AI policy debates tend to focus heavily on the content of proposed rules-what should be required, what should be prohibited, where the lines should be drawn-and comparatively little on a question that ultimately determines how much any of it matters in practice: who is actually going to enforce it, and do they have the resources and technical capacity to do so credibly.
Why enforcement capacity is the harder problem
Writing a rule that requires companies to disclose how a high-risk AI system was tested, or to conduct an impact assessment before deployment, is a policy design problem. Verifying that a company actually did those things, correctly, at the technical depth required to catch a genuine gap rather than a plausible-sounding compliance document, is a very different and often much harder capacity problem. Regulatory bodies tasked with overseeing AI compliance frequently have far fewer technically qualified staff than the number of companies and systems they're responsible for overseeing.
What this means in practice
A policy framework with strong requirements on paper but limited enforcement capacity behind it functions, in practice, closer to a voluntary code of conduct than a binding rule-compliant companies comply because they want to, not because they expect meaningful scrutiny. This gap between stated policy and enforced policy is one of the more consistently underreported aspects of the AI policy conversation.
Questions worth asking of any new AI policy proposal
What agency or body is responsible for enforcement, and what is its current staffing and technical capacity relative to the scope of what it's being asked to oversee? Is there a funding mechanism attached to the policy that would meaningfully expand that capacity, or is enforcement expected to happen with existing resources? Has the responsible body brought any enforcement actions under comparable existing rules, and what do those actions suggest about its practical capacity?
Why this belongs in policy coverage, not just legal analysis
Business readers evaluating regulatory risk need a realistic sense of enforcement likelihood, not just a summary of what a rule technically requires. Policy coverage that treats a rule's text as the whole story, without addressing whether it will actually be enforced, gives readers an incomplete basis for assessing real compliance risk.