You have to establish the broad strokes first, and that means legislation. Laws set out what must be done and what must not be done to reduce risk. Regulations set out how all that is done.
Given that technology is changing rapidly and that we're always reacting to the deployment of new technologies, here's my solution. We need an approach whereby regulatory authorities can decide to set standards. It takes a year to create a standard. A standard can be modified frequently, and then the results can be assessed. Once the technologies mature, it makes sense to regulate them.
This approach could enable the government to react quickly to ensure that a piece of legislation is consistent with reality, without impeding innovation. It would be a middle-of-the-road approach. That's what the government has done for a lot of new technologies: set reasonable minimum standards for everyone. It can be done.