Regulation: Rules Can Only Describe What Already Happened

Every serious argument about regulation eventually runs into the same structural fact: rules can only be written about harms that have already happened.

This is not a criticism of regulators. It follows from what writing a rule requires. Somebody has to notice a problem. It has to occur often enough to be documented rather than dismissed as an isolated incident. It has to be understood well enough that a rule can describe it precisely. And it has to matter enough politically that legislative time gets allocated to it.

Each of those steps takes time, and together they take years. Technology moves in product cycles measured in months.

The gap between those two speeds is where most of the interesting and uncomfortable dynamics in this field live — and understanding it explains why so many regulatory debates go in circles.

The lag, and what it does

By the time a rule addressing some technology is drafted, debated, passed, and implemented, the thing it describes has often changed shape. Sometimes the industry has moved on entirely, and the rule lands on a practice that is already declining.

Three consequences follow.

Absence of a rule is not permission, but it functions like it. Businesses operating in an unregulated space are frequently doing nothing illegal, because nothing illegal has been defined yet. Whether that is fine or a problem depends entirely on the conduct, and the ambiguity gets exploited in both directions — by companies claiming legitimacy from the absence of rules, and by critics treating the absence as evidence of wrongdoing.

Rules aimed at yesterday's problem can entrench yesterday's players. A rule written around the specific practices of the current dominant firms describes their operations well and often fits a new approach badly, even a better one.

The lag is asymmetric across jurisdictions. Because different places move at different speeds, companies can and do organise around the most permissive relevant jurisdiction. This is not always avoidance in a sinister sense — sometimes it is simply where the activity is legal — but it does mean the slowest regulator effectively sets the floor and the fastest sets the ceiling only for its own market.

The uncomfortable dynamics

Two features of how regulation actually works are worth stating plainly, because they cut across the usual pro- and anti- framing.

Compliance costs fall unevenly. Meeting a regulatory requirement has a large fixed component: legal review, reporting systems, dedicated staff. For a large firm this is a manageable overhead spread across enormous revenue. For a small competitor it can be a genuine barrier to entry.

This produces a result that surprises people the first time they see it: established firms sometimes lobby in favour of regulating their own industry. Not out of civic virtue, and not always cynically either — a stable rulebook has real value, and firms with compliance departments would rather compete on rules they can absorb. But the effect on competition is real, and it means "the industry supports this regulation" is not evidence that the regulation is good for consumers.

Regulators depend on the regulated for information. The people who understand a technical industry in detail mostly work in it. Regulators need that expertise, and getting it means talking to the firms being regulated. Over time this creates a pull toward the industry's framing of what the problems are and what solutions are practical. This is usually gradual and rarely corrupt in any legal sense, which makes it harder to guard against than outright capture.

Neither of these means regulation is futile. They mean the design of a rule matters as much as the decision to have one, and that "should we regulate?" is a much less useful question than "who does this particular rule advantage?"

What tends to work better

There is reasonable evidence about which regulatory approaches age well.

Specify outcomes, not methods. A rule saying a system must be safe, or that a risk must be disclosed, survives technological change. A rule specifying the exact mechanism to achieve it becomes obsolete and can prohibit better approaches invented later. Method-specific rules also create a compliance-theatre problem — firms satisfy the letter while the intended outcome drifts, which is Goodhart's Law arriving in legal form.

Make the cost fall on whoever creates it. Many harms persist because the party generating them does not bear the cost. Pricing that cost back to the decision-maker changes behaviour without anyone having to specify how — the general fix for a tragedy of the commons.

Scale requirements with size. Applying identical fixed compliance costs to firms of vastly different sizes systematically favours incumbents. Thresholds and proportionate requirements mitigate this, imperfectly.

Build in review. Rules written for conditions that no longer exist tend to persist indefinitely, because repealing something requires effort and creates political risk while leaving it costs nothing visible. Scheduled review is one of the few mechanisms that counteracts this.

Accept that some lag is irreducible. Faster regulation is not automatically better regulation. Rules written quickly, before a harm is well understood, are frequently aimed at the wrong mechanism and are harder to unwind than to pass. The honest position is that the lag is a genuine cost and rushing to close it carries its own, and neither side of that trade-off gets to pretend it is free.