Why regulating AI is so hard — and necessary