A Year On: My TEDx Talk on AI Governance Is Live

Tue, 19 May 2026 20:54:26 GMT

Last year I stood on the TEDxIllinois Tech stage in Chicago, under the event's theme of Uncharted Echoes, and made the case that the people building, integrating, and shipping AI systems carry the biggest responsibility in a generation: deciding what guardrails get put in place before the technology bakes itself into everything. The talk, Internet Universes, is now live on YouTube .

The framing was technical. The protocols underpinning the web have been broadly stable since CERN released the source code in 1991, even though every user sees a completely different presentation layer. Generative AI is the first technology in a generation to force changes at the protocol layer itself, not just at the interface. The questions I posed about what governance should look like were deliberately framed as thought experiments. A year on, several of them have stopped being hypothetical, and some of them need re-considering. Let's take a look:

What has actually happened since I delivered the talk

I spent some of the talk asking what happens when someone asks an AI agent for medical advice, gets bad advice, and dies. I walked through how Rylands v Fletcher might or might not still apply when the "non-natural use" is a model that nobody fully understands, including the people who trained it. At the time it read as a thought experiment.

It is not one any more. In May 2025 a federal judge in Florida ruled that AI chatbot outputs can be treated as a product rather than protected speech . That single ruling unlocked a wave of cases that would otherwise have been thrown out before ever reaching trial. The Raine family filed against OpenAI alleging ChatGPT functioned as their teenage son's "suicide coach"; the Soelberg estate is running parallel state and federal proceedings alleging GPT-4o, OpenAI's then-current model, reinforced delusions that led to a murder-suicide; and by November 2025, at least seven further wrongful death actions had been filed against OpenAI alone. The FTC opened a formal inquiry into seven companies in September, compelling them to hand over information on how their AI companion products affect minors.

For anyone building with these models, the engineering implication is sharper than the legal one. The "product, not speech" framing means model outputs are now being treated like any other thing a company ships: the standard questions about defective design, failure to warn, and known-but-unmitigated risk all apply. That changes what counts as an acceptable system architecture. Logging, refusal behaviour, content filtering, and the audit trail of what the model said and when stop being nice-to-haves and start being the artefacts that decide whether a defendant can prove they took reasonable care. If you ship an agent that can use external tools on the user's behalf and remembers things across sessions, you should assume those interaction logs will eventually be handed over as evidence in a case.

The emotional-support question got answered faster than I expected

I asked whether AI used for emotional support could offer the depth of perspective a human counsellor can, or whether widespread use would dull our emotional intelligence as a species. The data arrived sooner than I thought it would. OpenAI's own published figures, reported by Wired in November 2025 , put roughly 1.2 million ChatGPT users per week (about 0.15% of weekly actives) at expressing suicidal ideation or planning in conversations, with a comparable cohort showing signs of psychosis or mania that the model's agreeableness can amplify.

The interesting engineering point here is that two specific design choices, sycophancy and persistent memory, turned out to be the load-bearing problem. Sycophancy is what you get by default when you train a model using human feedback, because users consistently rate agreeable answers higher than challenging ones, and the training process learns to optimise for that. Memory makes the model more useful but also lets it accumulate and reinforce whatever framing the user brings to it. Combine those two and you have a system that, by construction, deepens whatever mental state a vulnerable user is already in. That is not user misuse. That is the system working exactly as it was built to work. OpenAI has since adjusted the default model's behaviour around signs of distress, but the change came after the litigation made it commercially unavoidable, not before.

The pay-to-play prediction

I noted in the talk that, the week before I delivered it, OpenAI had started showing product listings in ChatGPT responses, and I asked where the boundary between promotion and propaganda would sit once brands could pay for placement. OpenAI launched ChatGPT ads in the US on 9 February 2026, on Free and Go tiers, charging advertisers around $60 per thousand impressions with a $200,000 minimum to enter the pilot . In May 2026 they added product-feed campaigns that auto-generate ads from retailer catalogues, which is how every mature ad platform eventually monetises at scale.

The architectural commitment OpenAI has made is "Answer Independence" : the ad system and the model are separate, and advertisers cannot influence what the model says. As a principle that is the correct one. As an implementation question, it is the same one search engines have been wrestling with for twenty-five years, and the answer has historically been that the wall holds until the revenue line softens. The thing I would watch is whether the next round of model training runs use ad-click signal as a downstream optimisation target. The moment that happens, the separation stops being structural and starts being contractual, and contractual separations are weaker than the ones you can prove from the code.

Regulation: too early or too late?

I asked in the talk whether early regulation risked accidental authoritarianism and late regulation risked monopolies. The EU committed early. The AI Act's general-purpose AI obligations came into force on 2 August 2025, with the Commission's enforcement powers due in August 2026. The Digital Omnibus VII package , agreed in May 2026, pushes the application date for high-risk systems back to late 2027 and 2028, largely because the detailed technical rulebook underneath is not ready.

The practical translation for anyone building or integrating: the substance has not really shifted, the timetable has. The reason the timetable slipped is interesting on its own terms. Standards bodies move at the speed of consensus, and AI moves at the speed of next quarter. That gap is going to keep producing this same problem, where the political commitment to regulate arrives years before the detailed technical rulebook that would make the regulation actually enforceable. If you are designing systems that will eventually need to prove they meet the rules, the safer bet is to design as if the original deadlines still applied, because the eventual rulebook will look more like the current draft guidance than not.

The UK has stuck with sector-led, principles-based oversight rather than a single AI statute. The practical consequence for anyone shipping into both jurisdictions is that the same system can attract very different obligations depending on where the user sits, and the AI Act's extraterritorial reach (it applies wherever the output is used in the EU, not wherever the provider is based) means UK-based providers do not get to opt out.

What I would change, if I were delivering it today

Two things. The talk treats liability as an open question; the Florida ruling and what has followed suggest the question is closing faster than I implied, and the closing is happening through litigation rather than legislation, at least in the US. And the talk implies a comfortable runway between thought experiment and lived reality. That runway turned out to be roughly eight months.

The underlying argument has held up. The responsibility for what AI integration looks like sits with the people building it, integrating it, and advising on it today. The cases now in evidence-gathering, the regulatory deadlines now binding, and the commercial integrations now live are early answers to the questions the talk posed. They are not yet the final ones.