The Moat and the Floor

The New York Times opened its account of governments falling behind on AI in a palace outside Brussels, where senior European officials had gathered this month. Its summary line reads: "The gap between technology and policymaking has gotten wider than ever with artificial intelligence, leaving a global policy vacuum as A.I. models rapidly advance."

Peter Thiel went through the options with the publisher Mathias Döpfner and found every one of them bad. Slowing AI down, he said, would take "one world government with real teeth, real force," which he called "a cure that's worse than the disease." The alternative is what he called "fake global government," meaning "a lot of conferences" and "somewhat empty statements." And behind both sits the risk that AI "ends up being slowed down in the West" while China carries on.

He left one out.

On September 10 the largest AI laboratory in the world asked Congress to impose binding requirements on it: testing standards, independent assessment, mandatory incident reporting, evaluation gates before a model ships. Its policy chief gave the reason: "The prospect of AI-accelerated AI development demands more than voluntary commitments."

The request makes sense whether the company has had a change of heart or is digging a moat.

Why a company asks to be bound

Voluntary restraint is a competitive penalty. A laboratory that spends six months on evaluations its rival skips has bought the rival six months and watched it ship. Whoever is cautious carries the whole cost and the market never returns it, so restraint does not last.

The clearest evidence is a legal request. The chief executive of the other leading laboratory has asked Washington to grant a narrow antitrust waiver so that the companies can coordinate with each other on safety at all. Nobody asks the government for permission to coordinate unless they have concluded that they cannot afford to go first alone.

On Saturday the laboratory that asked Congress to regulate it paused training its latest models, its second pause in three months, and said it would resume "only when we are confident that we have additional safeguards" in place. That is the right call, and one company pays for it alone. The same week, the president said the United States would not be "putting on brakes." Both are rational choices for the party making them. Together they show the arithmetic: the company that pauses pays, and its rivals do not.

A requirement fixes the arithmetic. It converts a cost that punishes whoever carries it into a cost that everyone carries. It is the ordinary case for workplace safety rules, emissions limits, bank capital requirements, and testing a product before it ships.

The other thing that rules do

Rules also become moats, and the moat is usually made less of the standard than of the apparatus for proving you met it.

American insurance is the long experiment here. Since 1945, under the McCarran-Ferguson Act, federal antitrust law and most other federal statutes have not applied to the business of insurance to the extent that the business is regulated by state law. The consequence, by design, is that insurance is regulated state by state, and has been for eighty years. The Congressional Research Service describes the result: insurers "face 50 different state regulators and state laws, many of which differ on some particulars of insurance regulation," producing "overlapping, and sometimes contradictory, regulatory edicts driving up the cost of compliance and increasing the time necessary to bring new products to market."

I spent a stretch of my career as a technology executive in that industry, and a large share of that work was building and paying for the machinery that makes the maze navigable: licensing and appointment tracking across dozens of jurisdictions, rate and form filing workflows, compliance calendars, examination support, and the staff who keep all of it current as the rules move underneath. It is expensive and necessary, and a large carrier can afford it and amortize it across a book of business.

What it buys is the ability to operate inside a structure a newer, cheaper competitor cannot enter until it has built the same machinery. The cost scales with how many regulators you face and how often they want paper, not with how good the insurance is. A company already carrying the apparatus adds a state cheaply, while one that has never carried it has to build the whole thing before it can sell a single policy.

No one has to design a moat like that. It comes with the spending, and the firms that paid for it are in no hurry to give it up.

When a federal charter was seriously proposed, the industry split by footprint, with "larger insurers tending to favor some form of federal regulation, and smaller insurers tending to favor a continuation of the state regulatory system." Many of the larger ones, a companion report notes, "had previously defended state regulation but considered themselves at a competitive disadvantage." The bills on the table would have established a federal regulator operating "concurrently with the present state system," under which an insurer could "choose whether to take out a federal charter, which would exempt them from most state insurance regulations, or to continue under a state charter and the 50 state system of insurance regulation." The companies that had already built the machinery could have stopped paying for fifty versions of it, while the fifty-version requirement stayed where it was for everyone else. For anyone trying to enter, fifty regimes is a wall whichever way the incumbents are voting.

It is not the patchwork

If fragmentation were the cause, one national rule would cure it. The Sarbanes-Oxley Act is one national rule: every public company in the United States faces the same requirement, written once.

In 2025 the Government Accountability Office published its assessment under the title "Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones." Larger companies, GAO found, "generally incurred higher overall Sarbanes-Oxley compliance costs, but these costs were proportionally more burdensome for smaller" ones. A company crossing the line into the non-exempt tier saw a median increase of two hundred nineteen thousand dollars in audit fees in the year it crossed, a thirteen percent jump.

Congress and the regulators knew, which is why the statute now carries an exemption keyed to company size, releasing firms below a threshold of publicly held shares from the auditor-attestation requirement. One uniform federal rule landed hard enough on small companies that the remedy was to excuse them from it.

Fifty regulators produced a barrier, and so did one.

The threshold trap

The standard remedy for the moat effect is to exempt the small. Sarbanes-Oxley does it by the value of publicly held shares. California's frontier-model law does it by training compute. The laboratory's own proposal asks that a national framework cover "the handful of well-resourced laboratories developing the most capable systems" and not startups, independent developers, or researchers.

In the AI case it may be right, since the risks the rules are aimed at plausibly do live at the frontier. It has two known costs, and they should be named rather than discovered later. A threshold becomes a target: draw a line at a compute or revenue number and firms will design against it. And an exemption, once granted, tends to stay. The small-company carve-out in Sarbanes-Oxley is two decades old, and it has been widened, not retired.

Where the lines belong is a question for legislatures and the public process, and this essay takes no position on it. A threshold can manage a moat. Whether the rule creates one depends on the kind of evidence it asks for.

The form of the evidence

A rule can ask you for a document prepared for a regulator: a filing, an attestation, a certification that the process was followed. That cost is essentially fixed. It scales with the number of regimes and the number of filing cycles, not with the size or quality of what you are doing, and fixed costs are moats.

Or a rule can ask you for an artifact the work itself produced: the evaluation that actually ran, with its result, checkable by someone who was not you. That cost scales with the work. It is roughly the same per unit of capability for a large company and a small one, because it is a property of the thing being built rather than of the jurisdiction it is being sold into. It also travels: evidence that a check ran, and what it returned, is the same in Sacramento, in Washington, and in Brussels, so you produce it once.

And it keeps pace. A filing is written after the work and trails it by a reporting cycle, while an artifact exists the moment the work does. A government that asks for filings will stay behind however fast its legislature moves, and that is the vacuum the Times described. One that asks for artifacts keeps up with the work.

The test

For any proposed AI rule, ask one question: does this rule require a document, or an artifact the work produced?

The proposals now on the table sort quickly. A law requiring a company to publish its own safety framework and to file its own incident reports asks for documents, and so does a rule requiring an auditor to hand the company "a signed and dated statement indicating that the audit was conducted according to the provisions of this bill," which is a document about an audit. So does a notification line between two governments, in which each tells the other what it decides to tell. A requirement that an evaluation actually run, against the deployed system, with the result recorded where the company cannot revise it, asks for an artifact, and so does an embedded verifier whose finding the company cannot edit.

Both kinds can be called safety regulation and pass the same legislature in the same week, but only one can be met by hiring enough compliance staff.

The wrong axis

The argument in front of us is about who should write the rules: Washington or the states, Congress or an agency, the companies themselves under a waiver, two governments across a table, or, in Thiel's version, nobody short of a world government. It is a real argument and it will be settled by people other than engineers.

Whoever ends up writing the rule will have to decide what it asks a company to produce.

A rule you can comply with by filing is a moat. A rule you can comply with only by doing the thing, and showing what the doing produced, is a floor.