Using or building AI

Provides immunity to online platforms from liability for third-party content. The foundational law enabling user-generated content platforms, review sites, social networks, and any platform that hosts content created by others. Not absolute — does not protect platforms from federal criminal law, IP claims, or content the platform itself creates or materially contributes to. Under active legislative scrutiny — the scope of Section 230 immunity has narrowed through case law and remains politically contested.

DoD-specific cybersecurity certification requirement for defense contractors and subcontractors. Effective November 2025. Three levels — Level 1 (basic), Level 2 (advanced, requires third-party assessment for most), Level 3 (expert). Any company in the defense industrial base — including software vendors, IT service providers, and cloud providers touching DoD systems — must understand which CMMC level applies. Non-compliance means losing DoD contracts.

Small Business Innovation Research and Small Business Technology Transfer programs provide federal R&D funding to small businesses across 11 agencies. Awardees generally retain IP rights under Bayh-Dole principles. A major entry point for tech companies seeking federal contracts.

First-of-its-kind US state law regulating high-risk artificial intelligence systems. Effective February 2026, it imposes duties on developers and deployers to use reasonable care to protect consumers from algorithmic discrimination in consequential decisions.

Requires disclosure when AI-generated content is used in certain commercial contexts. Relevant for marketing, media, and content companies using AI-generated images, text, or video in commercial communications.

Regulates the use of artificial intelligence analysis of applicant video interviews in Illinois, requiring notice to applicants, consent, and limits on who may view the video.

First US law regulating automated employment decision tools (AEDTs). Requires employers using AEDTs in hiring or promotion to conduct an independent bias audit and provide notice to candidates.

Passed 2025 legislative session. Applies to developers and deployers of high-risk AI systems affecting Texas consumers. Requires impact assessments, transparency disclosures, and human oversight mechanisms for high-risk AI. Modeled partly on Colorado's AI Act but with Texas-specific carve-outs for small businesses and certain industry sectors. Effective January 2026. One of the most significant state AI laws for companies with Texas operations or Texas-based customers.

Canada's proposed overhaul of federal privacy law, currently before Parliament. It would replace PIPEDA with the Consumer Privacy Protection Act and create a new AI regulatory framework. Companies operating in Canada should monitor its progress as it will substantially change Canadian privacy obligations.

The world's first comprehensive AI regulation, classifying AI systems by risk level from prohibited (social scoring, manipulative AI) to high-risk (hiring, credit, law enforcement) requiring conformity assessments. Compliance deadlines are phased through 2027. Applies to any company deploying or developing AI systems used in the EU.