AI Regulation Is Failing Because It Governs the Wrong Thing

Every major regulatory framework for AI — the EU AI Act foremost among them — was designed around a legible object: a system with an identifiable developer, a classifiable risk level, and a deployment site that can be inspected. Helberger's commentary in iCS names what that design misses ^[3]: the 'GenAI governance gap,' the space between centralized legislative assumptions and the distributed, multi-actor chains through which AI is actually built and deployed. A model trained by one company, fine-tuned by a second, served through a third party's API, and embedded…