The fast-developing law of AI appears to be… risk regulation. But there is more to risk regulation’s toolkit than impact assessments.