“Law is Law,” “Code is Law” or “Code is Police”

In 1999, the American legal scholar Lawrence Lessig published a book that would become one of the most influential works of the digital age. His argument was simple: “Code is Law.” Code — that is, the architecture of digital systems — would regulate our behavior as effectively as, or more effectively than, laws themselves.

At the time, the idea seemed bold. Lessig argued that the internet was not merely a space in which laws would be applied. The very design of platforms, their algorithms and their technical rules would determine what was possible, what was allowed and what was prohibited. If a social network prevents certain content from being published, if an application does not allow a file to be copied or if a system automatically blocks a particular operation, the rule is being imposed neither by a police officer nor by a judge. It is being imposed by code.

Twenty-seven years later, perhaps it is time to update that famous phrase.

In many cases, code has become law. But it has also taken on another function: it has become the police.

I recently read a news story involving OpenAI. According to information released by the company, its systems identified conversations in which a user was seeking to use ChatGPT to plan the murder of his own young child. The interaction was interrupted by the platform’s safety mechanisms, which also followed the procedures established for situations of extreme risk.

Regardless of the specific details of that case, the episode reveals a quiet transformation. Companies responsible for artificial intelligence models are moving beyond offering technology and taking on functions that, until recently, we associated exclusively with the state. They observe behavior, identify risks, block actions, restrict access, preserve evidence and, when necessary, cooperate with public authorities. They are not merely running software. They are exercising a form of social supervision.

But this movement began long before artificial intelligence.

In the financial system, we have lived with it for decades. Banks and fintechs are not merely institutions that move money. They continuously monitor their customers’ financial behavior, analyze transaction patterns, identify suspicious operations, block transactions, terminate business relationships and report potentially unlawful activities to the appropriate authorities. The state realized that it would be impossible to monitor, on its own, billions of transactions carried out daily, and began using private infrastructure as its first line of oversight.

Digital platforms followed a similar path. Social networks identify potentially illegal content even before any court decision. Marketplaces remove prohibited products. Cloud computing services automatically detect cyberattacks. Ride-hailing applications monitor behavior considered unsafe. Now artificial intelligence models are beginning to assess not only what we do, but also what we intend to do.

This does not mean that these companies have replaced the state. What has changed is the architecture of regulation. Rather than directly overseeing every citizen, governments have begun imposing regulatory obligations on major digital intermediaries — the so-called gatekeepers. They develop the algorithms capable of detecting fraud, preventing crimes, blocking content, reducing risks and implementing, in real time, public policies that no state apparatus could execute at the same scale.

It is an extremely efficient solution. And an extremely transformative one.

When an algorithm prevents a suspicious financial transaction, removes content, blocks an account or interrupts an interaction with an AI model, are we witnessing a technical decision, a business decision or a new form of exercising regulatory power?

This may be the question of the next decade: who regulates those who have begun regulating society through artificial intelligence?

History shows that every major technological innovation changes the distribution of power. The printing press transformed the circulation of knowledge. Electricity reorganized industry. The internet redefined information. Artificial intelligence appears to be bringing about an even deeper change: it is redesigning the way the state exercises its own authority.

Perhaps Lawrence Lessig is still right. Code remains law. But looking at the world today, I have the impression that it has also become the police.

📌 Originally published in Época Negócios