Capability-based regulation is a policy model in which legal duties grow as a system becomes more powerful, more widely deployed, or more dangerous if misused. Instead of applying the same rules to every product, regulators set stricter obligations for higher-risk systems.
In cyber security, this matters because advanced AI can change the threat landscape. A highly capable model may help attackers write phishing lures, automate reconnaissance, or generate malware, while defenders may need stronger controls for access, testing, logging, and incident reporting. Under capability-based regulation, the most advanced systems could face requirements such as secure deployment practices, human oversight, evaluation before release, and documented safety processes.