A technology is used, harm appears, the harm is measured, a rule is written, and the rule takes effect. Each of those steps takes years, which is why law is permanently behind.
The regulation gap on a timeline, and the three ways rules try to close it.
Interactive diagram
Explore the labelled diagram, charts and maps for this topic in full study mode.
Free preview
This is the free notes preview
You're reading the free notes. Aimnova Pro unlocks the full study experience — and you can try it with your first topic free to keep:
- FlashcardsLock in vocabulary and key terms with spaced repetition.
- Practice questionsAnswer exam-style questions and get instant AI marking.
- Mock exams & past-paper vaultSit full mocks and see exactly how examiners award marks.
- Personalised study planA daily plan built around your exam date and weak areas.
Three ways to write a rule
Name the technology
Clear and enforceable, and obsolete as soon as the next one arrives under a different name.
Write principles
Survives change, and is so general that nobody knows whether they comply until a court says so.
Sort by risk of use
Rules apply by what a system is used for, so something invented tomorrow is already covered.
Why risk tiers won: Governing by use rather than by name is the only one of the three that covers a technology nobody has seen yet.
It is the approach the EU AI Act (in force August 2024) takes, and it is still written after the fact.
Practice with exam-style questions
Answer exam-style questions and get AI feedback that shows you exactly what examiners want to see in a full-marks response.
Real-world examples you can name
The EU General Data Protection Regulation (GDPR) — in force since May 2018
A regulation giving people rights over data held about them — to see it, correct it, have it erased and take it elsewhere — and requiring a lawful basis before an organization may process it at all. Fines can reach 4% of a company's worldwide annual turnover.
Who it affected: Everyone in the EU, and any organization anywhere that handles EU residents' data.
The EU Artificial Intelligence Act — agreed December 2023; entered into force August 2024, phased to 2027
The first broad law to regulate AI by risk. Some uses are banned outright, such as untargeted scraping of facial images and social scoring by public authorities; high-risk uses in areas like hiring and education carry duties for data quality, documentation and human oversight.
Who it affected: Anyone deploying AI systems in the EU, and users subject to those systems.
Australia's News Media Bargaining Code — passed February 2021
A law designed to make large platforms negotiate payment with news publishers for content that appears on their services. Facebook briefly blocked news for Australian users while it was being debated; the law passed in amended form and several deals followed.
Who it affected: News publishers, platform users, and regulators elsewhere who copied the model.
| Situation | Does the rule bite? | Why |
|---|---|---|
| Large market, large company | Yes | Compliance is cheaper than leaving |
| Small market, large company | Often not | Leaving is cheaper than complying |
| Any market, small company | Yes, and hardest | Compliance costs the same and they can afford it least |
The trap in strict rules: A rule strict enough to bind the largest company is often the one only the largest company can afford to follow, which strengthens the position it was written to limit.
What laws and policies cover
Crime and lawbreaking
Fraud, hacking and harassment online, often across borders.
Surveillance and monitoring
Laws set when states and employers may watch people, such as rules on police use of facial recognition.
Public and private policy
Government rules, and an organisation's own policies and professional codes that staff must follow.
How this is tested — part c almost always ends up asking what should be done, and this topic is how you answer it precisely. It comes up two ways:
Paper 1 — structured question
- Part c: evaluate a proposed regulation
- Part b: explain why a rule failed to change behaviour
Paper 2 — source-based question
- Q4: synthesise sources on regulating technology
- HL Paper 3: recommend a rule and defend its enforceability
The trap: “there should be stronger laws”: Say which kind — naming a technology, a principle, or a risk tier — and say what will still escape it.
Explain one reason why a law about a named technology may quickly become ineffective.
Model answer plan
See the answer broken into clear points, with guidance on how each point earns marks.
Evaluate regulating artificial intelligence by the level of risk of its use.
Model answer plan
See the answer broken into clear points, with guidance on how each point earns marks.