The risks of risk-based AI regulation: taking liability seriously