Within a few months this year, four people who could hardly be more different have said almost the same thing about artificial intelligence.
Steve Bannon, with some sixty America First figures and a roomful of pastors behind him, wrote to the White House demanding that the most powerful models be submitted for government testing and approval before they are released. Bernie Sanders, having already proposed freezing the construction of data centres to let democracy catch up, went further and floated handing the public a fifty per cent stake in the largest AI firms. Dario Amodei, who runs one of those firms, said in as many words that people like him should not be the ones deciding where this technology goes. And Pope Leo XIV made artificial intelligence the subject of his first encyclical, calling for it to be disarmed and put to the service of humanity.
Their concerns do not converge; they barely point in the same direction. Bannon fears a civilisational rupture; Sanders, the labour market and the electricity bill; Amodei, a loss of control. The Pope reaches past the technology altogether, to something older — the dignity of the human person, and the refusal to let anyone be reduced to an instrument. Their remedies flatly contradict one another — approval regimes, public ownership, voluntary restraint, moral suasion. What they share is narrower, and more interesting than any of it: each is objecting to the same arrangement, that a very small number of private actors are, for now, deciding on everyone else’s behalf.
At bottom, this is not about safety. It is about legitimacy. The vocabulary is all guardrails and testing and moratoria, but the grammar underneath is about authority — who holds the power to set the course of a general-purpose technology, and by what right. And it is worth being precise about where the problem is not. Nothing these companies do is unlawful; they act squarely within the law. What they lack is a mandate — no one elected them, and yet what they decide reaches all of us. The gap is not between the labs and the law, but between the power they hold and any mandate to hold it. The admission cuts deepest when it comes from inside the industry: when one of the people building these systems says the builders should not be the ones deciding, he is not describing a safety gap, he is describing a missing source of legitimacy. When the American administration finally acted, in June, it captured the confusion precisely. The order it signed asks frontier laboratories to submit their most capable models for review — voluntarily, up to thirty days before they release them more widely. A half-measure, where the populist right had demanded the real one. The confusion is not incidental. People are quarrelling about the remedy because they have not yet noticed that they agree on the grievance.
Europeans should recognise that grievance, because it is the question our own regulation was built around. But to answer it well we have to do something the chorus has not done, which is to admit that “who decides” is two questions, not one — and that they have different answers.
The first is who decides what gets built and released: the trajectory of the technology itself. This is the hard one, and it is hard for a precise reason. There is no body positioned to hold it. There is no world government; the international instruments are thin; and so, by default, the decision sits with the laboratories, which is the very thing the chorus is objecting to. It belongs to states, and better still to international institutions — to competition policy, to public investment in compute and models so that the frontier is not wholly private, to coordination on what may be built at all, and, at its bluntest, to the kind of taxation or public stake that Sanders is proposing. Europe already owns the beginnings of an answer here in the Council of Europe’s Framework Convention on AI, the first binding treaty on the subject. Whether the world builds the rest of it is the open question of the decade.
The second question is who decides when AI reaches into an ordinary life — a claim assessed, a premium set, a job application screened, a benefit flagged. And this one is answerable, for the opposite reason: someone is already standing at the door. The power these systems exert over people is almost never exercised on them directly in the decisions that matter most. A frontier laboratory does not decline your mortgage, cut you from a shortlist, or refuse your claim. Your bank does, your prospective employer does, your insurer does — increasingly with a model somewhere underneath. That power is mediated. It reaches a person only by passing through an institution that chose to deploy it. Which means there are two places to check it, not one: at the source, which is hard and contested and beyond any single institution’s reach; and at the point of contact, where someone accountable decides whether to use the thing, for what, on whom, and with what recourse for the person on the other side.
Checking power at the point of contact does not dissolve the power at the source. It does something more modest, and more reliable. It ensures that the technology cannot land on a person except through a door that an accountable institution is standing behind. For almost everyone, that is the encounter with artificial intelligence — not a model release they will never see, but the moment a decision is made about their life with a model in the loop.
This is what the EU AI Act actually does, and it is routinely misread. The Act does not make the decision. It does not tell an insurer whether to deploy a system, for what purpose, or on whom; it leaves the great majority of uses, below the high-risk line, to the institution’s own judgement. What it does is decide where the decision must be checked, and what floor must hold when it is made — conformity, human oversight, redress, transparency. It locates the decision at the accountable institution, and constrains how that institution may make it. That delegation is not a gap in the Act. It is the design. The right place for a decision about an ordinary life is the institution in contact with that life, provided the decision is made accountably. The Act is, in this sense, less a rulebook than a constitution for everyday-life AI: it does not decide the cases, it constitutes the bodies that do, and binds how they go about it.
Seen this way, Europe’s present instinct to simplify is not in tension with any of this. The Digital Omnibus would lighten the Act’s procedural load in the name of competitiveness, and that instinct is sound; a Europe that means to build as well as to govern has to mean it, and bureaucracy that protects no one is worth cutting. But simplification and legitimacy run on different axes, and the one real hazard of this moment is mistaking the second for the first. A register of what an institution runs and why; the discipline of saying what a system is for and who answers when it fails; the plain courtesy of telling a person when they are dealing with a machine — none of that is paperwork. It is the architecture that keeps the decision located and answerable. Cut the procedure that improves nothing. Keep the architecture that decides who decides. The two are easy to confuse, because both look like bureaucracy. Only one of them is.
So when the next open letter is published, and the next executive order is signed, and the next senator proposes to nationalise a model, it is worth holding three things steady.
The first: that the argument is about legitimacy, not safety, and that “who decides” is two questions. Who decides what gets built belongs upstairs, to states and, one hopes, to international institutions. Who decides how it touches an ordinary life belongs to the institutions in contact with that life.
The second: that for the second question we already have an answer, and a good one. The Act does not decide; it decides who must, and binds how. Regulation that locates and constrains the decision is not a tax on innovation. It is the constitution of accountable AI.
The third: that the answer is built, not drafted. Simplify the paperwork; keep the architecture; and build it before a crisis arrives to name the question for you. The world has at last begun asking who decides. The least we can do, in the places where the question is actually answerable, is to have already started answering it.