Risky artificial intelligence: The role of incidents in the path to AI regulation

Abstract

As Artificial Intelligence (AI) becomes increasingly embedded in critical digital infrastructure, including telecommunications, its integration introduces new risks that existing regulatory frameworks are ill-prepared to address. This paper conducts a comparative legal study of policy instruments across ten countries, examining how telecom, cybersecurity, data protection, and AI laws approach AI-related risks in infrastructure. The study finds that regulatory responses remain siloed, with minimal coordination across these domains. Most frameworks still prioritize traditional cybersecurity and data protection concerns, offering limited recognition of AI-specific vulnerabilities such as model drift, opaque decision-making, and algorithmic bias. Telecommunications regulations, in particular, exhibit little integration of AI increasingly supporting critical network considerations, despite AI systems operations. The paper identifies a governance gap where oversight remains fragmented and reactive, while AI reshapes the digital infrastructure. It provides a foundation for more coherent and anticipatory regulatory strategies spanning technological and institutional boundaries.