Those can be regulated because they require a level of physical access to materials. Centrifuges and viral samples and whatnot.
A given AI, once created, is "just" data. It can be sent around the world and run on commodity hardware. Nothing special needed beyond the expertise that created it in the first place.
Think of how relatively easy it is to clamp down on bioweapons, and compare that with our ability to stop malware.