From Vitoria, Brazil, I'm reading about the White House preparing to send Congress a national AI regulatory framework. It covers child safety, creators' rights, federal vs state regulation, and tighter export controls on AI chips. Protecting kids and artists and keeping top-end compute out of adversarial nations sounds reasonable on paper. I agree with those goals. I am worried about how they will be implemented.
Why a Brazilian developer cares about American regulation
Their rules end up here. When the EU passed GDPR, every developer on Earth added cookie banners. When Apple changed App Store privacy rules, every mobile dev globally complied. When the US sanctions a chip manufacturer, the supply chain ripples hit Sao Paulo the same week as San Jose. Every major AI API, every foundation model, every GPU cloud is headquartered in the US. I get neither a vote nor a seat at the table, but I will get the bill.
What gets strict and what stays vague
The visible wins get strict rules. "We protected children from AI" is easy to explain, so child safety will be strict. Good. Creators' rights will get some framework modeled after copyright law already outdated when Napster existed. Open-source provisions and indie developer exemptions are nuanced, and the nuanced parts tend to come out vague and underfunded.
Export controls worry me
Restricted chip supply means compute gets more expensive for everyone. A startup in Belo Horizonte pays more because of a geopolitical chess match it has no part in. The compute gap between big and small widens. Google, Microsoft, and Meta are partially insulated by their own chip programs. The rest of us fight over whatever NVIDIA is allowed to sell.
What happens to open source
Regulation tends to treat "AI" as a monolith. A framework designed for OpenAI's GPT doesn't make sense for a researcher fine-tuning a 7B model on a single GPU. Compliance requirements that are easy for a company with a legal department can be too heavy for open-source maintainers. If the US framework gets open-source exemptions wrong, indie devs and small teams pay the price.
Creators' rights and liability
If an AI model trained on copyrighted data, who owes what? Large providers will negotiate blanket licenses with major publishers. Those of us using APIs end up at the end of that liability chain: either API prices go up to cover legal exposure, or every indie dev needs to understand copyright law at lawyer level. Neither outcome is good.
Clear rules are workable
I work on an LLM agent for US healthcare that runs under HIPAA. A well-written compliance rule, clear and auditable, is something engineering can design for and prove. The risk is a vague rule, because nobody can build against it.
What I plan to do
I plan to bet on open-weight models and self-hosting when it makes sense, and keep building for the Brazilian market first. I will watch the open-source exemptions closely. Regulatory frameworks take years, so I want to build while the rules are being written.
The AI horse has left the barn. Model weights are on BitTorrent, and every CS department on the planet has the knowledge. You cannot uninvent transformers. Regulation can shape commercial deployment, create liability frameworks, fund safety research, punish bad actors. But it cannot stop a developer in Curitiba from downloading an open model and deploying it.
Some regulation is necessary. Deepfakes of children need criminal penalties yesterday. Autonomous weapons need hard limits. The framework needs to be precise enough to avoid catching every developer in the blast radius.
Regulation is coming. I want the people writing it to understand the difference between OpenAI and a developer with a GPU in his apartment, but history gives me little reason to expect that.