Broad enough laws don't have loopholes. GDPR for example had the wisdom not to define specific types of personal information (such as name, or IP address) but instead any data that could be correlated to identify a person. That puts the ball in the corporations' court to make sure they stay well clear of the dividing line.

Delegated councils (like the FDA, FTC, FCC, etc.) and courts can be used to make decisions about edge and individual cases, and do so much closer to real time than Congress can act.

Governments regularly successfully define things much more vague than "is this AI?"