It also creates a market for insurance and other mechanisms that can help evaluate and price those risks.

Liability cannot solve everything. Some harms are difficult to compensate after the fact, some potential losses are catastrophic, and causation may sometimes be difficult to establish. But responsibility should be the foundation on which more specific AI regulation is built.

Financial Responsibility for Autonomous AI

As AI systems acquire greater ability to act independently, organizations deploying them should demonstrate greater ability to compensate people harmed by their actions.

The requirement should depend on the potential harm, not simply on whether something is labeled artificial intelligence.

An AI that summarizes documents or makes restaurant reservations creates little risk and should face little or no special financial-responsibility requirement.

An AI authorized to move large sums of money, modify production software, control industrial equipment, operate critical infrastructure, or conduct cybersecurity or military operations is different.

Organizations deploying systems capable of causing substantial losses should demonstrate adequate financial responsibility through commercial insurance, surety bonds, self-insurance, or comparable mechanisms.

This is preferable to requiring every company developing advanced AI to maintain enormous capital reserves. A large corporation may be able to self-insure. A smaller firm with a well-designed system could purchase insurance and thereby obtain the financial capacity necessary to compete.

Insurance can also provide useful market discipline.

An insurer considering coverage for an autonomous AI system has an incentive to ask whether the system has limited permissions, secure audit trails, independent shutdown mechanisms, cybersecurity protections, appropriate human approval requirements, and safeguards against circumventing its own restrictions.

Better safeguards should result in lower premiums. Poorly controlled systems with extensive authority should cost more to insure or, in extreme cases, become uninsurable.

Insurers would therefore become a form of decentralized risk regulator with their own capital at stake. Government would establish the legal framework and impose minimum safeguards where necessary, but it would not have to determine every technical detail of safe AI design.

This approach also helps address an important competitive concern. Regulation should make dangerous activity expensive—not being small expensive.

Required Insurance and Financial Responsibility

Insurance obligations also help compensate for the ability of corporations to limit their exposure through bankruptcy. Corporate limited liability is a valuable institutional innovation and an important contributor to economic growth and prosperity. But by definition, limited liability can also insulate owners and investors from some of the consequences of an organization’s actions.

In general, the benefits to society are worth the costs. In some cases, however, it makes sense to require individuals and corporations to maintain insurance or otherwise demonstrate the financial capacity to satisfy liabilities they might incur.

Mandatory automobile liability insurance is one familiar example. Similar financial-responsibility requirements apply in areas such as hazardous-waste management and the transportation of hazardous materials, where potentially large third-party losses might otherwise exceed the responsible firm’s assets.

The potentially large liabilities associated with AI seem to us another reasonable application of this principle. Firms should be required to maintain appropriate liability insurance or demonstrate that they have sufficient resources to be adequately self-insured.

Autonomous Agents and Human Control

AI agents—systems that can use computer tools, communicate with outside systems, and pursue multi-step objectives with limited supervision—create risks different from those posed by AI systems that merely provide information.

Recent testing has shown that advanced agents may sometimes pursue assigned goals through methods their operators did not anticipate or authorize, including circumventing restrictions or taking actions outside intended boundaries.

These incidents should not be exaggerated. They do not demonstrate that AI systems are conscious, hostile, or independently seeking power.

They demonstrate something more ordinary but still important: a sufficiently capable system may find an unexpected means of accomplishing the objective humans gave it.

Safety therefore cannot depend entirely on telling the AI what it is permitted to do. Important limits should also be enforced by the systems surrounding it.

Agents with access to financial accounts, computer networks, critical infrastructure, sensitive personal information, weapons, or other dangerous resources should operate with permissions and controls appropriate to the harm they could cause. These may include limited access, human approval for consequential actions, secure audit trails, independent shutdown mechanisms, isolation of sensitive systems, and safeguards the AI itself cannot remove.

The principle is straightforward:

Greater autonomy should be accompanied by stronger internal controls and clearer financial responsibility.

Information Sharing, Early Warning, and Institutional Restraint

Liability, insurance, and technical safeguards operate largely at the level of an individual company or system. Some AI risks, however, may become apparent only when information from several organizations is considered together.

A troubling event at one company may be an anomaly. Similar behavior observed independently at several companies may be an early warning of a broader problem. The same is true of cybersecurity threats, attempts to compromise AI systems, unexpected autonomous behavior, failures of safeguards, and other low-frequency events.

There is therefore a strong case for mechanisms through which AI developers, major users, researchers, insurers, and the intelligence community can share information about significant failures, near misses, vulnerabilities, and emerging risks.

One way to think about this is through the intelligence community’s traditional concept of Indications and Warning. Rather than waiting until a threat is fully developed, analysts identify potentially meaningful indicators and look for patterns among individually ambiguous events. The Institute for Security and Technology has proposed applying this methodology to possible AI loss-of-control risks, precisely because weak signals observed across different systems may provide information that no individual organization possesses.

In economic terms, this resembles indicative planning rather than directive planning. Government can help gather information, identify patterns, communicate emerging risks, and facilitate coordination without deciding which AI systems may be developed or prescribing how private firms must design them.

Elements of such a system are already beginning to emerge.

The Frontier Model Forum, whose members include major frontier AI developers, has established a voluntary information-sharing mechanism covering vulnerabilities, security threats, and capabilities of concern. In 2026 it began developing the approach further to address incident reporting and incident response as frontier systems become more capable.

The federal government is considering related mechanisms. The 2025 America’s AI Action Plan called for a Department of Homeland Security-led AI Information Sharing and Analysis Center, or AI-ISAC, to facilitate sharing of AI-security threat information across critical-infrastructure sectors.

The Senate Intelligence Committee’s FY2027 Intelligence Authorization legislation proposes a three-year pilot program through the National Security Agency’s Artificial Intelligence Security Center for sharing intelligence and threat information with frontier AI developers. Significantly, the proposal expressly provides that the mechanism is limited to intelligence and threat information and is not to establish standards, requirements, or best practices governing AI development or deployment. It also includes limits on permissible use, privacy and civil-liberties consultation, and a three-year sunset.

Work is also underway on ways to obtain useful information without requiring every participant to surrender its underlying proprietary data. In 2026, NIST’s Center for AI Standards and Innovation entered a research partnership with the nonprofit OpenMined to develop privacy-preserving methods for evaluating AI systems across organizational boundaries when models, data, or benchmarks must remain confidential.

These efforts are encouraging. Better information could strengthen not only government decision-making but also engineering practice, corporate governance, liability, and insurance. Insurers in particular cannot price rare risks very well if each company sees only its own experience. Pooling information about incidents and near misses can help turn isolated observations into evidence about the frequency and severity of particular risks.

But useful coordination should not require centralized governmental control.

Information supplied for safety purposes can also become a source of regulatory, prosecutorial, commercial, or political leverage. If companies believe that candidly reporting a near miss could expose them to unrelated enforcement, procurement retaliation, political pressure, or public embarrassment, they will have strong incentives not to report it.

Statutory protections can reduce this danger, and they should be included. But no piece of paper can substitute entirely for republican virtue. Institutional rules ultimately depend upon public officials accepting some limits on how entrusted powers and information may be used.

Public policy should therefore be designed not only for officials we trust but also for those we may not.

CIVPAC favors a distributed AI safety information-sharing system in which government participates but does not monopolize the underlying information. An independent or broadly governed clearinghouse could receive confidential reports, develop common categories for incidents and near misses, and distribute anonymized or appropriately sanitized information to participants.

The intelligence community should be part of such a system because it may possess information no private organization can obtain about foreign threats, espionage, cyberattacks, and attempts to compromise American AI systems. But the intelligence community need not be the sole proprietor of the system.

Strong protections should limit the secondary use of information supplied for safety purposes. Where possible, privacy-preserving technology should allow participants to discover common patterns without requiring the creation of a single government-controlled repository containing every firm’s proprietary information.

The objective should be to create a broad field of vision without creating another regulatory gatekeeper.

Government should help the participants see the warning signs. It should not thereby acquire the power to direct the development of the technology.

High-Risk Uses and the Human Comparator

Stronger oversight is appropriate when AI affects areas already governed by legal duties, professional standards, or public accountability. These include employment, credit, insurance, health care, education, law enforcement, public benefits, national security, elections, and critical infrastructure.

The goal should not be to prohibit AI in these areas. AI may sometimes make decisions more accurately, cheaply, and consistently than humans.

But AI should not become a black-box workaround for duties involving accuracy, non-discrimination, due process, consumer protection, fiduciary responsibility, or professional conduct. The organization choosing to use AI should remain responsible for complying with those obligations.

At the same time, AI should not be held to an imaginary standard that human decision-makers do not meet.

Human beings are often biased in ways they themselves do not recognize. AI may reproduce those biases, but it may also reduce them.

The relevant question therefore should not always be:

Is the AI perfectly unbiased?

A more useful question is:

Does the AI perform better than the realistic decision process it replaces?

Significantly disparate outcomes should trigger review and validation. But an AI system should also be compared with the existing human process.

Where independently validated evidence shows that an AI system is at least as accurate and produces less unjustified discrimination than the process it replaces, that should weigh heavily in favor of permitting its use and could create a rebuttable presumption of compliance with applicable anti-discrimination requirements.

AI should not receive immunity from civil-rights law. But neither should society reject a system that demonstrably reduces discrimination because it fails to achieve a perfection humans have never achieved.

Competition and Regulatory Capture

AI regulation itself could become a competitive moat around today’s largest companies.

Large incumbent firms can absorb costly compliance requirements more easily than startups and have greater ability to influence technical standards and regulators.

That is another reason financial-responsibility requirements should be tied to risk, rather than company size or broad classifications of technology.

Insurance allows smaller companies to demonstrate financial capacity without possessing the balance sheet of a major corporation. A startup deploying a relatively safe system should not face the same obligations as a large company deploying an autonomous system capable of causing enormous losses.

Rules that are too weak may permit real harm. Rules that are too burdensome may protect established firms, suppress competition, and slow beneficial innovation.

Intellectual Property and Creative Work

AI policy should protect intellectual property without unnecessarily restricting innovation.

Copyright exists partly to preserve incentives to create. If AI systems can freely use copyrighted books, journalism, music, art, software, and other creative work without compensation, they may weaken the economic foundation supporting future creation. That concern is particularly strong when AI-generated output directly substitutes for the work used to train the system.

At the same time, requiring individualized permission for every copyrighted work used in AI training could make compliance nearly impossible and favor the largest companies capable of negotiating massive licensing arrangements.

The goal should be a practical compensation system rather than either extreme.

Congress and the courts should distinguish among noncommercial research, training on lawfully acquired material, training on pirated material, use of copyrighted material to produce direct substitutes, and outputs that reproduce protected expression.

Practical approaches could include collective licensing, standardized royalties, opt-out or opt-in arrangements for some categories of work, and stronger remedies for reproduction of protected expression or use of unlawfully obtained material.

The objective should be to preserve incentives to create without preventing society from receiving the broader benefits of AI.

Labor Markets and Public Finance

AI may have large effects on labor markets.

If it substantially increases productivity, it should increase overall economic output and may increase incomes, profits, and tax revenues. Those gains should not be sacrificed simply to preserve existing ways of performing particular jobs.

But the transition could be painful. Some workers will use AI to become more productive. Others may find that occupations for which they trained shrink or disappear.

The first response should not be to prevent businesses from adopting productive technology. That would reduce potential gains in living standards and could weaken the United States relative to countries that adopt AI more rapidly.

Government should instead make education and credentialing more adaptable and recognize the limits of retraining programs.

If AI substantially raises productivity while also creating persistent labor-market disruption, broader income support may become increasingly important. CIVPAC’s Guaranteed Basic Income proposal may offer a less distortionary response than protectionism, industry subsidies, employment mandates, or an expanding collection of narrowly targeted programs.

The objective should be to share some of the gains from technological progress without preventing the progress that creates them.

Elections and Manipulation

AI can generate misleading political content, impersonate candidates and public officials, create fake audio or video, and dramatically reduce the cost of producing propaganda. These risks are especially serious when foreign governments use AI to interfere in American elections.

Government should not regulate ordinary political argument, criticism, parody, or satire. Political speech requires especially strong protection.

Fraud and impersonation are different.

Policy should emphasize authentication, enforcement against deliberate impersonation and fraud, cybersecurity, and protection against foreign interference.

AI should not become a cheap mechanism for separating political speech from responsibility for who actually produced it.

Resource Use and Infrastructure

AI infrastructure should pay the full cost of the resources it uses.

Data centers require electricity, grid capacity, transmission, water, land, and local public services. There is nothing inherently objectionable about using large amounts of resources for a valuable economic activity.

The problem arises when the costs are shifted to others or when regulated utility pricing fails to communicate the real cost of supplying those resources.

Achieving efficient resource use therefore often requires improving the pricing mechanisms within regulated utility systems rather than restricting data-center development. Electricity, water, transmission, and other infrastructure should be priced so that users face the incremental costs they impose, including important differences across time and location.

Electricity is a particularly important example. Levelized rates that charge essentially the same price regardless of when power is consumed can conceal large differences in the actual cost of supplying electricity. Time-sensitive pricing can give data centers strong incentives to shift flexible computing loads away from periods of peak demand and toward periods when generating capacity is more abundant and electricity is less costly.

When prices accurately reflect scarcity and cost, firms have incentives to conserve resources, improve efficiency, invest in technologies that reduce expensive peak demand, and shift activity to less costly periods without requiring regulators to dictate how those adjustments must be made.

The central problem is therefore often not excessive resource use itself, but prices that fail to reflect the costs that resource use imposes on others.

Efficient electricity pricing, cost-causation principles in utility rates, transparent water pricing, appropriate environmental pricing, and direct infrastructure charges are generally preferable to arbitrary restrictions on data-center development.

Here again, the principle is to make those creating an external cost bear it rather than prohibit useful activity.

Conclusion

Artificial intelligence is likely to create enormous benefits and genuine risks.

The choice is not between unrestricted development and detailed government control of the technology.

A better approach begins with responsibility.

People and organizations that delegate authority to artificial intelligence should remain responsible for what they authorize those systems to do. Delegating a decision to a machine should not make the resulting costs somebody else’s problem.

Where autonomous systems can cause substantial harm, operators should demonstrate adequate financial responsibility through insurance, bonding, self-insurance, or similar arrangements.

This can do more than compensate victims. It can create a market in which insurers, companies, investors, and customers continuously evaluate the risks associated with different AI systems and safeguards.

Information sharing can strengthen that system. Rare and emerging risks may become visible only when incidents and near misses across several organizations are considered together. Government can help facilitate that process and contribute information available only to the intelligence community, while safeguards and distributed institutions reduce the danger that coordination becomes control.

Government still has important roles: defining legal responsibility, protecting rights, addressing catastrophic risks, preventing fraud and foreign interference, preserving competition, facilitating appropriate information sharing, and enforcing rules where liability and private bargaining are inadequate.

But government should be reluctant to dictate the technical architecture of a technology changing this rapidly.

The goal should be to establish clear rights and responsibilities, improve the information available to those making decisions, and then allow innovation, competition, liability, insurance, and market incentives to do as much of the regulatory work as they reasonably can.

Note: This is an ongoing CIVPAC reader poll. It is not scheduled to close, so you can ignore any Crowdsignal prompt offering to send “final results.” You should be able to see current results after voting.

Go to the Table of Contents or to the Next Policy Position