Lawyers Urge Preparation for AI's Uncertain Regulatory Landscape
While few states have laws crafted specifically to regulate AI, they all have measures that cover the technology, Troutman Pepper lawyers said during a podcast episode. Adding to the AI uncertainty is the Trump administration's anti-regulatory stance and rumblings that the failed federal moratorium blocking state AI laws will be resurrected. As such, preparing for various scenarios is recommended, the attorneys said.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
State AI laws are an “ever-evolving landscape,” said Gene Fishel, a Troutman Pepper lawyer and former regulator. While just Colorado, Utah, California and Texas have AI-specific laws, “there are dozens of states" considering AI measures, "so this is going to change.”
Despite compliance with just four states' regulatory regimes seeming manageable, "I’m sure companies' heads are spinning, thinking, ‘How am I going to comply?’” said Chris Carlson, a lawyer specializing in state, federal and local regulatory matters. On top of that, every state has laws covering unfair, deceptive acts and practices (UDAP) and other consumer protection laws that cover AI.
Indeed, state regulators often say, “‘We don't have to wait for some state law to be passed on AI for us to regulate it,’” he added.
Moreover, states are moving from “a slap on the wrist" to treating things “as a true violation,” especially in the health care space, Carlson said. “We're seeing that in terms of big data and making decisions, and [telling companies] ‘You're not being thoughtful, nor are you disclosing how those decisions are being made.’”
On the federal side, the Trump administration has “been patently clear" that it favors "deregulation" for AI, Fishel said. While the proposed 10-year AI state-regulation moratorium failed this summer in the Senate (see 2507010071), Fishel said it was “notable” that the split was not along party lines.
Senate Commerce Committee Chairman Ted Cruz, R-Texas, told Privacy Daily in late July that the moratorium "absolutely could return" in some form (see 2507210042). Cruz and other Senate leaders are set to discuss the moratorium and privacy soon (see 2509160055).
“The White House does not want states passing legislation that interferes” with its AI Action plan (see 2507230058), Fishel said. “The reports are the White House is going to continue to lobby Congress to pass some sort of legislation that is similar to this moratorium that was stricken from the budget bill in the near future.”
Despite some uncertainty about the specifics of future AI regulation, companies should prepare for various scenarios, the lawyers said.
For example, organizations should gather stakeholders now "to discuss where their AI use sits currently" and where it's going, Fishel advised. This discussion should include everyone from C-suite executives to IT personnel and legal counsel, he said.
A “mechanism” is needed for company units to communicate “about how AI is being deployed," how it will impact operations, and "the potential legal exposure" from deploying AI, he added.
Carlson agreed, and added that companies should be wary and “thoughtful” about “public disclosures about your AI,” as “what you're communicating to the public, typically, is the source of UDAP laws.”