Artificial intelligence (AI) legislation should strike a balance between fostering innovation and ensuring security, with contextual, risk-based regulation serving as a key legal tool for ex-ante oversight. From the perspective of the co-evolution of law and technology, the legal construction of risk-based regulation presupposes robust institutional architecture and a carefully designed implementation pathway that remains aligned with foundational principles of public law. Centered on risk as its foundational concept, the regulatory framework ought to clarify its multi-dimensional connotations and normative requirements for legislators, regulators and regulated entities alike, while upholding the principles of proportionality and technological neutrality. With respect to institutional design, it is essential to delineate differentiated regulatory competences and responsibilities between the legislature and administrative regulators. The legislature should focus on systemic security risks, cross-sectoral risks concerning organizational resilience, and risks arising in commercial transactions, while also determining and allocating risk management obligations and governance frameworks for both AI providers and deployers. Regulatory authorities, acting pursuant to clearly defined statutory objectives, should undertake risk assessments of providers and deployers and adopt proportionate corrective or remedial measures. In practice, the principal alternative institutional pathways can be articulated as follows: (1) competent AI authorities may develop soft law instruments to facilitate comprehensive risk management; (2) sector-specific regulators responsible for supervising providers and deployers may formulate and enforce risk management rules within their respective domains of competence; and (3) overarching AI legislation should establish a unified, risk-based regulatory framework that applies coherently and consistently to both providers and deployers.
内容提要 人工智能立法应平衡发展和安全的关系，而风险导向型规制成为事前规制的核心法律工具。从法律和技术共同演化的角度来看，风险导向型规制的构建应依据规制原理，合理设计法律制度结构，并选择适宜的推进路径。风险导向型规制原理应以风险为基石概念展开，区分其对立法者、规制者、规制对象的不同面向及规范性要求，并秉持比例原则和技术中立原则。法律制度设计应区分立法机关和规制机关差异化的规制要求，立法机关应解决系统安全风险、跨部门的组织稳健风险和商业交易风险问题，同时界分提供者和部署者之间的风险管理义务及其风险管理框架，而规制机关基于法定的监管目标对提供者或部署者进行风险评估，并采取纠正措施。实践中可选择的推进路径主要包括：人工智能主管部门提供全面风险管理软法规范，提供者和部署者的行业主管部门应制定管辖范围内的风险管理政策和流程，而综合性人工智能立法则应确立风险导向型规制的统一框架。