The Hard Realities of Setting AI Risk Policy