One term has been ringing in my ears since the Prime Minister announced plans for an AI safety regulator on Tuesday: “frontier AI companies”.
In case you aren’t an absolute dork like me, the Australian government this week announced plans for a new regulator to play warden to said companies, requiring them to meet some (still pretty vague) safety and security obligations.
Some of the more skeptical responses to that announcement — from Greens Senator David Shoebridge and independent David Pocock, for example — have focused on whether a regulator will have any real teeth.
I have to agree, particularly given that, as announced, the companies would apparently be required to “identify and manage” their own serious risks. Not sure how helpful that is. (But you can read more on why I think asking AI companies to check their own homework is a stupid idea here.)
But it was the term “frontier AI companies” itself that really snagged me. Because ... isn’t every company an AI company now? Who exactly are we planning to regulate?
How we choose who to monitor
The announcement itself doesn’t settle the question.
It describes frontier AI as “the most sophisticated models at the cutting edge of current technological capability”. So, makers of models? Which ones? And who decides what “most sophisticated” means?
In Australia, our banks are famously world leading in AI innovation, for example. Are they frontier companies for the purposes of this regulator? Or are we only talking about your OpenAIs and Anthropics?
Other places have at least tried to draw that line already. California defines a “frontier” developer by the computing power used to train its model. Feels like something that could change on a dime in my opinion, but its something.
The EU separates companies that build AI from the ones that use it, so no nebulous “frontier” language at all. Either you make models or you use them. End of story.
I know all of this seems very weedsy, but who we are regulating does actually matter a lot, because it tells us who will be left holding the bag when things inevitably go wrong.
How we choose who to blame
You cannot effectively regulate if you do not know who or what you are regulating. And I don’t think there’s a clear answer in Australia right now.
I’ve been trying to think of comparables from industries we have regulated successfully to see if we can wrap some more familiar context around the problem. So here goes:
We could think about AI like big pharma.
When drug companies produced thalidomide in the 50s and marketed it to women to treat morning sickness, they had no idea it would cause birth defects. Ultimately, we still held those companies legally responsible for the unintentional damage their products caused. We didn’t blame the doctors who prescribed it in good faith or the mothers who took it.
As written, this appears to be where the regulator plans to place blame. With the model makers, rather than its corporate customers or individual end users. Except that is contradicted in other ways our government and courts have already spoken about AI and responsible use.
The government’s own current guidance says businesses “are responsible for managing health and safety risks, including consulting workers and providing training on safe AI use, and cannot shift liability to AI systems”.
So perhaps we should instead treat AI more like a piece of industrial machinery? A company buys it, deploys it on site, and is responsible for making sure employees are trained in its proper use and that guidelines are followed to keep everyone safe. The manufacturer is liable if the tool malfunctions causing injury, but if the company installs it incorrectly or fails in its duty of care it is the employer who is on the hook.
We’ve already seen a version of this as well, with Deloitte forced to repay fees for AI slop.
But then, in the case of AI, distinguishing between proper intended use and improper use can quickly become extremely opaque. Not even the companies that build these models can fully explain why they produce a particular answer, so when something goes wrong it’s hard to tell whose fault that is.
And moreover, AI use is in no way restricted to a professional environment.
So perhaps liability lies with the end user?
Lawyers have been held personally responsible for AI mistakes. In 2024, a judge referred a Melbourne solicitor to the legal regulator after he filed a list of cases that didn’t exist, prepared with an AI tool.
So when we ask who is responsible for AI cock-ups, right now, it seems like the answer is … kind of, sort of, maybe everyone?
And in a world where everyone could be responsible, I worry no one will ultimately be held accountable at all. Or more realistically, responsibility will be handed out arbitrarily, based on the winds of that particular day, with the least powerful the most likely to take the brunt of it.