“Regulators should broaden their regulatory toolkit and move away from, or at least add to, the current narrow focus on AI impact assessments. If regulators want to truly address the harms caused by AI systems, they are going to have to do better than light-touch risk regulation.”