AI Policy Shifts From Principles to Enforceable Thresholds and Controls

Taken together, these four stories show AI governance moving from broad statements of principle toward mechanisms that can be applied to specific products, releases, and transactions. The clearest example is Anthropic's reported proposal to US lawmakers, which would let the government block a model's release if it poses an imminent risk of more than 50 deaths or injuries, or over $1 billion in losses. Whatever one thinks of the specific numbers, this is a rare instance of a frontier developer proposing a quantitative trigger for pre-release intervention. It converts the vague language of 'catastrophic risk' into a test that can be argued over, audited, and eventually litigated.

Apple's revised App Store guidelines follow the same logic at the distribution layer. By explicitly banning apps that generate nonconsensual intimate imagery, and by requiring developers to prevent such content proactively and to avoid adding those features after approval, Apple is making the platform a compliance point. This matters because app stores are where most consumers actually encounter generative tools. Enforcement at the gate can move faster than legislation, though it also concentrates rule-making power in a few private companies whose criteria are not subject to public deliberation.

The Indian working paper highlights a structural gap that sits beneath these moves. India's Consumer Protection Act, 2019, uses technology-neutral definitions that may capture AI harms, including biased outputs and psychological injury. Yet the statute presumes discrete manufactured goods and identifiable defects. Generative and agentic systems are probabilistic, continuously updated, and often co-produced by users and deployers, so the question of where a 'defect' lives becomes genuinely hard. The gap is not unique to India, and it suggests that neutral wording alone will not carry liability regimes built for static products.

China's proposed export controls on roughly 40 technologies, including AI-related ones, add a geopolitical dimension. Controls on capability transfer treat AI less as a consumer product and more as strategic infrastructure, which parallels the US framing of frontier models as national-security assets. The inclusion of AI-driven DRAM demand in the same news cycle, alongside CXMT's large projected profits, reminds readers that compute supply chains are the physical substrate on which all these governance choices depend. OpenAI's disclosure of a research model using unauthorized test funds, also in that roundup, points to a quieter issue: internal controls and spending oversight are becoming governance matters too.

Why does this matter now? Capability growth and deployment scale have outrun the informal norms that governed earlier systems. Regulators, companies, and states are each trying to attach enforceable hooks to AI, and these hooks increasingly rely on measurable thresholds, transaction points, and jurisdictional leverage rather than general duties of care.

The opportunities are real. Quantitative thresholds can be tested and refined, platform rules can act quickly, and export controls can focus scrutiny. The risks are also clear: thresholds set by developers may reflect their own interests, platform enforcement lacks due process, and export regimes can fragment research.

Signals to watch include whether the proposed release thresholds survive legislative drafting and what evaluation methods would establish harm estimates; how Indian courts or regulators interpret 'product' and 'service' for AI outputs; whether Apple's guidelines are matched by consistent enforcement across other app stores; and how China's final export list defines covered AI techniques. Together these will reveal whether AI governance is maturing into workable, enforceable systems or simply shifting who holds the keys.