That's a great question. There's a sort of frustrating chicken-and-egg problem in that it's hard to build up the governance capacity in terms of the evaluations, the certifications and the whole infrastructure that is needed to evaluate and test these models when there's no requirement to do so. There's no customer without some sort of regulation that requires those things.
On the other hand, when you're thinking about regulations, it feels very daunting that there are all of these different use cases for these systems, and you have to think about how you are going to regulate all these things.
As Max has pointed out and you suggested, I think it's critical to identify some first steps to take. Maybe it's around child safety testing or just requirements that, when you produce an AI system along this sort of tool orientation, you say what it's for and then you can start to assess whether that AI system is fit for that purpose.