Cities Are Regulating AI Too Statically for Systems That Keep Evolving

Urban AI creates a problem that conventional accountability frameworks handle poorly: the more actors, infrastructures and functions involved in a system, the harder it becomes to identify who is responsible when something goes wrong. In cities, that difficulty is amplified by tightly connected services, adaptive technologies and general-purpose AI systems that can take on new roles after deployment.

In "Responsibility and planning amid growing urban complexity and AI proliferation: many hands, many things, many tasks," published in AI & Society, Daniele Chiffi and Stefano Moroni of Politecnico di Milano argue that urban AI produces three distinct forms of responsibility dispersion: agency across "many hands," causality across "many things," and scope across "many tasks." They claim that general-purpose AI requires planners to monitor how systems evolve over time, not just whether they were acceptable when first introduced.

The Smart-City Problem Is No Longer Just About Whether an Algorithm Works

Urban AI is often evaluated at the level of an individual application: does a traffic system reduce congestion, can a digital twin improve land-use forecasting, or can automated monitoring identify infrastructure problems earlier? Chiffi and Moroni argue that this framing is becoming inadequate because cities are not collections of isolated technologies. They are dense sociotechnical systems in which failures can propagate across multiple infrastructures and populations.

The paper treats these cascading effects as systemic risks. A disruption in one part of an urban network can travel into others, as happens when electricity failures affect transport signals, water systems and communications. AI adds another layer because automated systems can be adaptive, opaque and embedded inside decisions that citizens may never directly see.

This changes the nature of accountability. An adverse outcome may involve a municipal department that procured the system, a private company that developed it, another company supplying data, infrastructure operators integrating it, officials relying on its recommendations and human users acting on its outputs. Each participant may control only a fragment of the final outcome.

The authors describe this as the problem of "many hands": when agency is distributed across numerous public and private actors, responsibility can become fragmented. The danger is not merely that assigning blame after failure becomes difficult. If responsibilities are unclear before deployment, nobody may have sufficient authority or incentive to prevent risks in the first place.

For urban governance, the implication is substantial. Cities cannot assume that contracts, procurement procedures or organisational hierarchies will automatically resolve responsibility. They need explicit arrangements defining who can approve, monitor, intervene, audit and answer for AI-enabled decisions before systems become deeply embedded in public infrastructure.

AI Risk Emerges From Networks, Not Just From Machines

The second problem is what the authors call "many things." Urban technologies rarely operate independently. Sensors feed data into algorithms; algorithms interact with databases and communication networks; those systems connect with physical infrastructure and human operators. Failure may therefore emerge from relationships between components rather than from a defective component itself.

Conventional risk assessments often examine whether individual technologies meet prescribed standards. Yet every component could technically perform as intended while their interaction still generates a harmful outcome. A badly interpreted sensor signal, an automated response and an operator following standard procedure can together produce consequences that none would have produced alone.

The authors call for a systemic approach to planning that examines entire sociotechnical configurations. Authorities should assess how technologies interact with existing infrastructure, what dependencies they create and whether problems in one system can cascade into another.

This is where meaningful human control becomes critical. The paper argues that humans must retain the ability to monitor automated systems, intervene when necessary, contest decisions and modify systems when vulnerabilities emerge. In practical terms, that points toward real-time monitoring, human override mechanisms, decision logs, independent audits, appeal procedures and repeated post-deployment review.

The governance principle is straightforward: complexity cannot become an excuse for surrendering control. If cities cannot identify who has the authority to stop, question or revise an AI-enabled process, they risk building technologically sophisticated systems with surprisingly weak accountability.

General-Purpose AI Creates a New Problem: Its Purpose Does Not Stay Put

The paper's most original contribution is the "many tasks" problem. Unlike fixed-purpose technologies, general-purpose AI systems can perform multiple functions and may later be adapted for roles that were not anticipated when they were initially designed, purchased or approved. A general-purpose AI system used first for traffic analysis could later incorporate environmental data, public-health information or public-safety signals. Each additional task changes the system's relationship with the city, expands the populations affected and potentially introduces new forms of discrimination, privacy loss or systemic failure.

The difficulty is that governance frameworks usually assume reasonably stable purposes. Public procurement, regulatory approvals and risk assessments often ask whether a particular technology is appropriate for a defined function. General-purpose AI weakens that assumption because its scope can expand without a single moment clearly marking when the original approval has ceased to be adequate.

This creates what the authors describe as a temporal dimension of responsibility. Harm may emerge not from one obviously reckless decision, but from a sequence of individually reasonable choices that gradually transform what the system does. By the time consequences become visible, the technology may be operating far beyond the context in which accountability was originally assigned.

For policymakers, this may be one of the most important governance challenges posed by foundation models and general-purpose AI. The relevant regulatory question is no longer simply whether a system is safe at deployment. It is whether institutions can detect when its role has changed enough to require fresh scrutiny.

Cities May Need to Govern AI Trajectories, Not Just AI Applications

The authors propose "trajectory-based governance" as a response. Instead of regulating an AI system only according to its current task, planners would monitor how its functions, data inputs, institutional relationships and affected populations evolve over time.

Reassessment could be triggered when a system enters a new policy domain, begins using new categories of data, affects significantly more people or becomes integrated with additional AI-enabled infrastructure. The goal is not constant bureaucratic intervention but institutions capable of recognising when technological evolution has crossed a threshold that requires renewed judgement.

The approach carries direct implications for municipal governments, regulators and technology companies. Procurement contracts may need provisions for ongoing audit, role changes and data expansion. Public agencies need clearer responsibility maps across different levels of government, while private vendors may need continuing obligations that extend beyond initial deployment.

Public participation also becomes more important. The authors argue that democratic and participatory processes can help identify emerging biases and detect task drift before risks accumulate. This turns citizen involvement from an optional consultation exercise into a potential component of technological oversight.

For developing-country cities, the challenge may be especially acute. Many are simultaneously urbanising, digitising public services and experimenting with smart-city technologies while facing capacity constraints in regulation, procurement and technical oversight. By reasonable inference from the paper's framework, rapid technological adoption without equivalent investment in institutional capability could widen responsibility gaps rather than close them.

The review is theoretical, and this is an important limitation. It does not test trajectory-based governance empirically or show which mechanisms work best across different cities. No original dataset is analysed, and the administrative costs of continuous oversight, especially for lower-capacity municipalities, remain largely unanswered.

The gaps point toward a clear research agenda. Comparative studies could track AI systems after procurement to see how often their functions expand, when responsibility becomes ambiguous and which institutional arrangements detect problems early. Further research is also needed on agentic AI and interactions among multiple autonomous systems, where the problems of many hands, many things and many tasks may become even more tightly intertwined.