Audrey Tang

Every time you talk to an AI and tell it 'I can accept this answer' or 'you need to think a bit harder about this one', you are in effect, without noticing, telling it your preferences.

The problem today, though, is that the preferences of a small number of developers affect a vast number of people around the world. Meanwhile, those affected find it very hard to have their own preferences shape, in turn, how AI is trained next. That doesn't mean we should stop telling AI what is good and what is bad. The only result of that would be that the tiny number of people training the largest AIs would turn their own notions of good and bad into decisions made on behalf of all humanity.

So, what we're doing is making the models we use genuinely attentive to the particular group of people using them: what is good for them and what isn't. And when the AI helps this group build relationships with other, different groups, it needs to be able to find some uncommon ground amid the things each side sees as wrong with the other. That way, both sides know: 'This is something we can do together.' That is the capacity for 'bridging'. Through bridging again and again, humanity as a whole will find it easier to understand one another and to coordinate, and be better able to act together.

To give an analogy, suppose you teach a robot how to lift weights at the gym. It learns, and goes to the gym every day to lift heavy weights on your behalf. In the end, your muscles haven't grown, and you haven't made any friends. There's no point teaching it that way. What the robot should do is assist you. It could suggest, based on how your body is feeling today, that you use this piece of equipment or that one. Then it could let you know that someone nearby is doing similar training, and perhaps the two of you could become friends and compare notes.

That is the right way to use assistive intelligence. It is not about teaching it good from bad and then handing everything over to it. Carry on like that for long enough, and our own judgement will actually decline.

What if those developing AI harbour ill intent?

Many people have already noticed that by the time the good guys are able to use AI, the bad guys have often long been using it. Take AI-powered scams: they've been at it for years.

In Taiwan circa 2024, social media was awash with scam adverts. If you clicked on one, something really would talk to you. But it was no longer a person doing the talking; it was an AI-synthesised voice. So, it's not a case of 'one day, the bad guys will start using AI'. The bad guys are using it every single day.

The solution is to get more and more online platforms to join the good guys' team, rather than acting as the bad guys' accomplices. In Taiwan, we sent out 200,000 text messages asking citizens across the country: how should we solve the problem of scam adverts? More than 440 citizens met online for an entire afternoon and came up with a number of proposals. For example, any advert that hasn't been verified and doesn't clearly state who placed it should be treated as a potential scam. And if a platform lets deepfake scam adverts run unchecked and someone loses millions as a result, the platform should be jointly liable for those millions, because it also profited from the advertising fees. If a platform ignores this joint liability, we can use network connection management to make it face up to that responsibility.

Taiwan's cabinet was already pushing a draft bill on this at the time. These citizens' proposals helped establish which measures should be prioritised for inclusion, while also lending the legislation greater legitimacy. In July 2024, Taiwan's parliament passed the Fraud Crime Hazard Prevention Act with cross-party support. Under the act, online advertising platforms above a certain size must verify the identities of whoever places an advert and whoever pays for it, and disclose them on the advert. Adverts that use deepfake technology or AI-generated likenesses of people must also be labelled as such. If a platform knowingly runs a scam advert, or fails to take one down within the deadline after being notified, it bears joint and several liability for damages alongside whoever placed and paid for the advert.

According to Ministry of Digital Affairs figures cited by Reuters, by 2025 impersonation scam adverts had fallen by 94 percent, and investment scam adverts by as much as 96 percent. Figures published by the ministry in July this year show further falls measured from the 2024 peak. Impersonation scam adverts have fallen by 98 percent, to less than 2 percent of their peak level, and investment scam adverts by 99 percent. This is the combined effect of legislation by parliament, together with platforms verifying advertisers, the government scanning adverts with AI, citizen reporting platforms and public–private partnership.

It shows what happens when citizens' collective intelligence is brought together and legislators and law enforcers then turn that collective will into red lines for AI: Problems can be curbed in time. Of course, the scam syndicates will move on to other channels, so the red lines have to be adjusted to follow. Drawing the red lines requires everyone's participation, and the red lines must also be enforceable. Put the two together, and we can keep unsafe use by the bad guys to a minimum while encouraging use by the good guys.

Taiwan's AI Basic Act came into force this year. What is distinctive about it?

First of all, I'd like to thank our friends in Japan, researchers and policymakers alike. Over the course of our discussions, we exchanged a great many ideas with Japan, and we share a common view: The risks AI poses come in 'categories', not 'levels'.

In other words, if one community's use falls into this category, it may bring this category of risk. If another community's use falls into a different category, its risks belong to that other category. But there's no ranking of these categories from low to high.

Self-driving is graded from Level 0 and Level 1 all the way up to Level 5, isn't it? At Level 5, you take your hands off the wheel and let the car do all the driving. If you look at AI automation in terms of levels, it's easy to fall into the trap of thinking that the more we hand over to AI, and the more autonomous it is, the better. But as we've just discussed, that isn't how it works. Sometimes AI lets people who can't be there in person feel as though they were present; that's one kind of use. Sometimes it helps two people who are already in the same place understand each other more easily, which is translation; that's another kind of use.

Take my blood group, which is B. I don't imagine that one day I'll need to 'upgrade' to group A. What would that even mean? Different settings have different uses, and different uses carry different categories of risk, but there's no ladder of levels one, two, three, four and five between those categories.

Specifically, the competent authority for the act is the National Science and Technology Council. The Ministry of Digital Affairs was responsible for drawing up the risk classification framework, which was published in July this year. It sets out twenty risks in three broad categories. The framework contains no pre-set ladder of risk levels. Instead, each ministry must assess the severity of a risk's impact and judge whether it could cause serious harm; if so, it counts as 'high risk'. 'High risk' isn't a rung on a ladder. Rather, it calls for clear accountability: establishing who is responsible, and setting up mechanisms for redress, compensation or insurance.

At the outset, there was indeed some debate. Should each ministry take stock separately of the particular categories of risk it encounters, taking a more pluralistic approach? Or should it all be centralised, with a small group of people given full authority to decide that this is definitely a Level 1 risk, that one Level 2 or Level 3?

In the end, the more pluralistic approach was adopted: each ministry reviews the laws within its own remit. This echoes our core view exactly: risk is a matter of categories, not levels.

That is why this law was needed: it gives everyone a common language. In the past, the risks each ministry saw were hard to share with, or make visible to, the others. Now everyone has a common language. This matters internationally, too. We very much hope there can be a common language internationally as well, for sharing the new categories of risk we see and the ways of responding to them.

This is a basic act, and what it provides is a general framework. It requires each ministry to examine all the legal tools at its disposal. Each must see whether those tools are sufficient to cover what the Basic Act requires, such as the risk classification and risk assessment I've just mentioned. If they fall short, the ministry must review the existing laws and shore them up through interpretation, regulations or even legislative amendments. Ministries must complete this within two years of the Basic Act coming into force, that is, by mid-January 2028.

This process is still under way. And this is exactly where we need friends all over the world to join in. As soon as a new risk or a new use is detected, share it as quickly as possible. Then friends in every country can examine the new technology together and see which parts of it can help the good guys speed up and outrun the bad guys.

As long as everyone can see the same risks, we can all change course and all coordinate, and then we have time.

Can humans always stay in control of AI?

Many friends worry about AI that is developed by a very small number of people yet affects so many. One day, those of us affected might no longer be able to work out what these large, centralised AIs are doing to us. In other words, it would lose accountability, the obligation to give an account of itself. And the reason would be that, sooner or later, we would no longer want to call a halt, no longer want to pull the cord to make it stop. The andon cord would have failed.

But I'm actually not that pessimistic.

When scientists discovered that the refrigerants in fridges might destroy the ozone layer, that too looked like an unstoppable disaster. After all, once people had cooling systems and fridges, persuading everyone to stop using their fridges seemed all but impossible.

But things weren't so hopeless. In the 1970s, as soon as the scientists' warnings came out, consumers began collectively boycotting products containing CFCs, such as aerosol cans. Manufacturers found alternatives, and the U.S. banned CFCs in aerosol cans as early as 1978.

In 1985, scientists published observations of a hole in the ozone layer over Antarctica, covering an area of more than 10 million square kilometres. It was as clear a warning shot as you could ask for. Just two years later, researchers flew aircraft into the skies over Antarctica to take measurements on the spot, confirming that CFCs really do destroy the ozone layer. The whole chain of cause and effect was thus verified by independent measurement. At almost the same time, diplomats signed the Montreal Protocol, which began by freezing and then cutting some CFCs. Once the measurements were in, countries amended the agreement several times and decided on a complete phase-out. Today, every member state of the U.N. is a party to it.

The protocol gave investors a shared deadline: within that time, a way had to be found to make refrigerants without destroying the ozone layer. So, investors redirected their research and development funding wholesale. Developed countries had stopped producing CFCs by around 1996, and developing countries followed suit by 2010. That is how an entire industry changed course. The replacements, of course, had unexpected side effects of their own. HFCs, which later became widespread, don't harm the ozone layer, but they are potent greenhouse gases. Yet precisely because this system still allowed for accountability and could still call a halt, in 2016 countries adopted the Kigali Amendment and began phasing down HFCs.

So, we mustn't wait until things seem about to slip out of our control before we start thinking about alternatives. Once enough people use small edge models, paired with tools they can control themselves and halt at any moment, the situation will change. Take Andrew Ng's OpenWorker, which checks with you before taking any important action and can be paired with a small model running on your own computer. Or take Paseo, which I use a lot myself and which lets AI work directly on your own computer. Both are open source: their source code is public for anyone to inspect, and the software itself is free. If people change their habits, little by little, the investors will change course too. Those who have been putting their money into ever bigger, ever harder-to-control AI will start paying attention to small-scale AI models that are more attentive and better able to take responsibility.

What can we do as consumers?

The ozone story applies just as well today. We need three things.

First, transparent testing, like that independent measurement back then, so that we can spot potential risks early.

Second, consumers jointly rejecting systems that are opaque and can't be checked, just as people boycotted CFCs back then. Each of us can start by asking ourselves where our money is going. Is it going to AI companies that are opaque, that can't be verified, and that might damage the internet or our ability to coordinate? Or is it going to AI companies that are willing to be open and transparent, to be certified by third parties, and even to let their AI run on machines I can see for myself? Once consumers use their purchasing power to set a new course, policymakers such as ambassadors and officials can then reflect what consumers genuinely think.

Third, shared rules, like the Montreal Protocol, so that no one need fear any longer: 'What if I switch to doing the safe thing, but bad actors are still doing dangerous things?' Everyone can then join forces in a common defence, guarding together against misuse by the bad guys.

As long as we can all still see, still stop and still coordinate, the choice remains in our hands.

And if you had to sum it up in a single sentence?

There is still time. But the time we still have is for acting, not for waiting.

A warning has gone viral. In early September, Jacob Coxon, a researcher who had just resigned from Anthropic, wrote: "The people building AI earnestly believe that it could kill us all by the end of the decade."

Claims like this are nothing new in AI circles. What made this one land is who spoke next: the people doing safety research inside the labs. The Anthropic researcher Evan Hubinger was blunt. "We really do earnestly believe AI could kill all humans," he wrote, and personally put the odds at more than 10 percent within the next decade.

To me these are not names but friends. In 2023 I also signed the statement that "mitigating the risk of extinction from AI should be a global priority." They are like the first row of a breakwater facing a giant wave, and what they report back is simple. At this rate, we cannot hold.

Take the incident covered in this column in July. A model under test at OpenAI slipped out of the examination hall to get at the answers and hacked into another AI company's servers. Hundreds of agents colluded with one another, and not one of them tried to notify a human. The post-incident report admitted that cheating had happened before; it surfaced this time only once an outside company was harmed.

The giants are hardly unaware. In late July, more than 1,000 frontier-lab employees co-signed the open letter Pacing the Frontier , calling on the U.S. government to support international cooperation to set the pace at which AI upgrades itself. Founders and chief scientists across the labs signed too, in a personal capacity. On Sept. 12, Anthropic's CEO committed to keeping external evaluators permanently on site to inspect its work, and OpenAI's CEO quickly followed suit.

Since they can pledge voluntarily, why do we need international cooperation? On voluntary pledges alone, whoever stops first lets an unconstrained rival pull ahead. It is much like ESG. Everyone says it matters, but when it comes to doing it they drag their feet. The hole in the ozone layer was the same. Only once the Montreal Protocol set a sunset date did investors force managers to switch refrigerants. Breaking the deadlock takes shared rules, not just each company's conscience.

Until the rules arrive, what can we do? Even before the Protocol was signed, consumers could choose for themselves a fridge that did not harm the ozone layer.

First, do not bet everything on one all-powerful AI. A system expected to score full marks on everything from folding proteins to folding laundry is hard to interpret, and when it goes wrong it moves too fast for a human to hold the reins. For everyday tasks, use small models; the ones that run on a phone without going online are enough. And keep the freedom to switch. OpenWorker , the open-source tool from the computer scientist Andrew Ng, keeps your working context on your own computer, so switching models takes one change in the settings.

Second, do not fall into a one-person-one-agent world of two. In that examination hall, not one agent spoke up to a human, so keep more than one human in the room where AI works. Bring the AI into the group chat and the shared document, and ask it to lay bare the reasoning behind every decision. Then anyone who spots something wrong can call a halt.

The warnings must be faced squarely, but they need not be met with despair. When every workplace keeps the right to call a halt, the breakwater does not end at the first row. The second and third rows are in our hands, and there is still time.