I like the discussion that Hugging Face's Clem Delangue started around regulating AI at the appropriate layer.
I agree with the principle, but I think the compliance model can be extended. From a systems engineering perspective, it's closer to eight distinct layers, each with different responsibilities and different compliance requirements.
Each layer should have its own compliance contract, rather than applying a single regulatory approach across the entire stack.
The Eight Layers
- Applications: Sector-specific regulations (healthcare, finance, education, employment, consumer protection)
- Agents & Orchestration: Autonomy bounds, tool authorisation, human approval gates, action audit trail, rollback
- APIs & Platforms: Identity, audit logs, abuse prevention, rate limiting and monitoring
- Inference Runtime: Secure execution, telemetry, policy enforcement and model isolation
- Foundation Models: Alignment, safety evaluations, provenance and watermarking
- Model Weights: Transparency, documentation and reproducible research
- Training Data: Provenance, licensing, consent, personal-data handling, retention and deletion
- AI Hardware → trusted execution, attestation and hardware security
Why It Matters
A layered compliance model provides clearer accountability, avoids duplicate regulation, preserves innovation where appropriate, and ensures responsibility sits with the actors best positioned to manage the associated risks.