The brutal reality of 2026
AI regulations are exploding. The European AI Act (the European regulation on artificial intelligence, the world's first comprehensive legal framework on AI) has been coming into force progressively since 2024. The American Take It Down Act comes fully into force for platforms this week. China has its own Cyberspace Administration (the Chinese internet regulatory agency). The United Kingdom, Brazil, Australia, India and South Korea have all legislated. On paper, never have so many political efforts been devoted to reining in a technology in so little time.
And yet these regulations all share a fundamental limitation: they apply only to proprietary models (models whose code and parameters remain closed, controlled by the company that created them). On open source models (models whose parameters are published and freely downloadable), which now account for 17.1% of the global market according to MIT and Hugging Face, regulation loses almost all purchase. As we documented in our article on Chinese models, Qwen, DeepSeek, Llama and Mistral circulate freely on dozens of servers, can be downloaded by anyone, and can be run on any sufficiently powerful computer.
The question in 2026 is no longer "how do we regulate AI?". It is "what can still be regulated when the technology itself has already escaped?".
The irreversible nature of open source
To understand why open source changes everything, you have to understand a technical peculiarity. When an AI model is released as open weights (with its parameters downloadable under a permissive licence such as MIT or Apache 2.0, two very liberal software licences that allow almost any use), it becomes indestructible. Here is why.
First, models are files. Once downloaded, they can be copied, distributed, put on hard drives, private clouds, public mirrors (copies of the same content on different servers). No one can "delete" a file that is already on hundreds of thousands of machines around the world.
Second, execution is local. Once the model is downloaded, you can run it on your own computer, without an internet connection, without a central server. No authority can intercept or block its use.
Third, derivatives multiply. According to a Swedish study, the Qwen model alone has generated around 2,800 fine-tuned derivative models (modified by third-party developers for specific uses, fine-tuning being the technique of adjusting an existing model for a particular task) by developers around the world. Each of these derivatives is itself open source. Even if Beijing decided tomorrow to "deactivate" Qwen, the thousands of derivatives would continue to exist.
Several tech security experts use a formula to sum up the issue: "You can ban a car, but you can't ban automotive mechanics." In the same way, you can ban a specific AI service in a territory (blocking DeepSeek.com in France, for example), but you cannot erase the mathematical techniques published in research papers, nor the models already downloaded onto hard drives.
Attempts at regulation and their limits
Let us examine the main current regulatory approaches and what they can really achieve.
The European AI Act. In gradual application since 2024, it is probably the most ambitious regulation in the world. It classifies AI uses by level of risk, imposes transparency obligations, and bans certain uses (social scoring, cognitive manipulation, real-time biometric identification in public spaces). But its sanctions can only apply to identifiable providers with a legal presence in Europe. For an open-source model downloaded by a developer in Berlin and run on their own computer, the AI Act has virtually no practical hold.
The American Take It Down Act. In force for platforms since 19 May 2026, it requires the removal within 48 hours of any non-consensual intimate content, including deepfakes. As we explored in our article on deepfakes, this is a major step forward, but it applies to the platforms hosting the content, not to its creation itself. A deepfake generated locally and shared in private WhatsApp messages does not fall within its scope.
US export restrictions. The United States bans the export of advanced Nvidia chips to China. This strategy has failed: Beijing has invested in Huawei Ascend (the range of AI chips developed by the Chinese giant Huawei to replace the banned Nvidia ones), and as we documented in our article on the US-China war, Donald Trump ultimately authorised in 2026 the sale of 400,000 H200 chips to China. The lesson: even the most aggressive export controls (restrictions imposed by a state on the goods and technologies it allows to leave its territory) can be circumvented or diluted through political negotiation.
National service bans. Italy briefly banned ChatGPT in 2023. India banned DeepSeek on government devices. Several countries restrict access to Chinese AI services. These bans slow local adoption but do not remove the availability of the models. VPNs (Virtual Private Networks, which allow geographic restrictions to be bypassed), mirrors and open-source alternatives still provide access to the technology.
The four levels of regulation that remain possible
Faced with the impossibility of banning the technology itself, regulators are shifting their efforts to other levels. Four strategies remain practicable.
| Target level | Real-world effectiveness |
|---|---|
| Regulating uses (deepfakes, fraud, defamation) | High if enforced |
| Regulating platforms (hosting, distribution) | Moderate, a game of cat and mouse |
| Regulating API services (identifiable companies) | Moderate, workarounds possible |
| Regulating the technology itself | Very low, if not nil |
Regulating uses. This is probably the most effective lever. Rather than banning the technology (impossible), you punish its use for illegal purposes. If you use AI to make a non-consensual deepfake, you face prison. If you use it to draft a work email, you face nothing. This is the approach of the Take It Down Act, the French law on non-consensual sexual deepfakes, and most 2025-2026 legislation.
Regulating platforms. By requiring platforms to moderate AI-generated content, you create a bottleneck. A deepfake video can be created freely, but it will struggle to spread widely if TikTok, YouTube and Instagram take it down quickly. This is the approach of the AI Act and the Digital Services Act (the European regulation on digital services, which makes large platforms responsible for the illegal content they host). Limitation: content can still circulate in unregulated spaces (Telegram, unmoderated forums, private messaging apps).
Regulating API services. The major providers (OpenAI, Anthropic, Google) are identifiable, taxable and sanctionable. Imposing transparency, filtering and liability rules on these players is effective for 80% of consumer uses. Limitation: it does not capture uses via self-hosted open source models (hosted on one's own servers).
Regulating the technology itself. That is what does not work. Trying to ban the creation of models, their training, or their release as open source is technically and legally almost impossible. Several attempts have failed (Biden's 2023 Executive Order on high-risk models was revoked by Trump, California's SB 1047 was vetoed by Newsom). The regulatory capacity at that level is now marginal.
The angle we avoid looking at: what if regulation became counterproductive?
A subject rarely discussed in public deserves to be named: overly strict regulation of Western players risks favouring Chinese and Russian models. If OpenAI and Anthropic have to comply with 50 European rules, but DeepSeek can ignore them (because it has no legal representation in Europe), European users will probably migrate to the least constrained option.
This argument is regularly put forward by the American Big Tech companies (sometimes cynically, to escape any regulation), but it contains some truth. As we explored in our article on OpenAI's lock-in, AI ecosystems quickly become locked down. If Europe deprives itself of the best tools through excessive regulation, it could condemn itself to even deeper dependence on unregulated models.
This dilemma is probably the hardest to resolve politically. Too little regulation, and serious abuses are allowed to happen. Too much regulation, and users are pushed towards less supervised alternatives. The right balance cannot be found because it does not exist in the abstract: it depends on concrete choices about which uses must be protected and which players must be encouraged.
How other technologies lived through this moment
For perspective, let us look at how other technologies with mass adoption handled the same problem.
The Internet. In the 1990s, many thought the Internet would be uncontrollable and would destroy social structures. The reality: the Internet was never "regulated" in the strict sense, but specific uses were (cybercrime, illegal content, copyright). Societies adapted. The result is neither perfect nor catastrophic: an imperfect but liveable balance.
Cryptography. In the 1990s, the United States tried to ban the export of strong cryptography software (the PGP affair, Pretty Good Privacy, is the open-source encryption software created by Phil Zimmermann in 1991, whose export triggered a major legal battle). The technology spread regardless. Today, cryptography protects your payments, your messages, your medical data. No one seriously proposes to "uninvent" it.
Music downloading. The music industry spent 15 years trying to ban illegal downloading. Total failure. The technology was accepted, and new business models (Spotify, Apple Music) emerged to offer attractive legal alternatives. Regulation turned into a pragmatic compromise between artists, platforms and users.
AI is probably following the same trajectory. A period of regulatory anxiety, a realisation that the technology cannot be "uninvented", then the gradual emergence of pragmatic frameworks.
AGI (Artificial General Intelligence) and general-purpose AI are sometimes compared to biotechnology. Like AI, biotechnology is a dual-use platform: it can save lives (vaccines, treatments) or cause catastrophes (biological weapons). Regulation was built up gradually, clearly distinguishing beneficial research (subsidised and supervised) from dangerous uses (criminalised and monitored). No country tries to "ban biotechnology". They all try to steer it. AI will probably follow a similar trajectory.
What must be accepted in 2026
Three honest observations to conclude.
Observation 1: the technology will not disappear. Powerful AI models exist. They are available. They will keep evolving. No law, no international treaty, no company shutdown will make disappear what is now a distributed global infrastructure.
Observation 2: abuses will massively outnumber sanctions. For every deepfake removed from a platform, ten others will be created elsewhere. For every AI scam prosecuted, hundreds will slip under the radar. This asymmetry is not a sign of failure: it is the very nature of technologies with mass diffusion.
Observation 3: individual responsibility becomes central again. In a world where technology cannot be fully regulated, it is education, critical thinking, and behavioural adaptation that become the first lines of defence. Learning to recognise a deepfake, verifying your sources, protecting your data: these skills are no longer optional. They are indispensable.
This analysis is part of our series on the blind spots of AI in 2026. To go further, you can consult our article on the medicine of the future, which shows a field where regulation remains essential, and our analysis of 30-year scenarios, which places these regulatory issues in a long historical perspective. Those waiting for regulations to solve AI's problems will probably be disappointed. Those who adapt actively, learning to live with this technology while protecting themselves from its excesses, will get through the coming decade without drama. That is probably the only truly actionable message of this story.