US AI regulation compliance is a patchwork of state laws

AI-specific legislation is shifting. Colorado scaled back its AI Act. The EU delayed its high-risk timelines. Federal preemption may be next. And yet enforcement is moving forward by traditional means – including civil rights laws and consumer protection statutes, which were established long before AI. Organizations face a core challenge: How do you build effective compliance when AI introduces novel risks and the rules keep changing? Although AI’s risks are complex, the strongest frameworks to govern it are the ones we've used for decades: documentation, testing, training, oversight, and, most importantly, accountability. I've never viewed uncertainty as a reason to improvise, least of all when the stakes are this high. Rather, it's a reason to be more disciplined. When technology outpaces the rules written for it, the fundamentals are the only things standing still.

In the fast-paced world of legal research, AI tools are revolutionizing the way information is accessed and processed. These advanced systems promise lightning-fast retrieval of legal precedents, streamlining the workload for legal professionals. However, this impressive speed is not without its pitfalls. A growing concern is the emergence of 'phantom precedents,' where AI inadvertently fabricates non-existent cases, citations, and judgments. These fabrications pose significant risks, potentially misleading lawyers and jeopardizing legal outcomes. As AI continues to evolve, it becomes crucial to scrutinize its outputs and verify the authenticity of the information it provides. The legal field must adapt by implementing robust oversight mechanisms to ensure the reliability of AI-generated data. This balance between technological advancement and cautious validation is essential to harness the full potential of AI while safeguarding the integrity of legal practices.

I recently joined the ABA's Our Curious Amalgam podcast to discuss a fascinating and increasingly important question: what is up with AI in pricing? As companies use AI to analyze vast amounts of data and optimize pricing in real time, regulators are grappling with questions at the intersection of AI, antitrust, consumer protection, and privacy. We talked about the emerging state legislative landscape, the potential benefits and risks of AI-driven pricing, and what companies should be thinking about as these laws develop. Thanks to the American Bar Association, Sergei Zaslavsky and Alicia Downey and the Our Curious Amalgam team for a great conversation. 🎧 Listen to “Who Gets To Say the Price Is Right? State Regulation of AI Pricing” here: https://lnkd.in/gAF44EhV #AI #ArtificialIntelligence #Antitrust #Privacy #AIGovernance #Pricing

The AI news from August that matters For me, one of the biggest AI stories this August was not a new model, a new product, or another impressive demo. It was August 2 — the day the EU started enforcing important parts of the AI Act. This is a shift I think businesses should pay attention to. The conversation around AI regulation has been going on for years. But now we are moving from “What will the rules look like?” to “Are you actually complying with them?” The new transparency requirements are a good example. In certain cases, people need to know when they are interacting with AI. AI-generated and AI-altered content, including deepfakes, will need to be properly identified. And for companies working with general-purpose AI, there are additional requirements around documentation, copyright policies and training data transparency. What I find most important here is that AI compliance is becoming a business issue, not just a legal one. If AI is part of your product, customer support, marketing or internal processes, it is probably time to ask a few practical questions: What AI are we actually using? What does it do? Who can be affected by it? And can we prove that we are using it responsibly? The AI Act is no longer something to prepare for someday. It has started. #AIAct #AICompliance #ArtificialIntelligence #AIRegulation #TechLaw #ResponsibleAI #LegalTech #EU #Avitar

Our article, The Phantom Agent: Artificial Intentionality and Legal Responsibility, co-authored with John Nay, has now been published and is available online. Artificial intelligence systems are more and more acting as though they have intentions. They facilitate negotiations, provide advice, adapt to problems and influence human decisions. But they are not legal persons, and do not have a mind in any conventional sense. Does law require AI personhood to address this? We argue that it does not. Legal intent has not been merely a record of inner mental states. In contract, tort, corporate, and criminal law, intent is a normative device that determines legal effect, assigns blame, and manages risk. It is inferred and imputed routinely, and sometimes fictionalized. In this light, artificial intelligence systems are best understood as non-personal agents whose actions can be traced back to known human principals through doctrines we already have: agency, respondeat superior, electronic-agent contracting, and corporate attribution. We propose a three-level framework for differentiating between status, attribution, and governance, and a factor-based test for when AI conduct should be treated as intentional for the purpose of a legal doctrine. We apply it to recent litigation, including wrongful death claims against a chatbot provider, and compare US and EU trajectories. Bottom line: law can treat artificial agency as consequential without granting AI personhood, consciousness, or moral standing. Human responsibility is still there.https://https://lnkd.in/eyWRRkyX

Most people are asking the wrong question about AI... The question should not be "What can AI do?" but rather "What should AI not do?" Another good one: instead of asking "What can I do with AI?" ask "What can I do safely with AI?" I see a lot of confusion out there, and not just around what AI can or cannot do. Thanks to countless AI Bros it feels like you are always behind the curve and someone else has just vibe-coded the next multi-billion dollar unicorn... well, rather popcorn 👏 👏 👏 We can all think about regulation what we want, but one thing is fact. It would not be necessary without the bad players. I have been talking to businesses who really got burned. Not stereotyping here, but often young men who believe they know everything, selling a bad chatbot or voice agent to the local plumber for 1,500+ dollars a month, although the admin person was doing a great job. When a business comes to me and their website is fine, or needs minor fixes, I send them back to their web designer with homework instead of selling them a Claude-vibe-coded website for the quick money. I see a lot of business owners lost in the jungle of AI, stuck in between what AI can do for them and what they are actually allowed to do with it. And breaking rules you did not know about is not a monopoly-like get-out-of-jail card. So months ago I got a domain and started writing. Something for business owners and entrepreneurs without a law degree or a background in compliance. Over the last weeks I have covered AI governance, compliance and risk management in the US, the EU, Australia and New Zealand. Why New Zealand? I moved here, I love it, and I work with local businesses. So, an audience I want to include. So here is the call to action. Jump over to aicompliance.blog and have a read. If there is something of value in it, come back and leave a nice comment 🤙 I am not doing this to earn money or to sell you anything. I started it because I like to help others. Really. Read it here: https://aicompliance.blog

On AI policy design, someone mentioned: “AI policy is often written as if the whole world has the same problems.” Without knowing where they were coming from, I asked them to provide an example. They cited GPDR data protection laws. “GDPR-style frameworks often rely on informed consent and effective legal recourse, but those assumptions can become harder to translate into contexts with lower digital/legal literacy or weaker enforcement capacity.” This is a fair example, and certainly one worth considering when we think about policy design, especially policy design of a concern that reaches around the world. My thoughts are that policy needs to be applicable to the scope that it is designed to govern, but the thinking needs to start somewhere. To put another way, policy should not force square pegs to fit through round holes, but we need something that points everyone towards the right general direction. Direction without specificity is not going to work for every use case. Specificity without direction is not going to solve the problems with best practice in mind. AI policy discussion should start from a first principles based collaborative set of discussions between policy makers and subject matter experts alike, to eventually arrive at a comprehensively sound policy framework. Certain areas of this framework can be made abstract to allow carve outs that suit more localised policies to define things more specifically. Failing to create a unified policy framework, policy makers in different jurisdictions can create adaptations of existing implemented policies that suit their area of service, based on what they deem best practice and most suitable for their needs. So, universal where it's actually universal, specific where it has to be, and particularly in a fast evolving environment that is AI, flexible enough to adapt to any new breakthroughs, challenges or resolutions that are discovered in the years to come. Where have you found that "keeping things abstract" breaks down in practice — whether in policy making, running operations or shipping products? #AIPolicy #PolicyDesign #AIGovernance #DataProtection #AI

The legal ambiguity around AI training data isn't just a niche problem; it's a foundational challenge for the entire AI industry. Companies building LLMs face massive IP liability risks that could halt innovation or lead to huge settlements. This directly impacts developers and data scientists who rely on vast datasets, prompting a search for ethically sourced alternatives. Understanding these legal nuances is crucial for leaders navigating future regulatory landscapes and ensuring responsible AI development. How do we balance rapid AI progress with protecting creator rights in a sustainable way? #ResponsibleAI #IntellectualProperty #AIDevelopment 🔗 Read more: https://lnkd.in/guiD4CWn

Simple ways to keep your AI-powered business from paying huge regulatory fines. AI regulations are coming with real compliance obligations. While AI governance sounds complicated, most businesses can start with four basic things: 1. Do an impact assessment Before deploying AI, assess what impact it would make. Look at privacy: What data does it use? How is that data processed? And AI risks: Could it discriminate, make harmful decisions, produce unreliable outputs or create security risks? 2. Document how your AI operates You should be able to show: → Why it made a decision → How a human can understand that decision → What tools it can access → What permissions it has → What rules it must follow → What tests it must pass → What changes have been made over time And very importantly, log it all. This isn't actually very simple, but it can save you a ton of problems later. 3. Create an accountability map Someone needs to be responsible at every important point in the AI pipeline. Who approves it? Who monitors it? Who reviews its decisions? Who handles incidents? 4. Make Auditing a standard practice. Don't just create policies and forget them. Regularly check that your AI is actually operating within the rules you've established by establishing a procedure and system in your organization. These few steps provide a good framework for AI Governance and avoiding fines. Which of these four do you think businesses are most likely to get wrong?

Does legal AI have a shelf life? The law changes constantly, but usually slower than the world around it, and slower than technology itself. That gap is actually the interesting part. With the right data engineering behind it, AI can start making predictive reads on where the law is heading, sometimes faster than the technology tracking it can even keep pace with itself. So no, legal AI does not have a shelf life. If anything, the gap between how fast the law moves and how fast everything else moves is exactly what makes this space worth building in long term.