Regulation in a Faster World

Executive Summary

This paper asks a bounded question: what do the laws and principles of systems theory reveal about the difference between how regulation is conventionally practised and how it needs to behave, given the pace of technological, economic and political change regulators now face? It is not a policy recommendation on any single reform. It applies the framework consistently, naming the governing principle before stating what follows from it.

The six findings that follow are set out in full in the next section. In summary: the binding constraint is whether regulators hold an adequate model of what they regulate, not the volume of rules; “growth duty” reform re-tunes rather than removes regulatory stability; even the best-resourced regulatory design cannot presently keep pace with its environment; the number of simultaneous reforms, not their net direction, is what destabilises regulated firms; jurisdictional fragmentation is now a complexity source in its own right; and the same structural mismatch recurs at every level of the system, from a single regulator to global governance.

Findings

These findings are the headline output of the diagnosis. The technical analysis that follows names the specific systems principle behind each one and traces how it plays out in the current regulatory situation.

Finding 1. A model problem, not a rules problem.

Regulators are being asked to control systems – AI models, global capital markets, digital platforms – that are more complex and faster-changing than any working model the regulator holds of them. This, not the sheer number of rules on the books, is the binding constraint on regulatory effectiveness, and it is most acute wherever the regulated system is opaque or adaptive by design.

Finding 2. Deregulation is a re-tuning, not a removal.

“Growth duty” reforms in the UK and deregulatory agendas in the US do not remove the stabilising function of regulation; they reset which variables are held within limits, explicitly trading tolerance for harm against tolerance for growth. That trade-off is a legitimate political choice, but its systemic consequences are not yet being tracked with the same rigour as the growth metrics it is meant to serve.

Finding 3. Even well-resourced regulatory design cannot keep pace.

The EU’s AI Act needed its own high-risk provisions delayed by 16 months before they took effect, because the supporting technical standards were not ready. This is direct, current evidence that the rate of environmental change is outstripping even the most elaborated conventional regulatory design in the world.

Finding 4. It is the number of moving parts, not their direction, that destabilises.

UK financial firms report compliance costs and effort rising even as the stated policy direction is deregulatory. Several reform tracks – conduct rules, payments regulation, buy-now-pay-later rules, stablecoin regulation – are landing before earlier ones have been absorbed, which is what generates instability, independent of whether the net change is more or less regulation.

Finding 5. Fragmentation is now a complexity source in its own right.

Roughly a dozen diverging national and regional AI-governance postures mean the compliance surface facing any cross-border actor grows combinatorially rather than additively, regardless of how strict or lenient any single regime is.

Finding 6. The same pattern recurs at every level of the system.

The mismatch between a control system built for stability and an environment that is accelerating shows up almost identically whether the level examined is a single regulator, a national growth-duty programme, a supranational simplification package, or the fragmented state of global AI governance as a whole – which means reform confined to any one level is unlikely to resolve it.

Technical Analysis

The remainder of this paper sets out the evidence and the systems-theory mechanism behind each finding above: the boundary of the system under examination, the situation on the ground, and the principle-by-principle diagnosis and its cross-cutting dynamics.

1. System Framing and Method

1.1 System Framing

Systems laws describe the behaviour of a defined system in relation to its environment and are only meaningful once that boundary is set explicitly.

1.2 Method

Each section below identifies the governing principle first, states the mechanism by which it operates, and only then derives the regulatory implication, so that findings remain traceable to a named principle rather than appearing as free-standing opinion. Principles are drawn from the full set of systems laws, thinking patterns and miscellaneous systems ideas, and are reported only where they materially apply to this situation – not as an exhaustive checklist. Interaction between principles (“splicing”) is noted at the point each connection is found, rather than deferred to a single later section.

2. Conventional Model and Systemic View Compared

Before turning to the situation itself, it is worth setting the two approaches side by side, since the contrast is the organising question of this paper.

3. Situation Brief

The regulatory picture across major jurisdictions in mid-2026 is one of simultaneous loosening and tightening, pursued under a shared “growth” or “competitiveness” banner, against a backdrop of accelerating and fragmenting technology regulation.

United States. The second Trump administration’s 2026 Unified Regulatory Agenda sets out close to a thousand planned deregulatory actions against only a handful of new rules, continuing a first-term approach of offsetting new rules with the removal of older ones; proponents cite an estimated $200bn in net regulatory cost savings from the first term and argue Biden-era rules added roughly $1.8 trillion in cost, though these figures come from the administration’s own accounting rather than independent audit. The Securities and Exchange Commission’s 2026 agenda similarly pivots toward capital formation and lighter listing requirements.

European Union. The “Digital Omnibus” amending the AI Act reached political agreement in May 2026 and received final legislative approval in June 2026. It delays high-risk AI obligations for use-based (Annex III) systems from August 2026 to December 2027, and for product-embedded (Annex I) systems from August 2027 to August 2028; delays the deadline for national AI regulatory sandboxes by a year; and extends SME-style compliance simplifications to mid-sized companies. It simultaneously adds a new prohibition, taking effect December 2026, on AI systems that generate non-consensual intimate imagery or child sexual abuse material, regardless of an organisation’s high-risk status – illustrating that the reform is a genuine simplification exercise, not a uniform loosening.

United Kingdom. A parallel “regulate for growth” programme has placed a statutory growth duty on regulators including the FCA, PRA and CMA, backed by a public regulator performance dashboard and the Financial Services and Markets Bill introduced to Parliament in May 2026. Industry data (TheCityUK and PwC) puts UK financial services compliance costs above £33.9bn a year, with 84% of surveyed firms reporting costs have risen over the past five years – even as the stated policy direction is deregulatory – because several distinct reform tracks (Consumer Duty, buy-now-pay-later regulation, Senior Managers regime reform, stablecoin rules, non-financial misconduct rules) are landing at overlapping points in the same period that older rules are being stripped out.

Global AI governance. Beyond the EU and US, Singapore launched a governance framework for agentic AI and South Korea’s binding AI Basic Act both took effect in January 2026; Japan has taken an explicitly “innovation-first” light-touch approach; and in the US, in the absence of comprehensive federal legislation, a growing state-level patchwork (Colorado, Texas, New York among others) has emerged. Jurisdictional boundaries are being tested directly through litigation: xAI has mounted a constitutional challenge to Colorado’s AI anti-discrimination statute, with the US Department of Justice intervening, and CNN has brought copyright litigation against Perplexity AI over its use of published content.

Signs of an explicitly systemic response. Several initiatives reframe regulation itself as continuous and adaptive rather than a one-off rulebook: the OECD’s Regulatory Policy Outlook 2025 promotes AI-assisted, data-driven and sandboxed regulatory design; Australia’s “Rules as Code” programme converts legislation into machine-readable logic; and both APEC’s Agile Regulatory Governance toolkit and the US National Academy of Public Administration’s Agile Regulatory Framework set out explicit tenets for anticipatory, iterative regulatory practice. These remain pilot-scale relative to the conventional apparatus they sit alongside.

What is unverified or unknown: whether the EU’s revised AI Act timeline will hold given that supporting technical standards remain behind schedule; whether the UK’s Financial Services and Markets Bill will pass in its introduced form; whether agile-regulation pilots will scale beyond current programmes; and – by the nature of the risk being taken – the realised systemic consequences of current growth-duty reforms, which by design will not be visible until well after the fact.

4. Systemic Diagnosis

The table below sets out the principles that materially apply to this situation, the mechanism by which each operates, and the impact it implies for regulation and regulators. Discussion of each, and the connections between them, follows.

4.1 Boundaries under permanent contest

Conventional regulatory design treats scope – what counts as “high-risk”, a “safety component”, a regulated activity at all – as something settled once, by statute or definition. The Law of Calling says the opposite: drawing that distinction is a judgement, not a discovery of a natural boundary, and the Law of Crossing adds that moving the boundary changes the state of what is on either side of it. This shows up directly in the EU AI Act’s narrowed definition of “safety component” and in the US litigation testing where a state’s authority to regulate AI actually ends. This connects immediately to the Darkness Principle below: boundary judgements are made under irreducible uncertainty about a system that is still changing, which is exactly why they keep being revisited rather than settled once.

4.2 The good-regulator problem

The Conant–Ashby Theorem – sometimes called the good regulator theorem – states plainly that every effective regulator of a system must hold an adequate model of that system. Applied literally to regulatory bodies rather than metaphorically to managers, this is the sharpest available diagnostic for the current situation: where the regulated system (a large AI model, a densely interconnected capital market) changes faster and holds more internal complexity than the regulator’s working model of it, every subsequent intervention is aimed less and less accurately, regardless of the volume or stringency of the rules written. The Darkness Principle sharpens this further – no system can ever be known completely – but the Two Black Box Principles show this is not fatal: it is legitimate systems practice to treat a complex sub-system as a black box, tracking its outputs reliably rather than modelling every internal mechanism. Much of the current AI regulatory debate is fixated on explainability of internals; the more tractable and arguably more valuable systemic lever is rigorous, continuous output monitoring – a black-box discipline that current regimes have not consistently built.

4.3 Variety, survival and relaxation

The Law of Requisite Variety states that control of a system requires variety at least equal to the system being controlled; fixed rulebooks reviewed periodically cannot match variety that is compounding continuously. Where a regulator’s variety falls persistently behind its environment’s, the System Survival Theorem applies directly: the system – here, the regulatory regime in its current form – loses fit with its environment. The clearest live evidence is the EU AI Act itself needing a 16-month deferral of its own high-risk obligations before they took effect, because the supporting technical standards were not ready – proof that even one of the world’s most elaborated conventional regulatory designs cannot presently satisfy ΔS ≥ ΔE. This links directly to the Relaxation Time Principle: a system disturbed again before it has had time to settle from the last disturbance may never stabilise. UK financial firms describe exactly this – rising compliance costs and effort despite a stated deregulatory direction – because several reform tracks are landing before earlier ones have been absorbed.

4.4 Compounding complexity, and where structuration could help

The Complexity Instability Principle states that systems with too many simultaneously changing, interacting parts tend to become unstable irrespective of how stringent any one part is; this is the more precise explanation for the apparent paradox of rising cost under a deregulatory banner – it is the number of moving parts, not their net direction, that destabilises. The Network Power Law adds that this complexity grows exponentially, not additively, with the number of interconnected elements: roughly a dozen diverging national AI-governance postures do not create a dozen units of extra complexity for a cross-border actor, they create a combinatorial compliance surface. The Root Structuration Theorem offers the countervailing systemic insight – complexity is minimised, not by reducing rules within any one jurisdiction, but by reducing the number of independently-structured regimes a system has to reconcile, through mechanisms like mutual recognition or shared testing protocols. This is the structural argument for coordination that a purely growth-versus-protection framing misses entirely.

4.5 What “stability” is now being asked to protect

The Homeostasis Principle frames regulation as a set of variables held within limits for the system to remain viable. “Growth duty” reforms do not remove this homeostatic function; they reset its set-points, explicitly trading some tolerance for harm against tolerance for slower growth – made unusually explicit in UK regulators’ own acknowledgement that “not all harm can be prevented” under the new remit. This is inseparable from the Power Structuration Theorem: growth duties, public scorecards and strategic steers are visibly recentralising agency from technical regulators back to political principals, reversing a long trend toward delegated independence. Whether that rebalancing improves the system’s overall agency or degrades it depends on whether the political principals now setting these limits hold an adequate model of the systemic risk they are asking regulators to tolerate – looping directly back to the Conant–Ashby problem in §4.2. The Viability Principle frames both tensions – autonomy versus cohesion, and stability versus adaptation – as requiring continuous rebalancing rather than a one-off resolution; treating either as settled once and left alone is the most consistent conventional error visible across every jurisdiction reviewed here.

4.6 A double bind for regulated firms

For firms operating inside this environment, the combination of a growth mandate and simultaneously intensifying conduct expectations produces something close to a formal double bind: satisfying the growth-and-speed imperative (faster approvals, lighter documentation, streamlined rules) and satisfying the intensifying conduct, non-financial-misconduct and consumer-protection imperative pull in different directions, with no available move that fully satisfies both. UK compliance and operations teams describe exactly this – a “dual-track” environment where deregulation at the policy level does not reduce, and in the short run increases, the practical burden of navigating simultaneous change. The classic systems response to a double bind is not to pick a side but to find a higher logical level at which the apparent contradiction dissolves – in this case, treating growth and protection as jointly-tracked variables in a single viability equation (§4.5) rather than as competing mandates handed down separately.

4.7 Emergent purpose versus stated purpose

POSIWID – the purpose of a system is what it does – offers a useful corrective to accounts that treat a regulator’s purpose as fixed by its founding statute. What several of the regulatory systems examined here actually do, day to day, is produce compliance documentation, audit trails and political risk-management for the regulator itself, alongside their stated purpose of preventing harm. This is not necessarily a failure of intent; it is what emerges from the structure and incentives regulators currently operate under, and it means that reforms aimed only at the stated purpose (loosen or tighten the rules) without addressing the emergent one (what the system’s actual day-to-day behaviour rewards) are likely to be absorbed into that same emergent pattern rather than changing it.

4.8 The same pattern, recurring at every scale

The Fractal Principle notes that systems tend to replicate their own structural form across levels. The mismatch identified throughout this diagnosis – a control system built for a slower environment, now asked to match one that is accelerating – recurs almost identically whether the level examined is a single regulator’s rulebook review, a national growth-duty programme, a supranational simplification package, or the fragmented state of global AI governance as a whole. Adams’ 3rd Law adds a further counterintuitive layer here: a system assembled entirely from individually low-risk components can itself be high-risk. Each simplification, deadline extension or carve-out currently being made across these levels is individually defensible as a proportionate, low-risk adjustment; but the combined effect of many such adjustments landing together, across every level at once, has not been assessed as a single system-level risk – which is precisely the configuration Adams’ 3rd Law warns tends to produce higher, not lower, aggregate risk.

5. Cross-Cutting Dynamics

Read together, the principles above converge on a single structural account rather than a list of independent findings. A widening variety gap (Requisite Variety) produces a survival gap (System Survival Theorem), which shows up as repeated re-shocking of the system before it can settle (Relaxation Time), which compounds into instability driven by the sheer number of moving parts rather than their content (Complexity Instability, Network Power Law) – all while political principals are simultaneously resetting what regulatory stability is even meant to hold constant (Homeostasis, Power Structuration), a resetting whose legitimacy is a political question but whose systemic consequences depend on whether the same principals hold an adequate model of the risk involved (Conant–Ashby). Because this pattern recurs at every level examined (Fractal Principle), no single-level intervention – reforming one regulator, tightening or loosening one jurisdiction’s rulebook – addresses the underlying mismatch; and because many individually low-risk adjustments are landing together across all levels at once (Adams’ 3rd Law), the aggregate risk of the current reform wave has not actually been assessed at the level where it would matter most: the system as a whole, rather than any one of its parts.

Conclusion

Applied consistently, the laws and principles of systems theory suggest that the live debate over regulation – more of it or less of it – is largely the wrong axis. The more consequential questions are whether regulators hold an adequate model of what they are regulating, whether the pace and simultaneity of regulatory change exceeds the system’s capacity to absorb it, and whether the current political re-tuning of what regulatory stability protects is being tracked with the same rigour as the growth it is meant to serve. None of these are answered by the conventional framing of deregulation versus protection, and all of them recur at every level of the system examined here – from a single regulator’s rulebook to the fragmented state of global technology governance. The practical implication is that reform confined to any one level, however well designed, is unlikely to resolve a mismatch that the framework shows to be systemic rather than local.

Appendix A – Glossary of Systems Principles Referenced

References

Sources consulted for the factual grounding of the Situation Brief (Technical Analysis §3). Theoretical statements throughout the paper are drawn from the systems-theory reference framework and are not separately footnoted.

1. U.S. Office of Management and Budget / OMB OIRA, 2026 Regulatory Plan and Unified Agenda of Federal Regulatory and Deregulatory Actions, published 3 July 2026. https://leadingage.org/2026-regulatory-plan-and-unified-agenda-released/

2. Economic Policy Innovation Center (EPIC), “The Unified Agenda and Renewed Regulatory Reform Efforts”. https://epicforamerica.org/federal-budget/the-unified-agenda-and-renewed-regulatory-reform-efforts/

3. U.S. Securities and Exchange Commission, “Statement on the 2026 Regulatory Agenda”, Chairman Paul S. Atkins. https://www.sec.gov/newsroom/speeches-statements/atkins-statement-2026-regulatory-agenda-070726

4. Holland & Knight, “2026 Legislative and Regulatory Outlook”. https://www.hklaw.com/en/insights/publications/2025/12/2026-legislative-regulatory-outlook

5. Council of the European Union, “Artificial Intelligence: Council and Parliament agree to simplify and streamline rules”, 7 May 2026. https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/

6. White & Case LLP, “EU agrees Digital Omnibus deal to simplify AI rules”. https://www.whitecase.com/insight-alert/eu-agrees-digital-omnibus-deal-simplify-ai-rules

7. Morgan Lewis, “EU Approves Delays and Other Amendments to Certain EU AI Act Obligations: What Businesses Should Know”. https://www.morganlewis.com/pubs/2026/06/eu-approves-delays-and-other-amendments-to-certain-eu-ai-act-obligations-what-businesses-should-know

8. Travers Smith, “EU agrees to delay key AI Act compliance deadlines”. https://www.traverssmith.com/knowledge/knowledge-container/eu-agrees-to-delay-key-ai-act-compliance-deadlines/

9. Cloud Security Alliance, “EU AI Act High-Risk Deadline Pushed to December 2027” research note. https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-omnibus-vii-deadline-delay-20260/

10. UK Government (GOV.UK), “Growth placed at the heart of regulators’ remit alongside new measures to boost scrutiny and transparency”. https://www.gov.uk/government/news/growth-placed-at-the-heart-of-regulators-remit-alongside-new-measures-to-boost-scrutiny-and-transparency

11. UK Government (GOV.UK), “Regulation for growth” collection. https://www.gov.uk/government/collections/regulation-for-growth

12. UK Government (GOV.UK) / Financial Conduct Authority, “Response from the Financial Conduct Authority 2026”. https://www.gov.uk/government/publications/recommendations-for-the-financial-conduct-authority-november-2024/response-from-the-financial-conduct-authority-2026

13. Hogan Lovells, “UK Financial Services and Markets Bill 2026-27: A major milestone of the government’s growth and competitiveness strategy”. https://www.hoganlovells.com/en/publications/uk-financial-services-and-markets-bill-202627-a-major-milestone-of-the-governments-growth

14. Alpha, “Regulate for Growth: But Who Picks Up the Operational Tab?”. https://www.alphabpo.co.za/regulate-for-growth-but-who-picks-up-the-operational-tab/

15. BCLP Perspectives, “Rebalancing risk to unlock growth: How financial services regulation will shape the economy in 2026”. https://perspectives.bclplaw.com/emerging-themes/forecasting-change-in-2026/rebalancing-risk-to-unlock-growth-how-financial-services-regulation-will-shape-the-economy-in-2026/

16. EY, “Impact of UK financial services regulation in 2026”. https://www.ey.com/en_uk/insights/financial-services/impact-of-uk-financial-services-regulation-in-2026

17. Bloomberg Professional Services, “UK Regulatory Outlook 2026”. https://www.bloomberg.com/professional/insights/regulation/uk-regulatory-outlook-2026/

18. CMS Law, “Regulation nation? UK regulators in 2026”. https://cms.law/en/gbr/legal-updates/regulation-nation-uk-regulators-in-2026

19. The Modern Regulator, “UK’s regulatory year in review: growth, governance, and global divergence”. https://themodernregulator.com/uk-regulatory-year-in-review/

20. Bloomsbury Intelligence and Security Institute (BISI), “Global Fragmentation of AI Governance and Regulation”. https://bisi.org.uk/reports/global-fragmentation-of-ai-governance

21. Airia, “AI Compliance Takes Center Stage: Global Regulatory Trends for 2026”. https://airia.com/ai-compliance-takes-center-stage-global-regulatory-trends-for-2026/

22. FifthRow, “From Centralized Certainty to Live Fragmentation: Why 2026’s ‘Three-Front’ AI Governance Shock Shatters Compliance as We Know It”. https://www.fifthrow.com/blog/from-centralized-certainty-to-live-fragmentation-why-2026-s-three-front-ai-governance-shock-shatters-compliance-as-we-know-it

23. GIOFAI, “AI Governance in 2026: From Regulatory Fragmentation to Enterprise Readiness”. https://giofai.com/blog/ai-governance-in-2026-from-regulatory-fragmentation-to-enterprise-readiness

24. Deloitte Insights, “Rewiring regulation: From static rulebooks to adaptive, data-driven oversight”. https://www.deloitte.com/us/en/insights/industry/government-public-sector-services/government-trends/2026/future-of-regulation.html

25. APEC, “Project Report on Adopting Agile Regulatory Governance to Foster Innovation”. https://www.apec.org/publications/2026/01/project-report-on-adopting-agile-regulatory-governance-to-foster-innovation

26. National Academy of Public Administration / PMI, “Agile Regulation: Gateway to the Future”. https://napawash.org/academy-studies/agile-regulation-framework

27. GL Solutions, “Modernization in 2026: AI Rewrites the Rulebook for Regulatory Agencies”. https://glsolutions.com/regulatory-agency-software-blog/modernization-in-2026-ai-rewrites-the-rulebook-for-regulatory-agencies/