The Law Always Comes Later

A pattern that repeats itself exactly

Nils Bohlin patents the three-point seat belt for Volvo in 1959: a piece of metal and fabric that, by later estimates, has saved more lives than any other automotive invention of the twentieth century. But the automobile has existed since 1886. For seventy years people died in crashes a belt would have made survivable, simply because nobody had invented it yet — and for another eleven after the invention, because no state in the world made wearing one mandatory. The first to do it is the Australian state of Victoria, in 1970. Italy makes belts mandatory on front seats only in 1988, on rear seats in 1989. A century of cars, three decades of belts available, before the law said "buckle up".

The same scheme, on different timelines, repeats itself for leaded petrol (added from 1921, toxicity known already in the 1920s, eliminated from vehicles in the USA only in 1996), for asbestos (used industrially from the late nineteenth century, the first serious bans arrive a century later), for speed limits designed for traffic that had already changed in the meantime. It didn't happen once. It's the rule, not the exception. The Rule ....funny.

Why it's not an accident, but a structure

In 1980 the sociologist David Collingridge gave a name to this mechanism^[1]: when a technology is new, it's still malleable and easy to regulate — but not enough is known about its effects to write sensible rules. By the time the effects become visible, the technology is already widespread, woven into the economy, defended by those who built a business on top of it: regulating it costs far more, politically and economically, than regulating it earlier would have. It's a structural dilemma, not a lack of will: by the time you'd know what to write into the law, it's already too late to write it without paying a price.

The same lag, today, with AI

The paper that introduces the Transformer architecture — the technical foundation of every modern language model — dates from 2017. GPT-3 arrives in 2020, still a product for insiders. Then, in November 2022, ChatGPT turns it into a mass-market product: a hundred million users in two months, the fastest growth ever recorded by a consumer application. The European AI Act — the world's first comprehensive attempt to regulate artificial intelligence — is proposed in 2021, definitively approved in 2024, and its full application is staggered through to 2027. Between the moment the technical architecture exists and the moment the last part of the European law is fully in force, ten years go by. Between the explosion of mass adoption and the law meant to govern it, four or five.

It's not an isolated case: it's the same lag as the seat belts, measured on a compressed timescale because software spreads faster than metal. Digital technology didn't invent the problem of regulatory lag — it only made it faster, and therefore more visible while it happens, instead of in the hindsight of a history book.

• SEAT BELTS — invented 1959, mandatory in Italy 1988: 29 years of lag
• LEADED PETROL — toxicity known since the 1920s, eliminated from US vehicles in 1996: over 70 years
• SOCIAL MEDIA AND RECOMMENDATION ALGORITHMS — widespread since the mid-2000s, first comprehensive rules (the European DSA) in 2022: roughly 15-18 years
• GENERATIVE ARTIFICIAL INTELLIGENCE — technical foundation 2017, mass adoption 2022, AI Act fully in force 2027: 5-10 years, depending on where you start the stopwatch

What changes for those who code, not for those who legislate

This blog doesn't write laws, it writes code. But the pattern has a direct consequence for anyone building software today, before the rule that will govern it arrives: the responsibility not to do harm can't wait for the law to kick in. If the law always comes later, by definition, then in the interval — whether it's eleven years or seventy — the void is filled only by the choices of whoever is building. It's the same idea behind verifying an APK before installing it^[2]: don't wait for someone else to certify its safety, because in the interval before they do, the risk is yours anyway.

Frequently asked questions

Why do safety laws always come after the technology?

Because when a technology is new its real risks aren't yet known, and by the time the risks become visible the technology is already widespread and hard to regulate without high economic and political costs. The sociologist David Collingridge described this mechanism in 1980: it's a structural dilemma, not mere bureaucratic slowness.

How much time passed between the invention of the seat belt and its legal requirement?

The three-point belt was patented by Nils Bohlin for Volvo in 1959. The world's first legal requirement arrives in 1970 (the state of Victoria, Australia); in Italy the requirement for front seats dates from 1988. Counting from the automobile itself (1886), the lag exceeds a century.

How long did it take for the law to regulate artificial intelligence?

The Transformer architecture underlying modern language models dates from 2017. Mass adoption arrives in November 2022 with ChatGPT. The European AI Act, proposed in 2021, only comes fully into force in 2027: between five and ten years of lag, depending on the starting point you choose.