I think you're on the right track at a theoretical level. Philosophically, you have the Bernstein v. Department of Justice here but on stereoids. My personal take is that any AI regulation should focus on those who sell the stuff and those who deploy the stuff. Note that the latter includes also the state.