One of the most anticipated sessions at the 2026 GC AI Summit brought together perspectives that rarely sit on the same stage: private sector operators, former regulators, government officials, and seasoned outside counsel.
Sharon Johnson of MODE Global, Stephen Sherrill of the San Francisco Board of Supervisors, Melody Drummond Hansen of the Federal Motor Carrier Safety Administration at USDOT, and Michael A. Jacobs, formerly of Morrison and Foerster, spoke candidly about where AI regulation is headed and what general counsel should be doing now.
The discussion opened with a question many in-house lawyers are already fielding weekly: is AI regulation inevitable, and if so, what will it look like?
Melody Drummond Hansen started by reframing the premise. Drawing on her experience both inside and outside government, she explained that many perceived AI risks already sit inside existing regulatory frameworks.
“A lot of what people think are AI problems are really regulatory development issues in industries you are already working in with regulators,” she said. AI tends to surface and amplify issues in regulated environments rather than create entirely new ones.
Michael A. Jacobs pushed the conversation further. While AI is often described as another productivity tool, he argued that lawmakers are treating it as something more consequential.
“I think we are in a new frontier,” Michael said. “This is merely a tool, but I think it is a paradigm shift. And the legal world is, in a sense, treating it like a paradigm shift.”
He pointed to a recent and largely overlooked change in California law as evidence. California Assembly Bill 360 amended the Civil Code to eliminate a defense that many companies might assume was available. In any civil action involving AI, a defendant may not argue that the artificial intelligence acted independently.
“You cannot point to the AI tool and say the AI did it,” Michael said. “The company that deployed the AI tool is the responsible and legally responsible entity.”
He contrasted this approach with the early internet era, when Section 230 largely shielded platforms from liability for user-generated content. The absence of a comparable immunity framework for AI signals how differently lawmakers are approaching accountability.
As the conversation shifted from regulation to governance, the panel converged on a shared concern: policies that exist only on paper.
“Do not give me an excuse to come find and try to regulate you,” said Melody. “The most important thing is governance and credibility. Your policies need to really govern the behavior, not just exist on paper.”
Sharon Johnson echoed that sentiment from the corporate side. She warned against downloading model AI policies without reflection. “That is a huge missed opportunity,” Sharon said. “You want your policies to align with your business and with your values. It needs to be organic. It needs to come from the bottom up. It needs to solve a real need.”
Stephen Sherrill described how San Francisco approached AI governance during 2023 and 2024. The city resisted adopting sweeping new rules in favor of grounding AI decisions in existing procurement standards and values.
“If you are going to be general, build off your existing values,” he said. “We went through our procurement regulations and aligned them with the values we already had.”
For Michael, defensibility depends on whether people actually understand and follow the rules. He described hearing the same refrain repeatedly as outside counsel.
“We have this policy,” he recalled. “And then anything after that was whatever. No training. No mechanisms in place to implement the policy.”
The panel also spent significant time on where future regulation is most likely to land. While consensus in Washington remains elusive, one area stood out.
Child safety is emerging as a primary driver of AI legislation. Panelists pointed to growing concern around social media addiction, chatbot relationships, and exposure to harmful content. These issues are politically salient, emotionally charged, and already familiar to regulators.
Sharon Johnson urged legal teams to respond to these pressures with calm. “We need to come to it calmly and with clarity and bring the temperature down,” she said. “We have people telling us that if we are not on board, we are going to be owned by computers. I think we have time.”
That calm extends to how general counsel engage with regulators. Sharon encouraged relationship building rather than avoidance, noting that regulators are also learning in real time.
Stephen Sherrill reinforced the responsibility borne by public institutions. From his perspective, thoroughness matters more than speed. “We have to be stewards of the public money and the public trust,” he said. “Go about this really thoroughly in a robust way and check the sources. That would be a huge public service.”
Across the discussion, we heard three main takeaways.
AI is being treated as a structural shift.
Governance must be real, auditable, and rooted in how a business actually operates.
Child safety concerns are likely to shape the next phase of meaningful AI regulation.
For in-house legal teams, the message was pragmatic: Laws still apply, accountability remains human, and credibility is built through clarity.