“A potential model for AI regulation involves requiring companies to create and publish a safety and security plan, which would then create a clear basis for whistleblowing if the company fails to adhere to its own plan.”