The actual safety rules, whatever they are, if they are put into law have to be made explicit, and that makes them easy targets to hit. But if what matters is not the technical compliance per se, but paperwork certifying compliance, that's a different story.
Regulated AI right now is a grift game. Donations for policy changes, and the ability to lock out competitors. Flattery to stay green-lit instead of shut down by random executive orders and policies. Bend the knee to keep shipping.
If anything, we need LESS federal regulation here and more FTC / SEC enforcement but (see above grift comments) that will also not happen in the United States until voters elect somebody that actually respects the law enough to enforce it for something other than their own gain (outside of their need to be elected, of course...)