General Counsel (GCs) and Chief Information Security Officers (CISOs) should work together to familiarize themselves with and address the growing complexity of AI regulation, as U.S. companies face a “patchwork of compliance requirements” stemming from the absence of a federal AI framework. This is true for all companies that will have some involvement with AI (as all should), developers and deployers alike.

With the European Union (EU) AI Act now in effect and several U.S. states having AI laws, companies must prepare for increased regulatory scrutiny while maintaining innovation and competitiveness. This fragmented landscape creates challenges around compliance, transparency, and governance, particularly for organizations operating globally or deploying AI in sensitive sectors like finance, housing, and government services.

Key Takeaways — Laws and Regulations GCs and CISO’s Should Be Familiar With:

1. EU AI Act Compliance:
   • The EU AI Act, the world’s most comprehensive AI regulation, applies to many U.S. companies. It applies extraterritorially to any company that is a Provider, Deployer, Importer, Distributor, or Product Manufacturer of AI systems within the EU.
   • Its provisions include mandatory risk assessments, transparency requirements, and prohibitions on high-risk AI systems.
   • U.S. companies must comply with EU rules to sell or deploy AI systems within Europe, effectively making the Act a “default” regulation for global businesses.
2. State AI Laws in the U.S.:
   • Over half of U.S. states have enacted AI-related legislation, including laws targeting bias in elections, housing, and employment.
   • Colorado’s AI law, effective in 2026, requires deployers to mitigate algorithmic discrimination. Nebraska and Texas are considering similar laws modeled after the EU AI Act.
3. Federal Action Laws:
   • President Trump’s recent executive order calls for a cohesive federal AI strategy but lacks specific regulatory mandates. A proposal is expected within six months.
   • The absence of federal direction forces companies to navigate a patchwork of state and international laws, increasing compliance costs and risks.
4. AI Governance Best Practices:
   • Companies should implement robust AI governance frameworks, including risk assessments, transparency measures, and stakeholder education programs.
   • Multinational companies are advised to adopt risk-averse approaches, ensuring compliance with the strictest applicable regulations to avoid legal and reputational risks.
5. Global Trends:
   • While Europe leads in AI regulation, the U.S. and China dominate AI innovation. This dynamic underscores the need for balanced regulations that protect consumers without stifling innovation.

Summary:
The fragmented regulatory landscape for AI creates significant compliance challenges for U.S. companies, particularly those operating globally. GCs and CISOs must prepare for the EU AI Act’s requirements while addressing state-specific laws in the absence of federal guidance. Proactive measures—such as implementing comprehensive governance frameworks and aligning with strict international standards—can help businesses navigate this complex environment while fostering innovation and trust.

Original Article:
Title: “Companies Look to Jumble of AI Rules in Absence of US Direction”
Publication: Bloomberg Law
Date: February 18, 2025
Author: Kaustuv Basu
Note: This summary was written by AI and is unedited.
Link to Article