Policymakers sometimes need to act before knowing the full risks involved, a reality in the world of artificial intelligence (AI). Traditional risk management relies on calculating probabilities and severity, which can’t be estimated reliably when it comes to AI, especially for frontier models. We lack historical data, models evolve rapidly, and lab tests don't fully show how AI will act in the real world. As explained in the 2026 International AI Safety Report, this stems from an evidence gap arising from difficulties evaluating impacts of AI’s rapid technological development. Waiting for perfect evidence before acting might seem safer, but inaction is itself a choice that allows new vulnerabilities to take root and harms to materialize.
Lessons from Safety-Critical Fields
Rather than trying to predict every outcome, policy should focus on resilience: reducing vulnerabilities, containing harms, and adapting quickly. Other sectors offer clear precedents:
- Aviation combines safety rules with mandatory incident reporting and continuous learning.
- Automotive safety underlines the importance of anticipating potential hazard scenarios prior to model deployment and to require measures to mitigate their impact.
- Nuclear safety pairs probability models with strict requirements to ensure plants withstand worst-case scenarios.
- Cybersecurity assumes new threats will emerge and focuses on rapid detection and recovery.
- Climate scientists and financial regulators use scenario testing and stress tests rather than single forecasts.
- Public health & GMO regulation rely on real-time tracking and precautionary safeguards to prevent irreversible damage.
While AI is a unique and emerging field, these industries demonstrate that sound governance doesn't require indefectible foresight but relies on multi-layered defenses.
Four Layers of Intervention
A practical strategy covers four complementary levels so that weakness at one level is offset by safeguards at another:
- Model Level: Standardized evaluations, red-teaming, audits, and incident reporting to spot technical flaws early.
- Individual Level: Robust cybersecurity, misuse detection, content authentication, and enforcement of existing laws to curb abuse.
- Societal Level: Active monitoring of economic impacts, workforce support, consumer protections, and public literacy.
- International Level: Shared definitions, common evaluation standards, and global coordination to avoid fragmented rules.
Adapting the Policymaking Process
When dealing with deep uncertainty, traditional risk assessment and cost-benefit analysis fall short. Policymakers should adapt the way they define the policy issue and compare policy options through several practical steps:
- Revisit risk assessments continuously by tracking research, news, and incident reports alongside experts and civil society.
- Map out causal pathways to see how risks become real harms, separating proven facts from unverified assumptions.
- Focus on regulatory gaps where current legal frameworks, government guidance and industry initiatives fail to address novel AI risks.
- Evaluate policies using flexible criteria by prioritizing flexibility, reversibility, administrative feasibility, and international compatibility alongside cost efficiency.
- Balance delay against potential harm, weighing the benefit of gathering more evidence against the threat of irreversible damage.
Not all AI risks require equal measures. Minor or reversible consequences can be handled through monitoring, sandboxes, and pilots. However, where potential harms are severe and permanent, waiting for conclusive proof can close the window for effective action. In those critical cases, setting initial safeguards that adjust as clearer evidence emerges constitutes an essential precautionary approach.
Managing AI risk under uncertainty means acknowledging the limits of available evidence and building adaptable, resilient policy frameworks designed to perform well even when outcomes cannot be predicted. Urgently, this is what we need to embed in AI governance approaches nationally and internationally.
To learn more, we invite you to read Managing AI Risks Under Uncertainty: A Toolkit for Policymakers.
