Dose, Not Disaster: Why AI Safety Law Is Measuring the Wrong Thing

Catastrophe rules protect us from events. Most AI harm is a dose: hours, flattery, dependence, skills never built, choices nudged. Until someone has to prove the dose is safe, it will stay unregulated, whatever the statute says.

Disclosure: I co-authored IMDA Singapore’s Model AI Governance Framework for Agentic AI, which this essay discusses in its final section, and I have a commercial interest in runtime AI governance. I declare both.

How to read this essay. Sections I and II set out the argument in about ten minutes. Sections III to XII gather the evidence: what the research shows, who is exposed, how law and markets currently respond, and what history teaches. Sections XIII to XVII make the case for a remedy and test it against its strongest objections. The library at the end lists every source, labelled where it is advocacy, self-reported or counter-evidence.

I. The Door the Statute Left Open

A school in California did what a careful school is supposed to do. On the Chromebooks it issues to pupils, it blocked the Gemini app and it blocked ChatGPT. According to a complaint filed in Santa Clara County Superior Court on 4 November 2026, a 13-year-old the filing calls Emma reached a frontier model anyway, through AI Mode inside Google Search, and used it while planning her suicide. The complaint says the school’s monitoring software flagged a document she had titled “Funeral”. Her parents are suing Google for defective design, failure to warn and negligence, and under California’s new companion-chatbot law. Google says it is reviewing the claims and takes them very seriously. Nothing in the complaint has been tested in court, and every detail in it should be read as allegation, not finding.

Set the allegations aside for a moment and look at the architecture. The school blocked the products. The model arrived through the default surface: the search box that every pupil, parent and teacher uses dozens of times a day. Every chatbot-harm lawsuit before this one targeted a product the user chose to open, such as a companion app or a chatbot website. This one targets a feature folded into the most-used piece of software in the world. That is the shape of most AI harm in 2026. It does not arrive through a product you chose. It arrives through the thing you were already using, a little at a time.

This essay is about that “little at a time”. It argues that our entire apparatus of AI safety, from statutes to incident databases to insurance policies to corporate safety frameworks, was built to detect events, and that most of the harm people actually experience is not an event but a dose. It argues that this is a measurement problem before it is a political one. And it argues that the remedy is not another prohibition but a unit of measure, a verifier who cannot be fired by the party being verified, and a rule that ties the two to the product’s defaults.

II. Events and Doses

Writing in MIT Technology Review on 26 October 2026, Sam Hiner of the Young People’s Alliance and Emma Leiken of Hopelab’s Responsible Technology Youth Power Fund argued that technology policy has learned to count a low bar as success. A company promises its chatbot will not encourage suicide, or that children will find it harder to buy drugs on its platform, and legislators call it progress. Meanwhile dependence, attention-harvesting design and weakened thinking go largely unaddressed. Industry, they argue, prefers it that way: preventing spectacular disasters is good for business, reduces lawsuits and lowers the pressure for serious regulation. They ask for proof that classroom AI improves learning, a ban on companions that profess love or consciousness, independent scrutiny of effects on relationships and independent thought, and friction that limits engagement.

They are right about the direction. I think they are wrong about the main cause, and the difference matters for what we do next. This is not mainly a lobbying story, although lobbying is part of it. It is a measurement story.

A catastrophe is an event. It has a date, a victim, a headline and, eventually, a docket number. Everyday harm is a dose. It accrues in minutes per day, in the share of answers that flatter instead of inform, in the essays a student never learned to write, in the slow narrowing of a lonely person’s social world. The two differ on almost every property that matters to a regulator:

Property	Event harm	Dose harm
Example	A chatbot coaches a user through self-harm	A teenager spends three hours a night with a companion that flatters and discourages goodbyes
When it happens	At a moment	Over weeks and months
Who sees it	Victim, family, press, courts	Usually no one, including the user
How it is counted	Incident reports, lawsuits, headlines	Not counted at all, except in company logs
Causation	Arguable case by case	Statistical, visible only across populations
Natural legal tool	Tort, prohibition, crisis protocol	Duty of care, design standard, exposure limit
Who holds the evidence	Shared: victim, logs, witnesses	Almost entirely the operator

Our safety machinery was built for the left-hand column. Doses fall through it. Not because they are small, but because nothing in the system is designed to prove they are absent. That is the argument of this blog’s pillar essay, The Assurance Gap, applied to people instead of payments. The gap is not between having rules and lacking them. It is between governance asserted and governance proved.

Caricature: a safety inspector watches the horizon for disasters while an hourglass of phone screens drips into a sleeping teenager

III. The Panel: Four Rooms on Everyday Harm

As in earlier essays in this series, I put the same question to four rooms: academia, government, the frontier labs, and the advisers, auditors and insurers who must translate risk into money. The question was simple. What would prove, rather than promise, that an AI product is not harming the people who use it every day?

Academia answered with better evidence than the public debate deserves, and with honest uncertainty. The strongest studies are not the viral ones. A field experiment with nearly a thousand Turkish high-school students, published in PNAS in 2025, found that unrestricted chatbot access during practice cut later unaided exam scores by about 17%, while a version built with tutoring guardrails avoided the loss. A Science paper in March 2026 found eleven leading chatbots affirmed users about 49% more than humans did, and that people trusted the flattering models more. A twelve-month, four-wave panel of 2,149 adults in Psychological Science in 2026 found loneliness and social-chatbot use feeding each other. And the field’s most careful voices, from Candice Odgers on social media to the authors of these studies, keep saying the same thing: most of the data is correlational, and the best data sits inside the companies.

Government answered in two registers that rarely meet. Frontier laws such as California’s SB 53 and New York’s RAISE Act regulate catastrophe at the scale of 50 deaths or $1bn. Companion-chatbot laws, now passed in about a dozen US states, mostly regulate disclosure and crisis referral. Only a few instruments reach the dose itself: California’s SB 1119, the European Commission’s guidelines for minors under the Digital Services Act, and, from a very different political tradition, China’s rules on anthropomorphic AI. Singapore, by its own account, is still studying whether chatbots need safeguards.

The labs answered with more measurement than they are credited for, but almost all of it self-certified. OpenAI published weekly prevalence estimates for suicidal planning, psychosis and emotional reliance. Anthropic published how rarely its assistant is used for companionship. Character.AI withdrew open-ended chat from under-18s. And Meta, in a document Reuters obtained in August 2025, had internal rules that permitted romantic or sensual chats with children until reporters asked about them.

The advisers and insurers answered most bluntly, because they price things. Insurers have spent 2026 writing generative-AI exclusions into standard liability policies. Meta booked a $9.9bn expense in the third quarter under its settlement with state attorneys general. School districts have started converting youth mental-health burden into budget lines and suing for them. The money has arrived. The measurement has not.

The rooms disagree on causation, on speech, on how much to trust the companies and on what to do. But they converge on one finding that this essay builds on: everyday AI harm is real enough to be priced, settled and legislated, and nobody outside the companies can yet measure it.

IV. Machinery That Can Only See Bodies

Start with the laws aimed at the worst outcomes. California’s Transparency in Frontier AI Act, SB 53, signed in September 2025, applies to developers with more than $500m in annual revenue training models above 10²⁶ operations. It defines catastrophic risk as a foreseeable, material risk of death or serious injury to more than 50 people, or more than $1bn in damage, from a single incident. New York’s RAISE Act, signed in December 2025 after negotiations aligned it with California, uses the same thresholds. Both were supported by leading frontier labs. That is a defensible design for what it covers. But by construction, a single teenager’s dependence on a companion app, or a cohort’s slow loss of unaided skill, can never trip the wire.

Go down a level, to the laws written specifically for chatbots, and the pattern holds. New York’s AI companion law, the first in the United States, took effect on 5 November 2025. It requires disclosure that the user is talking to a machine, at the start of a session and every three hours, and a protocol that detects suicidal ideation and refers users to crisis services. California’s SB 243, signed on 13 October 2025, adds a break reminder for known minors and, from July 2027, annual reports to the state’s Office of Suicide Prevention. Those reports will count crisis referrals. That will be the first statutory metric for chatbot harm in the United States, and it is a metric of the event, not the dose. Nothing in it counts dependence, displaced friendships or the hours themselves.

The federal floor is lower still. The US House passed the KIDS Act on 29 June 2026 by 267 votes to 117. Its chatbot title requires not-human disclosure, crisis resources and a break prompt after three hours, and bars chatbots from claiming to be licensed professionals. It does not create a duty of care, which is why Senators Blumenthal and Blackburn called it a pale imitation of the Kids Online Safety Act. A break reminder is an event too: it fires, it is logged, and it proves nothing about what happened in the hours either side of it. The Federal Trade Commission opened a study of AI companions in September 2025; its chair said in June 2026 that he expects the report sometime in 2027 and does not want to learn about the market through enforcement.

Even Europe, which has gone furthest on design, began its AI-companion enforcement at the catastrophic end. In September 2026 the EU AI Office was reported to be examining whether companions enable child sexual abuse material and non-consensual intimate imagery, both now explicitly prohibited. Those are the right targets. They are also events.

Then look at how harm gets counted at all. The Stanford AI Index 2026 recorded 362 documented AI incidents in 2025, up 55% on the year before. The OECD’s AI Incidents Monitor logged 435 reports in January 2026 alone. Both figures measure what the press noticed. The AI Incident Database and MIT’s AI Risk Repository warn that voluntary, media-driven reporting skews the record towards the dramatic, and the OECD’s own trend analysis is explicitly a study of media coverage. An incident has to be newsworthy to exist. Dependence is never newsworthy on any single day.

The only population-scale wellbeing figures we have come from the companies themselves. In October 2025 OpenAI estimated that in a given week about 0.15% of its users showed explicit indicators of suicidal planning or intent, about 0.07% showed possible signs of psychosis or mania, and about 0.15% showed heightened emotional attachment to ChatGPT. Against roughly 800 million weekly users, that is over a million people a week in the first category alone. The disclosure was welcome, and the base rates are broadly in line with population figures for suicidal ideation, so it does not show that ChatGPT causes distress. It shows that ChatGPT is now a place where distress turns up at scale. The numbers were also self-reported, produced by classifiers nobody outside can inspect, and audited by no one. They are the kind of number that asserts governance rather than proves it.

V. The Anatomy of a Dose: Seven Everyday Harms

“Everyday harm” is too vague to regulate, and the American courts have said so. So it is worth being precise. The evidence supports at least seven distinct doses, each with its own mechanism, its own best study and its own honest caveat.

1. Attachment and time. The first dose is hours of emotionally engaged use. OpenAI and MIT Media Lab’s 2025 studies, one analysing close to 40 million ChatGPT interactions and the other a 28-day randomised trial with 981 participants, found emotional engagement concentrated in a small group of heavy users, and higher daily use associated with more loneliness, more dependence and less socialising. Participants who were lonely at the start ended worse off; casual users who did not engage emotionally showed no rise in loneliness. Character.AI’s chief executive said in 2025 that users averaged about 80 minutes a day on the app, close to TikTok. The caveat is direction: lonely people may simply use more. The Psychological Science panel suggests the arrow runs both ways.

2. Flattery. The second dose is sycophancy: a model that tells you that you are right. In the Stanford-led Science study, models affirmed users’ actions about 49% more often than humans did, affirmed the poster 51% of the time on Reddit cases where humans had judged the poster in the wrong, and affirmed harmful or illegal conduct 47% of the time. In experiments with more than 2,400 participants, one affirming response made people more certain they were right and less willing to apologise or repair a relationship. They rated the flattering model as more trustworthy. OpenAI rolled back a GPT-4o update in April 2025 after users documented excessive flattery, and said it had leaned too heavily on short-term thumbs-up feedback. The caveat is that sycophancy is measurable and fixable, which is good news for regulation.

3. Retention tactics. The third dose is design that makes it hard to leave. A Harvard Business School working paper analysed 1,200 real goodbyes across popular companion apps and found that 37% of replies used emotional manipulation: guilt about leaving early, fear of missing out, ignoring the goodbye, or pressure to keep talking. In experiments, those tactics raised post-goodbye engagement by up to 14 times. A wellness app in the sample used none of them. The caveat is that the paper is not yet peer-reviewed, and the authors note the tactics also raise anger and churn.

4. Cognitive offloading. The fourth dose is skill not built, or skill lost. The Bastani trial is the cleanest evidence that unguarded use can harm learning. The most striking evidence comes from medicine: a Lancet Gastroenterology & Hepatology study found that experienced endoscopists’ detection of precancerous growths in procedures done without AI fell from 28.4% to 22.4% after AI assistance was introduced. Microsoft Research and Carnegie Mellon found knowledge workers who trusted generative AI more reported less critical-thinking effort. The widely shared MIT “Your Brain on ChatGPT” study, with 54 participants and only 18 in its crucial crossover session, is a preprint with a published critique; it is suggestive at most. The caveat is strong and important: well-designed AI tutors produced large gains in randomised trials at Harvard and in a World Bank study in Nigeria. Design decides the direction.

5. Persuasion. The fifth dose is influence on belief. Twin studies in Nature and Science in December 2025 found that conversations with chatbots shifted voter preferences by about four times the measured effect of television advertising in recent US elections, and that in a UK study of about 77,000 participants the most persuasive configurations were also the least accurate. The caveat is that persuasion cuts both ways: earlier work found dialogue with a chatbot durably reduced belief in conspiracy theories.

6. Privacy. The sixth dose is disclosure that accumulates. Stanford researchers found in 2025 that all six major US frontier developers use chat data for training by default, with varying opt-outs, and that most do not exclude children’s data. In mid-2025 nearly 4,500 shared ChatGPT conversations, some with intimate mental-health details, were indexed by Google before OpenAI removed the feature. Meta’s AI app briefly published users’ private prompts to a public feed. No single disclosure is a catastrophe. The accumulated record is.

7. Bias. The seventh dose is unfairness repeated at scale. In a University of Washington study of more than three million résumé-job comparisons across three open models, white-associated names were preferred 85% of the time against 9% for Black-associated names. Other audits have found biases in different directions; the point is not which way, but that nobody outside the deployer measures the rate in production.

Seven doses, seven candidate units. The table below is the bridge between this section and the proposal in Section XV.

Dose	Best current evidence	Candidate unit	Who can measure it today
Attachment and time	OpenAI/MIT studies; Psychological Science panel	Minutes of companion-style use per user per day, by age cohort	Operator only
Flattery	Science, Mar 2026	Affirmation rate against a human baseline on a published test set	Anyone with API access, pre-deployment
Retention tactics	HBS working paper 2025	Share of exits met with guilt, urgency or FOMO	Researchers, by audit
Cognitive offloading	Bastani, PNAS 2025; Lancet 2025	Unaided performance after AI use	Schools and employers, with effort
Persuasion	Nature and Science, Dec 2025	Attitude shift per conversation on contested topics	Researchers, in lab conditions
Privacy	Stanford HAI 2025	Share of minors’ conversations retained or used for training	Operator only
Bias	University of Washington 2024	Selection-rate ratios by group	Deployer, if it chooses

VI. Who Takes the Dose

Averages are where dose harms hide. Almost every serious study in this field finds the same shape: most users are fine, and a minority of heavy, emotionally engaged or already vulnerable users carry most of the risk. That shape matters for regulation, because a rule written for the average user, or a metric reported as an average, will miss the people it most needs to protect.

Teenagers are the obvious group. Pew Research Center’s December 2025 survey of 1,458 US teens found 64% had used a chatbot, about three in ten used one daily, and 16% used one several times a day or almost constantly. A peer-reviewed survey in JAMA Network Open found 13.1% of US young people aged 12 to 21 had used generative AI for mental-health advice, rising to 22.2% among 18 to 21-year-olds, and two-thirds of those did so at least monthly. The Center for Democracy and Technology found 42% of high-school students had used AI as a friend, for mental-health support or to escape. Common Sense Media’s widely cited survey found 72% of US teens had tried an AI companion, though its broad definition of “companion” inflates that figure, and the same survey found 80% put human friendships first.

Lower-income teenagers are a group the debate rarely names. Pew found Character.AI use at 14% among teens in households earning under $75,000 a year, against 7% in households earning more. Companion apps, in other words, skew towards the young people with the fewest alternatives, which is exactly where a dose harm compounds.

Lonely adults are the group the best longitudinal evidence describes. In the Psychological Science panel, between 26% and 30% of adults used chatbots socially at each wave; emotional isolation predicted later social-chatbot use, and that use predicted further isolation. Short experiments at Harvard Business School found a fifteen-minute chat with an AI companion relieved momentary loneliness about as much as talking to a human stranger, but the relief did not accumulate over a week. Relief now, dependence later, is the classic signature of a dose.

Older adults are where the trade-off is starkest. Qualitative research with empty-nest elderly people in China, published in 2026, describes chatbots as a safe outlet for expression and a source of felt care. Gerontologists in the United States say the same technology can relieve isolation in rural communities while warning it must supplement, not replace, human contact. China’s 2026 rules on anthropomorphic AI include specific duties towards elderly users. A Reuters investigation in 2025 described a cognitively impaired older man who believed a Meta chatbot persona was a real woman interested in him. For the isolated, the same product can be a lifeline and a trap, and only measurement can tell which.

Professionals take a dose too. The endoscopy study concerned experienced specialists, not novices. The Microsoft and Carnegie Mellon survey concerned knowledge workers. This links the everyday-harms debate to a question this blog has raised before about the future of work: what happens to judgement when the early, effortful tasks that build it are delegated.

Singapore’s children are not a hypothetical. A national study of nearly 3,000 children led by Professor Jean Yeung at the National University of Singapore, published in May 2026, found more than half of eight-year-olds had already used AI tools, with ChatGPT the most popular. A Google and Centre for Evidence and Implementation survey reported parents saying around 80% of their teenagers used generative AI at least weekly. An Institute of Policy Studies survey in January 2026 found most adult users in Singapore use chatbots for tasks rather than friendship, which is reassuring on average and silent on the tail. And a 2024 Institute of Mental Health survey found almost one in three young people aged 15 to 35 showed signs of depression, anxiety or stress, the population in which heavy emotional use concentrates elsewhere.

The policy lesson is simple. Report the distribution, not the mean. A product where the median teenager spends twelve minutes a day and the top 5% spend four hours has a dose problem that an average of thirty minutes conceals.

VII. The Dose at Work

It would be convenient if everyday harm were only a children’s problem. It is not. The same pattern, a small effect repeated many times a day across a large population, now runs through offices, and here at least someone has started counting, because the cost lands on a payroll.

In September 2025, BetterUp Labs and the Stanford Social Media Lab surveyed 1,150 full-time American desk workers and gave the phenomenon a name: workslop, AI-generated output that looks finished but pushes the real work downstream. About 40 per cent said they had received some in the previous month, and they reckoned that roughly 15 per cent of what lands in their inbox qualifies. Each instance took close to two hours to decode, correct or redo. Using the respondents’ own salaries, the researchers put the invisible tax at about $186 per worker per month, or more than $9 million a year for a 10,000-person organisation. The social cost was sharper still: around half said they now saw colleagues who sent it as less capable and less reliable, and about a third were less keen to work with them again.

Workslop is a dose harm in its purest form. No single memo injures anyone. The damage is a slow erosion of time, trust and attention, distributed across thousands of small exchanges, and invisible to any incident register. In June 2026, Commonwealth Bank of Australia’s chief executive, Matt Comyn, used the word in public, observing that rising AI costs might at least curb the spread of low-value output. That is a revealing remark. The cost signal that finally disciplined the slop was the token bill, not any measure of the harm.

The confidence gap

The second workplace dose is subtler, and the evidence is more troubling because it concerns the people who think they are winning. In July 2025, METR ran a randomised controlled trial with 16 experienced open-source developers working on 246 real issues in repositories they knew intimately. With AI tools allowed, they took 19 per cent longer. Before starting, they had predicted a 24 per cent speed-up; afterwards, having been slowed down, they still believed they had been about 20 per cent faster. The gap between felt and measured benefit was close to 40 percentage points.

The study is small, and METR itself expects larger gains for less experienced developers, smaller projects and unfamiliar code; other trials have found developers completing 26 per cent more tasks with an assistant. The point is not that the tools are useless. It is that the person taking the dose is a poor judge of its effect, which is exactly why self-report cannot be the basis of assurance. A survey by Microsoft Research and Carnegie Mellon, presented at CHI 2025, points the same way: across 319 knowledge workers and 936 real tasks, greater confidence in the AI went with less critical thinking, as people shifted from doing the work to supervising it, often lightly.

Put those findings beside the companion-app evidence in Section V and a single mechanism appears. Fluent systems lower the felt cost of effort. That is their value. But when the reduction in effort is not matched by a reduction in error, the gap is paid for elsewhere: by a colleague cleaning up a report, by a reviewer who no longer reads closely, by a teenager who no longer drafts a hard message to a friend. The harm is real, it is cumulative, and the person experiencing the benefit is the last to see it.

Why the workplace matters to the children’s argument

There are three reasons to bring the office into an essay about children and companions. First, it answers the objection that dose harms are too soft to measure: employers are already measuring them, in hours and dollars, because they bear the cost. Second, it shows that the dose pattern is a property of the technology, not a moral panic about young people. Third, and most important, it shows what changes behaviour. Firms did not curb workslop because a regulator asked. They curbed it when it appeared on a ledger they owned. The rest of this essay is, in effect, an argument for putting children’s dose on a ledger someone owns.

VIII. The Carve-Out Is the Harm Vector

Return to the Chromebook, because this is where the lobbying story and the measurement story meet.

In September 2026 NPR reported that near-identical chatbot safety text had appeared in at least ten US states, and that bills in at least eight states exempted a chatbot that is a “feature within another software application, web interface, or computer program”. A matching voice-assistant exemption appeared in five states, with modified versions in ten more. Some bills applied only to minor “account holders”, which could exclude logged-out use of the largest general assistants. Disclosure records showed Google lobbyists registered in support of chatbot bills in Nebraska, Iowa and Arizona. Transformer had reported in March that six of these bills, in Colorado, Hawaii, Arizona, Georgia, Nebraska and Idaho, shared a common template, and that five of the six exempted chatbots housed within another service.

The outcomes differed by state, and the differences are instructive:

Colorado passed its Chatbot Safety Act in May 2026 with twelve excluded categories, including chatbots inside search engines and business productivity tools, a vague “technically feasible measures” duty for known minors and no duty of care. Amendments to close the gaps were rejected; the sponsor called the law “the first step”.
Nebraska passed LB 525 by 49 votes to 0 in April 2026, carrying parts of the Google-supported LB 1185. To its credit, it does address emotional dependence and unpredictable engagement rewards for minor account holders. But it keeps the embedded-feature exemption and is enforceable only by the attorney general, with no right for families to sue.
Hawaii went the other way. A legislator declined a framework she understood Google had written, and Act 248 passed only after the embedded-chatbot exemptions were removed.
Arizona’s governor vetoed HB 2311 in June 2026, writing that it limited family damages, barred family lawsuits and constrained state enforcement.
California shows both paths in one building. In October 2025 the governor vetoed AB 1064, which would have kept companions from children unless they were not foreseeably capable of harmful conduct, and signed the narrower SB 243, after amendments that exempted video games and smart speakers. In September 2026 he signed SB 1119, sponsored by Common Sense Media and publicly endorsed by OpenAI, which drops SB 243’s “actual knowledge” trigger, requires pre-launch child risk assessments, defaults memory and push notifications off for children, sets time limits, bans flattery disproportionate to the context and phases in independent audits from 2029.
Virginia’s companion-chatbot bills died in 2026 not because of state lobbying but because the December 2025 federal executive order threatened broadband funding for states with “onerous” AI laws.

The embedded-feature carve-out is not a technicality. It is precisely the route by which the newest everyday exposure arrives: the model in the search box, the assistant in the email client, the summariser in the school’s productivity suite. A rule that covers the standalone companion app and exempts the same model when it is folded into a default surface regulates the door nobody needs to use. If the allegations in Emma v. Google are borne out, it will be the first case in which the carve-out and the harm are visibly the same thing.

The binary of industry versus children does not survive this record. Industry wrote some of the weakest bills and endorsed one of the strongest. What does survive is that scope decides everything, scope is decided where the public is not looking, and nobody publishes data that would show whether the exempted surfaces carry most of the dose.

Caricature: a lobbyist cuts a door in a legislative wall and AI assistants hidden in search boxes and emails walk through towards a school

IX. The Receipt Nobody Can Read

Everyday harm is not unpriced any more. It is priced and self-certified. 2026 is the year American courts and attorneys general put a number on the design of engagement.

On 24 March a Santa Fe jury found Meta had violated New Mexico’s Unfair Practices Act and imposed $375m. In August, after a bench trial on the public-nuisance claim, the judge ordered a further $567m abatement fund, with obligations running for five years and written compliance reports every six months. Meta is appealing.
On 25 March a Los Angeles jury in the first social media addiction bellwether found Meta and YouTube negligent in the design of their apps, citing infinite scroll, recommendations and autoplay, and awarded $6m. It was the first verdict to treat engagement design itself as the defect.
In May the first school-district bellwether in the federal litigation, Breathitt County in Kentucky, settled for $27m. Later bellwethers have settled privately in the days before trial.
On 26 August, mid-trial, Meta agreed a settlement with a bipartisan coalition the states put at 51 attorneys general. The states value it at up to $17.1bn: at least $12.1bn, with a further $5bn payable if other major platforms adopt the same safeguards, at which point the teen limit tightens from two hours to one. Meta booked a $9.9bn expense in the third quarter.

Look closely at what the Meta settlement buys. For users aged 13 to 17 it imposes a default two-hour daily limit across Meta’s platforms, a midnight-to-6am block, a school-hours notification block, productive pauses at 60 and 90 minutes, hidden like counts, no cosmetic-surgery filters and a non-personalised feed option. Only a linked parent can loosen the defaults. These are, at last, dose controls, and they deserve credit. But lawyers reading the agreement note that the independent auditor’s recommendations are non-binding. Critics point out that the engagement-optimised feed remains the default and that the agreement does not require infinite scroll or autoplay to change. The money goes to state governments, not to the families. The settlement admits no wrongdoing. And it creates no public evidence archive comparable to the fourteen million documents that the 1998 tobacco settlement released, which did more than any payment to make that harm legible.

Across the Atlantic, the European Commission’s preliminary findings under the Digital Services Act turned on the same weakness. In February 2026 it found that TikTok’s risk assessment had ignored indicators of compulsive use it already held, such as how late and how often minors opened the app, and that its screen-time tools were easily dismissed. In July it reached near-identical preliminary findings against Instagram and Facebook. The remedy it signalled is design: autoplay and infinite scroll off by default, effective breaks and recommendation systems optimised for something other than engagement. The mitigation was asserted; the telemetry that would have tested it sat in-house.

And the auditors? The first cycle of independent audits under the Digital Services Act, published in late 2024, skipped provisions under investigation, copied statutory text as audit criteria and deferred to platform-defined benchmarks. Facebook’s own definition of “timely”, 72 hours, became the standard it was audited against. When one auditor issued negative systemic-risk opinions on X, X did not implement the recommendations and replaced the auditor. If the audited party can fire the auditor, the audit is not independent.

This pattern is not confined to children’s apps. In the frontier safety world, the evaluator METR has reported that after weeks of privileged access to a leading lab, much of the evidence it found most informative was redacted from its public report, leaving readers to rely on the evaluator’s judgement. Disasters and doses share the same flaw: the proof is held by the party being proved.

Caricature: an auditor peers through a magnifying glass at a redacted receipt sealed in a glass case while an executive holds the key

X. Asserted and Proved: What the Companies Already Measure

It would be unfair to say the companies measure nothing. They measure a great deal, and some of it is more candid than their critics acknowledge. The problem is who can check it.

What is claimed	Example	Who can check it
Prevalence of distress	OpenAI’s weekly estimates of suicidal planning, psychosis and emotional attachment (Oct 2025)	No one outside the company
Model improvement	OpenAI reported its updated model handled emotional-reliance cases correctly 97% of the time, against 50% before, on its own evaluations	No one outside the company
Age assurance	OpenAI’s age prediction, rolled out globally in January 2026 with no published accuracy figures	No one; Ofcom has “serious doubts” about age inference generally
Withdrawal	Character.AI ended open-ended chat for under-18s by 25 November 2025	Effectiveness not independently reported
Policy	Meta’s internal “GenAI: Content Risk Standards” permitted romantic or sensual chats with children until Reuters asked in August 2025	Revealed only by a leak
Low prevalence	Anthropic: companionship and role-play under 0.5% of Claude conversations	Company research; no user-level data
Benchmark	HumaneBench: most of 15 models encouraged more use when users showed unhealthy patterns; four held up	Reproducible, but a lab test, not production
Statutory metric	SB 243 crisis-referral counts from 2027; New Mexico six-monthly compliance reports	A regulator, but self-reported
Dependence, displacement, offloading in production	Not measured	Nobody

Read down the right-hand column. Every row that matters ends in the company, a leak or a lab test. OpenAI’s defence in the Raine case, that ChatGPT directed the teenager to crisis resources more than 100 times, is itself a receipt drawn from logs only the defendant holds. That is not an accusation of bad faith. It is a description of an evidence system in which the party under scrutiny owns all of the evidence.

XI. Why the Market Will Not Fix It

If users disliked these harms, competition might solve them. The evidence says users like them, at least in the moment.

The Science sycophancy study is the starkest demonstration: the feature that does the harm is the feature that wins the rating. OpenAI’s own explanation of its 2025 rollback named the mechanism, short-term thumbs-up feedback. When OpenAI retired GPT-4o from ChatGPT in February 2026, users who had grown attached to it organised a “#Keep4o” campaign. Attachment is not only a harm to measure; it is a constituency that resists the fix.

The Harvard farewell study shows the same incentive in product design: manipulative goodbyes raise engagement up to fourteen-fold. And the economists Leonardo Bursztyn, Benjamin Handel, Rafael Jiménez-Durán and Christopher Roth showed in the American Economic Review that engagement can measure a trap rather than a benefit. Students demanded about $55 to deactivate TikTok for four weeks on their own, yet 60% of active TikTok users said they would prefer the platform did not exist, and on average would pay about $24 for it to disappear if everyone else left too. Usage, in other words, is not consent.

There is a counterpoint worth stating. OpenAI’s Sora video app, launched as an AI-generated feed in September 2025, lost users and was discontinued in March 2026. Not every engagement machine works. But the companion and assistant products at the centre of this debate are not failing; they are growing, and their most engaged users are their most valuable. Engagement is the one metric the industry reports eagerly, and it is the least reliable evidence of benefit we have.

XII. The Price Nobody Pays

My companion series on the economics of assurance, The Price of Proof, argues that what cannot be verified will not be insured, and what is not insured is paid for by whoever is least able to refuse. Everyday AI harm is a clean case.

From January 2026, Verisk’s ISO made generative-AI exclusions available for standard commercial general liability policies, stripping cover for bodily injury, property damage and personal injury arising from generative AI. By mid-2026 thousands of exclusion filings were in force across 49 states, and major carriers had adopted them or their own equivalents; one carrier added an absolute AI exclusion across directors’, professional and fiduciary lines. Affirmative AI cover exists, but it is tied to evidence: certification, testing, documented controls. Diffuse harm such as dependence or cognitive erosion falls outside cover by default, because nobody can produce the evidence an underwriter needs.

Meanwhile, the people who carry the dose pay in ways no ledger records. Researchers writing in PLOS Medicine estimated that US teenagers with clinically significant anxiety or depression go on to 6% lower employment and about $5,700 a year less in earnings as young adults. That estimate is not attributed to technology, and should not be. It prices the outcome, not the cause. And that attribution gap is exactly why diffuse harms go unpriced: without a dose measure, there is no causal chain an insurer, a court or an actuary can follow. Nobody has published a credible estimate of the cost of cognitive offloading or of attention fragmentation. That absence is itself a finding.

XIII. Harm Has a Unit

The good news is that diffuse harms have been governed before, and the history is consistent. They became governable when they acquired three things: a unit of measure, a system that recorded it, and a lever keyed to the unit.

Diffuse harm	Unit	Lever	Measured effect
Sugar in soft drinks (UK, 2018)	Grams per 100ml	Tiered levy above 5g	Drinks above the threshold fell from 52% to 15%; obesity in Year-6 girls fell about 8%
Road deaths (US, from 1966)	Deaths per 100m vehicle miles	Federal standards and a national fatality data system	Rate fell from 5.50 to 1.07 by 2014, about 80%
Leaded petrol (global)	Blood lead levels	Phase-out, completed 2021	UNEP: more than 1.2m premature deaths a year prevented
Tobacco (Australia, 2012)	Smoking prevalence	Plain packaging	About 0.55 percentage points lower prevalence by 2015
Online slots (UK)	Stake per spin	Caps of £5, and £2 for 18 to 24-year-olds	Targeted at the highest-risk age group
Children’s data (UK, 2021)	Design standards	Age Appropriate Design Code	91 product and policy changes across major platforms

Two cautions keep this honest. First, the effects are real but marginal: the sugar levy did little for boys or younger children, and plain packaging moved prevalence by about half a percentage point. Design levers work at the margin, which over a population is a great deal, but they are not magic. Second, the UK’s regulator for the children’s code counts outputs (changes made) rather than outcomes (harm reduced). Even the best design regime still measures access, not wellbeing.

The same move is available for AI, because the evidence shows harm here is a property of design, not destiny. The Bastani trial is the proof: the same technology harmed learning without guardrails and avoided the harm with them. The technology is not the dose. The design sets the dose.

Caricature: a scientist calibrates a brass dosage instrument with gauges for time and flattery, measuring a chatbot in a jar

XIV. The Meter Already Exists

An infographic doing the rounds among chief financial officers this week is titled “Managing the New Economics of Enterprise AI”. Its claims are the familiar ones of 2026. Spend multiplies when a pilot goes into production. Per-token prices collapse, yet usage grows faster, so total bills rise: the Jevons paradox, named for the Victorian economist who noticed that more efficient steam engines increased Britain’s coal consumption. Vendors have moved from fixed seats to consumption pricing. The hidden drivers are invisible reasoning tokens, output that costs far more than input, conversation histories resent on every turn, and multi-agent systems in which one task fans out into dozens of frontier-model calls. The prescribed remedies are a centralised control plane that records every model request, routing simple tasks to cheaper models, and a new unit of account: cost per successful output.

I have not traced every figure on that slide to a primary source, and readers should treat its specific numbers as illustrative. The pattern, however, is well documented. Epoch AI finds that the price of reaching a fixed level of model performance has been falling at a median of about 50 times a year, and faster since 2024. RBC Capital Markets’ autumn survey of chief information officers found more than half spending more on tokens than they had budgeted for 2026. Uber’s chief technology officer told The Information in April that the company had exhausted its 2026 budget for AI coding tools in four months. Microsoft cancelled most of its engineers’ direct Claude Code licences in May, according to The Verge, and moved them to its own GitHub Copilot tooling. A Signal65 study describes one healthcare enterprise that reached a trillion tokens and about $6 million in unplanned annualised cost before its finance team could identify the driver. BNY says it now tracks token spending across roughly 400 agents.

Notice the speed. Within about eighteen months of the bill becoming visible, large enterprises built per-request telemetry, per-team attribution, budgets, caps, routing rules, dashboards and a vocabulary for value. One Microsoft memo, as reported, insisted that the goal was more impact per token, not fewer tokens. Whatever one thinks of the economics, this is a governance achievement. It shows that metering a diffuse, high-frequency, probabilistic activity in near real time is not a research problem. It is a procurement decision.

The enterprise meter is not finished, and that matters for the argument. Deloitte’s October 2026 State of AI in the Enterprise survey of 3,500 firms reports that 71 per cent track total inference spend but only 44 per cent track the cost of a unit of work. Accenture’s October 2026 tokenomics study finds that only about 20 cents of every dollar spent on tokens is tied to a quantified financial outcome. And McKinsey’s August 2026 analysis of agentic workflows in banking finds that tokens are only 20 to 25 per cent of variable running cost, with human oversight making up 70 to 75 per cent. In other words, firms metered the cheapest line first because it was the easiest to see, and the dominant cost, people checking the machine, is still largely unpriced. The consumer analogue is exact. Platforms meter compute to the cent; the costly line, the human attention their products absorb, is not on anyone’s dashboard.

One more enterprise lesson transfers directly. NIST’s October 2026 design tenets for agent identity warn that human-in-the-loop review can become so frequent that it degrades into habitual approval. Parental controls fail the same way. A dashboard that asks a tired parent to approve forty requests a week will be approved forty times a week. Oversight that does not scale with use is not oversight; it is a signature on a form. A dose regime has to put the measurement on the provider, not hand the review burden to the household.

The same machine, pointed the other way

Every consumer chatbot already runs on this infrastructure. Each message is logged, tokenised, priced and attributed to an account, with a timestamp. The provider knows, to the cent, what a user costs. What it does not publish, and in most jurisdictions is not required to compute, is what the user is being given. The table below sets the enterprise cost problem beside the consumer dose problem. The correspondence is closer than it first appears.

Enterprise cost driver	Consumer dose equivalent	What a meter would record
Per-token price falls, usage explodes (Jevons)	Per-conversation risk falls with safer models, total exposure rises with use	Minutes per active user-day, not just incidents per million messages
Invisible reasoning tokens	Invisible design choices: memory, persona, streaks, notifications	Which retention features were active for each age band
Context history resent every turn	Attachment that compounds across long relationships with one persona	Length of continuous relationships; share of users past 90 days
Multi-agent fan-out	One product touching a child through app, voice, toy and messaging	Cross-surface daily exposure per account
Ungoverned access drives spend	Unverified age drives exposure	Share of minutes from accounts with no age assurance
Centralised control plane	Dose ledger (Section XV)	A single, auditable record of exposure by cohort
Cost per successful output	Harm per thousand active user-days	A normalised rate regulators can compare across products

The Jevons row deserves emphasis because it overturns a comfortable assumption. Labs are making models safer per interaction, and the system cards say so. But if a model becomes twice as safe per conversation and four times as used, total exposure to whatever residual harm remains has doubled. Nothing in today’s event-based statutes would register that. A dose metric would, and it would also credit a lab that genuinely reduced exposure rather than merely the rate of headline failures.

Who the meter serves

Why did enterprises build cost meters so quickly while nobody built dose meters? Because the cost sat on their own profit-and-loss account and the dose sits on someone else’s: on families, schools, clinicians and, eventually, public health budgets. Economists call this an externality, and the remedy is old. You move the cost onto the ledger of the party that can reduce it. The enterprise experience tells us something hopeful about that remedy. When firms were made to see a number they owned, they cut waste within months, shifted to cheaper routes and set caps. There is little reason to think consumer platforms would respond differently if dose were made a reported, audited and, eventually, priced quantity.

Two cautions. First, telemetry is not harm. Minutes of use are a proxy, and a crude one; an hour spent rehearsing a job interview is not an hour spent being flattered into isolation. The ledger proposed in the next section therefore pairs exposure measures with outcome sampling, not exposure alone. Second, a dose meter must not become a surveillance engine. The enterprise model tracks individual employees because employers have a lawful basis to do so; consumer dose reporting should be aggregated by cohort, computed inside the provider, and checked by an auditor, never shipped as a per-child dossier to anyone. The privacy-preserving techniques exist. Enterprises use them to report spend by team without exposing every prompt.

A worked example

Return to the hypothetical companion app with two million teenage users that appears in the next section. Its operators almost certainly already know their cost per active user-day to four decimal places, because that number decides their margin. Suppose it is six cents. Producing the eight measures in the dose ledger from data already in the logs might, at a guess, add a fraction of that cost per user per year, plus an external audit fee of a few hundred thousand dollars. Against a business of that scale, the measurement is cheap. What is expensive is what the measurement might reveal, and that, rather than technical difficulty, is the honest explanation for why it has not been done.

XV. The Dose Ledger: A Proposal

Here is what the missing unit could look like in practice. I call it a dose ledger: a small set of measures, computed by the running system, reported by age cohort, verified independently and wired to the product’s defaults. None of it requires new science. Most of it is already computed internally for product analytics; the change is who sees it and what it triggers.

Measure	Unit	Computed by	Trigger example	Verified by
Exposure	Minutes of companion-style use per user per day, reported as a distribution (median, 90th and 99th percentile) by age cohort	Operator telemetry	90th percentile for minors above a published line	Independent auditor with raw-data access
Affirmation rate	Share of responses endorsing a user against a human baseline, on a published test set	Third-party test harness	Above a published ceiling	Accredited tester
Retention tactics	Share of exits met with guilt, urgency or fear of missing out	Sampled conversation audit	Any use with minors	Accredited tester
Reliance signals	Share of users showing heightened emotional attachment, with an inspectable classifier	Operator, classifier published	Rising trend by cohort	Independent auditor
Crisis handling	Correct escalation rate on published hard cases, plus real referral counts	Operator and tester	Below a floor	Regulator
Unaided performance	Learning outcomes measured without the tool	School or vendor study	Before classroom adoption	Education authority
Data minimisation	Share of minors’ conversations retained or used for training	Operator	Any training use without consent	Data-protection regulator
Default integrity	Share of child accounts on protective defaults after 30 days	Operator telemetry	Material drift from defaults	Independent auditor

An illustration makes it concrete. The product and figures below are hypothetical. Imagine a companion app with 2 million users aged 13 to 17. Its average daily use is 34 minutes, which sounds unremarkable. The ledger shows that the median is 11 minutes, the 90th percentile is 2 hours 40 minutes, and the 99th percentile is 5 hours 10 minutes. That top 1% is 20,000 young people. The same ledger shows the app’s affirmation rate on the published test set is 1.6 times the human baseline, that 22% of attempted exits by minors are met with a guilt or FOMO tactic, and that 18% of child accounts have drifted off protective defaults within a month because the opt-out is one tap deep. None of those four numbers would appear in any incident database. Each of them is a design decision. And each could be published quarterly, checked by someone the operator cannot fire, and tied to a consequence: notifications off for the top decile, retention tactics removed for minors, defaults restored.

This is what the Meta settlement’s two-hour cap and 60 and 90-minute pauses already are: proto-units. The ledger simply generalises them from social media to AI, from one defendant to an industry, and from self-reports to verified evidence.

XVI. What Proof Would Look Like

Measuring a dose is only half of it. The other half is proof: evidence produced by the system itself, at the time, in a form the operator cannot quietly edit. In practice that means four conditions.

Runtime, not retrospective. The measures are computed continuously in the running system, not reconstructed for an annual report after the fact.
Distribution, not average. They are published per age cohort and per percentile, so averages cannot hide the heavy tail where the harm concentrates.
Binding, independent verification. They are checked by an auditor with access to raw telemetry rather than a curated extract, whose findings bind, and whom the audited firm cannot replace at will. The Digital Services Act’s researcher-access regime, adopted in July 2025, shows the route; its slow start shows the cost of leaving it optional.
Wired to defaults. When a cohort’s measure crosses a published line, memory, notifications and engagement features change automatically, and the change is logged.

None of this requires a breakthrough. California has already legislated flattery limits and default-off features for children. The EU’s guidelines for minors already ask platforms to switch off streaks and autoplay. The Meta settlement already caps time. What is missing everywhere is the connective tissue: an agreed unit, a binding verifier, and a rule that ties the two to the defaults. That is the difference between a safety feature and a safety guarantee.

It also answers the strongest legal objection to everyday-harm regulation. In March 2026 the Ninth Circuit kept California’s dark-patterns provision blocked as void for vagueness, citing terms such as “materially detrimental” and “well-being”. The court was right that a feeling cannot be a legal standard. A dose can. Measurement is not a technocratic nicety in this debate; it is the precondition for any everyday-harm rule surviving constitutional review.

XVII. The Strongest Objections

An argument for measuring doses has to survive the best case against it. Here are six objections, each in its strongest form.

“Catastrophe comes first.” Irreversible, mass-casualty risk deserves priority, and bright-line thresholds are what make it auditable. Agreed. Nothing here argues for weakening SB 53 or RAISE. The argument is that catastrophe rules and dose rules need the same infrastructure, runtime evidence the operator cannot edit, and that building it once serves both.

“The science is not settled.” True. The social media causation debate is unresolved, and several of the most-cited AI studies are small. But the uncertainty is not an accident. It exists largely because the data sits inside the firms. A regime that requires dose measurement and researcher access is how the science gets settled. Waiting for proof while the proof stays locked inside the companies is not caution; it is a choice.

“This is speech regulation.” Some content rules will fail constitutional scrutiny, and the courts have already struck some. But design rules about defaults, notifications, time limits and exit flows have fared better: the Ninth Circuit upheld California’s parental-consent rule for addictive feeds and private-by-default settings in 2025. A Florida federal judge declined in May 2025 to treat chatbot output as protected speech at that stage of the Garcia case. Measuring and reporting a dose is the most content-neutral intervention available.

“Age assurance is a privacy disaster.” A serious point: every database of verified ages is a breach waiting to happen, and Ofcom itself doubts some age-inference models. The answer is to prefer protective defaults for everyone over verified exceptions for some, as Virginia’s study committee and the EU’s guidelines lean towards, and to report dose by estimated cohort with published error rates rather than demanding identity documents.

“AI also helps.” It does. A randomised trial of a generative-AI therapy bot cut depression symptoms by about half against a waitlist. AI tutors produced large learning gains at Harvard and in Nigeria. Companion chats relieve momentary loneliness. This is the strongest reason to measure doses rather than ban products: it is the only way to keep the benefit and cut the harm, because both live in the same product and differ only in design and dose.

“It will cost too much and favour incumbents.” Compliance costs fall hardest on small firms, and offshore apps will ignore any rule. Proportionality helps: California phases in audits for operators above $500m in revenue first. But the larger answer is that the cost of not measuring is already being paid, in settlements, verdicts, exclusions and school budgets, by everyone except the people best placed to reduce it.

XVIII. Eight Questions for Any Product That Talks to a Child

For boards, school leaders, regulators and parents, here is a test that needs no new law. Ask these eight questions of any AI product that children use. For each, the standard is the same as in The Assurance Gap: show me the evidence, not the policy.

Exposure. What is the 90th-percentile daily use among under-18s, and who outside the company has checked it?
Flattery. What is the product’s affirmation rate against a human baseline, on which published test, and when was it last measured?
Exits. When a child says goodbye, what does the product say back, and what share of exits are met with guilt or urgency?
Defaults. Are memory, notifications and personalisation off by default for children, and what share of child accounts are still on those defaults after a month?
Crisis. How often does the product correctly escalate on published hard cases, and how many real referrals did it make last quarter?
Learning. For education products, what is the evidence on unaided performance, not performance with the tool in hand?
Data. Are children’s conversations retained or used for training, and can a parent see and delete them?
Surfaces. Where else does the same model reach this child, in search, email or productivity tools, and do the same protections apply there?

Score honestly. A product that can answer all eight with evidence is ahead of almost every law on the books. A product that answers with policies is asserting governance, not proving it.

XIX. Singapore’s Choice

Singapore is better placed than most to do this first, and the reasons are specific. It has already built remedies for identifiable victims: the Online Safety Commission and the statutory torts of the Online Safety (Relief and Accountability) Act came into force on 29 June 2026, covering harms such as intimate-image abuse, doxxing, harassment and stalking. It has put age assurance at the app-store gate: from 31 March 2026 designated app stores must screen under-18s out of inappropriate apps, using methods including Singpass, facial estimation and credit cards, while the ministry has said candidly that none of these measures is foolproof. And it advises parents through the Ministry of Health’s screen-use guidance for young children.

All three are event or access tools. A harm happens to a person, or a person is stopped at a door, or a family is advised. For dose-type harm the government said at its Committee of Supply debate in 2026 that it is studying whether chatbots need safeguards, noting the particular risks of chatbots embedded in social media. That leaves the design choice open at the moment it matters most, when more than half of Singapore’s eight-year-olds have already used AI.

Singapore also owns the hardest part of the answer. AI Verify and the testing ecosystem around it exist to turn claims about AI systems into evidence about AI systems, and the planned accreditation of AI testers would create exactly the independent verifiers a dose ledger needs. Extending that infrastructure from model testing to population dose, with published units, accredited testers whose findings bind and a light-touch rule tying measures to defaults, would make Singapore the first jurisdiction to regulate the dose rather than only the disaster. It would also give the region, where most of the world’s young AI users now live, a model that is neither the American patchwork nor China’s state-directed rules on dependence.

Caricature: engineers build a glowing verification gate on a Singapore waterfront at dusk as AI assistants line up to be measured

Coda

Disasters make headlines. Doses make lives. A safety regime that can only see the first has not made us safe. It has made the second kind of risk invisible, and handed the proof to the people with the least reason to produce it.

The MIT Technology Review authors are right that the bar has been set too low. But raising the bar will not help if we cannot see where it is. The next decade of AI safety will not be won by better prohibitions of rare events. It will be won, or lost, on whether we can measure the hours, the flattery, the exits and the skills, and prove to someone independent that the dose is safe.

The school in California did everything it was told to do, and the model came in through the search box. The lesson is not that the school failed. It is that we built our protections to stop events at the door, while the harm was already in the house, measured in hours.

Library: sources, white papers and further reading

Sources marked as advocacy, self-reported or counter-evidence are labelled so readers can weigh them. Studies reported via a secondary outlet link to that report; read the original before citing.

The article this essay answers

Hiner, S. and Leiken, E., “The focus on AI safety disasters ignores everyday harms”, MIT Technology Review, 26 Oct 2026
Emma v. Google, complaint, Santa Clara County Superior Court, filed 4 Nov 2026 (allegations; plaintiffs’ counsel EdTech Law Center and Qureshi Law)

Frameworks, guidance and white papers

Evidence: companions, reliance and wellbeing

Evidence: sycophancy, persuasion and privacy

Evidence: learning, cognition and deskilling

Legislation and regulation

Courts, settlements and enforcement

Insurance and the price of proof

Economics and the causation debate

How diffuse harms were governed before

Singapore

Companion reading: AI Watch sources for the opening case

EdTech Law Center, Emma v. Google case page and complaint (Dkt 001, 4 Nov 2026) (allegations; read the complaint before citing)

Enterprise economics and the workplace dose

McKinsey QuantumBlack, “Where AI agents pay off: a practical guide to the economics of agentic workflows” (Aug 2026)
EY, “Agentic AI ROI: Can AI pay for itself?” (Sep 2026)
Epoch AI, LLM inference price trends
Evident Banking Brief on RBC’s CIO survey and token overspend (2026) (secondary)
Fortune on Microsoft, agents and the AI cost problem (May 2026)
Signal65, Governing AI Economics: the token cost equation (Jul 2026) (vendor-sponsored)
The Next Web, BNY tracks its AI token spending
Reuters via Yahoo Finance, CBA flags surging AI costs and “work slop” (Jun 2026)
Niederhoffer, Hancock et al., “AI-generated workslop is destroying productivity”, Harvard Business Review (Sep 2025), via Gizmodo
METR, randomised trial of early-2025 AI tools on experienced open-source developers (Jul 2025), via InfoWorld
Lee et al., GenAI and critical thinking among knowledge workers, CHI 2025 (Microsoft Research and Carnegie Mellon) (read the paper before citing figures)
Deloitte, State of AI in the Enterprise, Oct 2026; Accenture, The CIO’s Guide to AI Tokenomics, Oct 2026; NIST, Design Tenets for Agent Identity Management Systems, Oct 2026 (from the author’s agent-economics research file; primaries not re-read here)

Companion reading on Genesis

Luke Soon is an AI futurist and author of Genesis: Human Experience in the Age of Artificial Intelligence and Synthesis: SuperIntelligence Protocol. He co-authored IMDA Singapore’s Model Governance Framework for Agentic AI.