AI & Emerging Tech Compliance

AI regulation is moving from theory to enforcement faster than most companies expected. The EU AI Act — the first comprehensive AI law anywhere — is now in force, with obligations phasing in through 2026 and 2027. In the US, Colorado passed the first comprehensive state AI law in 2025, followed by Texas's TRAIGA. A dozen more states have introduced or passed AI-related bills. The FTC has issued guidance on AI and deceptive practices. The EEOC has weighed in on AI in hiring. NIST published its AI Risk Management Framework.

The central organizing concept in most AI regulation is risk classification. Laws distinguish between AI systems that pose higher risk — because they make consequential decisions about employment, credit, housing, healthcare, or critical infrastructure — and systems that pose lower risk. Higher-risk systems face more demanding obligations: impact assessments, human oversight requirements, transparency disclosures, bias auditing. Understanding where your AI system falls on the risk spectrum is the first compliance question to answer.