Data privacy and cybersecurity laws and regulations are constantly changing, and the rapid popularity of artificial intelligence (AI) is increasing, and more regulatory measures are beginning to be seen at the federal and individual state level, which are endemic to AI. Lawmakers at both levels are driven by a desire to protect consumers and intellectual property rights. Five states have recently implemented regulations on the use of AI, and it is more likely, so it is important to know that your business can do to avoid violating the law.
What laws regulate AI today?
Like data privacy, there is no comprehensive law in the United States at the federal level that governs AI use. An executive order was in place to fund AI research and how to safely use it and properly regulate it, but it was withdrawn in early 2025. There are currently several executive orders in place, revolving around three main White House objectives. Building American AI infrastructure. Leading international AI diplomacy and security. Below will be in effect or soon to make any current federal and state rules and regulations.
Current federal AI regulations:
- The Take It Down Act criminalizes unconsensual posting of intimate images, including deepfakes. Enforced by the FTC, the platform must remove such content within 48 hours of notification from the victim to 48 hours.
- The executive order promoting exports of the American AI technology stack imposes the Secretary of Commerce on establishing and implementing the AI export program by October 21, 2025. This directive is a program for the creation and release of US full-stack AI export packages. “Full stack development” is the construction of both front-end and back-end applications, and using AI makes this process more efficient.
- There are also executive orders to promote and provide funding to data centers across the United States. With the accelerated executive orders for data center infrastructure, the Secretary of Commerce will provide the ability to fund data center projects that include the infrastructure needed to power these data centers.
New State AI Law
The following states have passed laws specifically regulating the use of AI: Most laws provide that consumers must be notified when AI is being used, and that it is used to make decisions that bias (even if not intentional) can affect the outcome. Each of these differs in what the WHO must follow, so you must refer to a particular statue, but a high-level overview of each can be found below.
- The Utah Artificial Intelligence Policy Act was amended in May 2025. If a consumer is interacting with an AI system in a particular situation, the consumer must be notified, beginning and throughout, that he is interacting with AI rather than humans. Notification is required when sensitive data such as biometrics, health, or financial data are involved, and when AI is used to provide recommendations, information or advice regarding a particular decision, such as approval of loans and medical and mental health advice.
- Maine has enacted a Chatbot Disclosure Act. This requires that a reasonable consumer be notified when they are not involved with a person who is unaware of their involvement in AI (e.g., customer service online chat). The law prohibits the use of AI chatbots or similar technologies. This is a way that can be misleading or deceived to think that consumers are interacting with real people. Notifications regarding the use of AI chatbots must be clear and prominent.
- In June 2025, Texas' Responsible Artificial Intelligence Governance Act was signed into law and will come into effect on January 1, 2026. The law applies to government entities and all (businesses or individuals) that promote, promote or produce business in Texas, and produce products or services that Texas residents use or deploy Texas AI systems. Government agencies are specifically prohibited from using AI for specific purposes, such as assigning social scores or using biometric data without consumer consent. Other entities are prohibited from using AI to induce or encourage violence and infringe or limit the rights of others under the US Constitution. This legislation also affects the developers and deployment of these AI systems.
- Arkansas recently enacted laws to protect and clarify those who own AI-generated content. The new law states that those who provided information to train a model own the final model unless information is provided by the employee under the guidance of the employer (owned by the employer as a work product), unless there is no contract specifically stated. Similarly, when a person inputs information into a generator AI tool, the generated content is owned by that person.
- The Colorado Artificial Intelligence Act, which came into effect on February 1, 2026, is one of the most comprehensive AI laws in the United States to date, covering a variety of issues and may require an update to your existing privacy notice. With the exception of already highly regulated small businesses and certain sectors, it generally applies to people using AI systems that interact with Colorado residents. The use of AI must be disclosed to consumers (Colorado residents) when interacting with AI unless it is “obvious.” AI must be regulated when considered a “high-risk” AI system. If used to make a decision or is a substantial factor in the decision-making process in a particular area, such as education, employment, financial/loan, government services, healthcare, housing, insurance, law, etc., it is considered high risk. Developers of these systems should provide substantial documentation on the development process, including how to develop and evaluate the system to mitigate discrimination. Users of high-risk AI systems (for example, companies using AI systems to assess job seekers) should use reasonable care, implement risk management policies and programs, and complete impact assessments. Before a decision to use AI is made, the use of AI must also be disclosed in the deployer's Privacy Policy/Notice, and developers and deployments must notify the Colorado Attorney General of its use.
Considerations when using AI
First and foremost, you need to evaluate how you use AI and what you do with the generated information if you use the generated AI. You also need to consider who is interacting with AI on the platform (state and country residents), and which laws apply to you. We recommend that you consider updating your Privacy Policy/Notices to address your AI use. Having a full understanding of the information you have, where it comes from, where it is stored, and how to use it is very important to the privacy and security of your data in general, and it becomes even more essential with the ever-changing landscapes and the use of AI in that area.
If you own or manage your business and have employees, you need an AI usage policy. It is very likely that employees are using AI in some way, so to protect their business, they need to tell them how they use it for their work. Consider whether you want to allow the use of devices offered by your company using AI, or whether you must disclose whether some of your work has been developed using AI.
Some states focus on limiting and managing AI systems developers and deployers (entities using AI systems), so consider how they affect contract negotiations with specific service providers. For example, if you or your business use AI systems to sort the recruitment applications of potential applicants you want to interview and are subject to CO AI Act, you are currently a high-risk AI system deployer. Contracts with developers of high-risk AI systems must ensure that they are in compliance with applicable laws, including clauses that continue to the developer through certain compliance matters. Similarly, if you or your company are developers of a particular AI system, consider contracts with customers and make it clear that you will not do anything, such as providing the necessary notifications or whether you are eligible to be deployed.
In addition to concerns about bias, AI also offers “hastisation.” This constitutes the facts to provide the requested results. This occurred in laws filed multiple times by law, as AI constitutes false case law and citations. Lawyers are prima blamed for these mistakes and anyone using AI for drafting should be careful. AI is as good as the information provided for “learning”, and when trash comes out, it leads to trash coming out. AI can be a great resource, but users still need to fact-check and check the output.
If you or your company uses AI, the best practice is to know the law early and engage with experts who can help you manage and mitigate risks.
This blog has been drafted Jessica Brigmanattorney for Spencer Fain St. Cloud, Minnesota. For more information, please see www.spencerfane.com.
click here Subscribe to Spencer Fane Communications to get timely updates like this straight in your inbox.
