Mitigating AI-related risks: soft approach, hard approach or something in the middle?