Waiting for an AI law is a poor compliance strategy