Soft law, hard law: what the October 12 double move says about the future of U.S. AI regulation

On October 12, 2026, two events happened on the same day without coordination, yet they tell the same story. Three U.S. senators introduced the Artificial Intelligence Risk Management and Security Act of 2026, creating an AI safety board at the Department of Commerce tasked with assessing frontier-model risk and setting testing standards. And Microsoft President Brad Smith publicly declared the voluntary commitments the industry has held since 2023 insufficient, calling for common, legally binding rules — independent pre-deployment evaluations, mandatory incident reporting, emergency shutdown mechanisms.

To grasp the significance of this double move, the political economy of international regulation offers a precise framework: the soft law / hard law distinction formalized by Kenneth Abbott and Duncan Snidal in 2000. Hard law is defined by three cumulative properties: precise obligations, binding force, and delegation to a third party — a court, an agency, an oversight body — empowered to interpret and enforce the rule. Soft law relaxes at least one of those three dimensions: general principles rather than precise obligations, voluntary rather than binding commitments, self-assessment rather than third-party delegation.

The voluntary commitments major AI labs have made since the 2023-2024 safety summits are a textbook case of soft law: general principles ("safety," "transparency"), not legally binding, largely self-assessed by the companies themselves. That architecture had a real advantage at the outset: it lowered negotiation costs and allowed fast adoption in a field where no one yet knew precisely what to regulate. Abbott and Snidal note precisely that soft law is favored when uncertainty about the nature of the problem is high and parties want to preserve their decision-making sovereignty.

But soft law carries a symmetric cost the theory documents well: the absence of delegation means no credible sanction for non-compliance, and the absence of precision leaves each actor free to interpret its own commitments. That is exactly the argument Brad Smith is now making: voluntary commitments are no longer enough, and the industry itself is asking for the delegation — independent, i.e. third-party, evaluation — that soft law, by construction, never provided.

The Senate bill moves in the same direction, but through the domestic rather than international route: a board at the Department of Commerce is a form of institutional delegation, even though the text, at this stage, does not yet set precise, legally binding obligations — in Abbott and Snidal's typology it sits in what they call a "hybrid" form, common during regulatory transition phases.

This shift has a strategic dimension the U.S. anti-AI-Act argument has long obscured. For two years, the dominant U.S. industry narrative pitted the flexibility of American soft law against what it called the excessive rigidity of European hard law. The fact that an actor as large as Microsoft now reverses that argument — itself asking for binding rules, and citing the United Kingdom rather than the EU as a possible third-party testing model — suggests the cost-benefit calculus has shifted: diffuse regulatory uncertainty (fifty potential state-level regimes, unframed liability disputes) now costs a dominant player more than a single federal framework, even a binding one.

For Cardan-AI's client sectors, the lesson is not to wait for the vote — unlikely before the November midterms — but to read the implicit price signal. In aerospace-defense, where AI systems already touch classified critical infrastructure, a federal AI safety board, once created, will almost mechanically become the entry point for future sector-specific requirements: extending an existing body to a sector is cheaper than creating a new one. In energy and luxury, where direct regulatory exposure remains lower in the short term, the useful signal differs: if U.S. hard-law codification advances, it will narrow the compliance-cost gap with the EU AI Act — and with it, one of the structuring commercial arguments of the past eighteen months in favor of prioritizing U.S. AI deployment.

The risk for decision-makers in this hybrid phase is to overreact to a bill that may never pass, or to underreact to an industry doctrine shift that is already publicly on record. Abbott and Snidal remind us that the choice between soft and hard law is never permanent: it is a reversible trade-off, renegotiated each time the balance between uncertainty, sovereignty, and credibility moves. October 12, 2026 marks, for U.S. AI policy, one of those tipping points — not its conclusion.