Governments worldwide are racing to regulate AI, but new research suggests poorly designed rules could make AI systems less safe than having no regulation at all. A key question is who should be responsible for AI product safety—big tech companies building underlying models or firms adapting them for specific tasks. A study in *Proceedings of the National Academy of Sciences* finds that putting the bulk of the burden on downstream companies could be worse than having no rules. “There’s a free-riding behavior that occurs,” said Benjamin Laufer from Cornell University, who led the research. “The regulation acts as a tool for the general provider to offload the safety burden onto the downstream specialist.” The analysis used a game theory model treating AI development as a two-step game where a “generalist” developer builds a model before a “specialist” adapts it. In the absence of rules, both firms invest in safety because a safer product earns more revenue. But if the specialist is forced to meet regulatory requirements, the generalist can cut its own spending, and total safety settles at the legal minimum, below what would have occurred with no regulation.