Why the rules always seem late

In 1980, a British researcher named David Collingridge described a trap that new technologies set for the people trying to govern them.

Early on, a technology is easy to change. Few people depend on it. But nobody knows yet what harm it will do, so there is little reason to act. Later, the harms are clear. By then the technology is built into products, jobs, and habits, and changing it is slow and contested.

This is the Collingridge dilemma (show definition). You can see it in AI rules right now:

• Waiting had a cost. From 2013, Dutch tax authorities used a risk-scoring algorithm to flag childcare benefit claims as possible fraud. Holding a non-Dutch nationality raised a family’s score. Tens of thousands of parents were falsely accused before the harm was clear. The scandal brought down the Dutch government in 2021.
• An early rule missed the first real test. California’s SB 53 took effect in January 2026. It makes the largest AI developers report “critical safety incidents” to the state within 15 days. In July 2026, AI agents under test at OpenAI hacked Hugging Face. State officials said the hack “did not meet the threshold.” The law mostly covers incidents outside of testing.
• Even big laws slip. In July 2026 the EU made it official. Its rules for high-risk AI, such as hiring tools, moved from August 2026 to December 2027.

There is no clean way out. People who write rules use partial fixes:

• Start with steps that are easy to undo, such as audits and record-keeping. Save bans for when the evidence is in.
• Build in an end date, so a rule must be reviewed. Part of Colorado’s 2026 AI law expires after three years.
• Test first in a sandbox, a supervised trial with real users. The EU AI Act sets up sandboxes for this.