Every regulatory framework must choose a primary unit of risk -- model, use case, or impact produced -- to determine the starting point of regulatory oversight.