AI Compliance: What Businesses Need to Know and Do Now

Businesses can no longer wait to take AI compliance seriously. While there is still no federal AI statute, more than 60 state laws now regulate various aspects of commercial AI, and there is already substantial litigation involving business use of AI tools, largely brought under privacy, wiretap, and biometric statutes that predate the technology by decades. The good news for businesses is that most of what these new AI regimes require is familiar: inventory, notice, consent, vendor terms, retention limits, and human review.

If your business has not evaluated its own AI compliance, both in terms of the tools used internally and any products, services, or tools deployed as part of its business operations, now is the time to do so.

1. Laws to Know

Federal

Recent federal policy has moved toward light-touch AI regulation and a single national framework. The current administration is challenging state AI laws and pressing Congress to preempt them, but that effort has not yet displaced any state laws. Taking a lesson from privacy law, businesses should not take a wait-and-see approach in reliance on a future federal AI regime or preemption that may never happen. For now, companies should make plans to comply with state AI and privacy laws and rules that apply to their products, users, and data.

Notably, the FTC can act under Section 5 of the FTC Act even when no AI-specific statute applies. Businesses can face enforcement for undisclosed or misleading AI practices, including sharing user data with outside AI developers in a way its privacy disclosures do not explain.

States–Four Primary Areas of Legislation

Chatbots—the most active area of AI lawmaking. California, New York, Connecticut, Colorado, Washington, and several other states have adopted chatbot laws and rules. The details vary, but three obligations are common: (1) disclose when a user is interacting with AI, (2) maintain protocols to detect and respond to self-harm concerns, and (3) protect minors.Coverage turns on how a state defines a chatbot. Some rules reach ordinary customer-service bots, while others focus on companion systems that simulate relationships or remember prior interactions. These laws generally apply based on where your users are located, not where you are incorporated, so a nationwide chatbot should be built to the strictest applicable standard.
Automated decisions about people. New AI laws and rules are focusing on significant decisions made by AI or automated means. If AI helps decide who gets hired, fired, admitted, housed, insured, or provided services, the company using it should be prepared to disclose the use, explain the decision process, and document testing and oversight. Where states are splitting is the threshold question: how much AI involvement triggers those duties.California’s CCPA rules reach technology that replaces or substantially replaces human decisionmaking, meaning the output is used without meaningful human involvement. A reviewer who understands the output, weighs other relevant information, and has authority to change the result keeps the use outside the rules. Rubber-stamping does not.Colorado’s proposed SB 26-189 sets a broader trigger: AI that materially influences a consequential decision in seven areas including employment, housing, lending, insurance, and healthcare. The proposed law would also require notice after an adverse outcome and let individuals correct the underlying data and seek human reconsideration. The statute does not define “materially influences,” and the Attorney General has asked for comment on competing standards.The practical consequence: keeping a human in the loop may take you outside some state laws but not others. Inventory where AI informs decisions about people, not only where it makes them on its own.

Sectoral laws, content regulation, and AI-as-privacy. Specific review of AI laws based on industry sector is important, as states continue to regulate AI more restrictively in contexts such as healthcare, employment, and insurance, requiring express notice and consent and restricting uses in various contexts. States are also regulating AI content, including restricting deepfakes, digital replicas, and AI use in election contexts. And many states, including California, continue to regulate many aspects of AI as part of privacy law compliance.
Developer and frontier-model laws. Finally, we continue to see state laws governing large-scale AI systems. California, New York, and Illinois are imposing safety frameworks, incident reporting, and independent review requirements on developers of powerful frontier AI systems. And while this may not apply to most businesses, everyone who deploys or uses large AI models should monitor these trends.

California-Specific Laws

The CPPA’s rules on automated decisionmaking technology (ADMT) and privacy risk assessments create the clearest near-term deadlines for AI compliance for many businesses:

ADMT—January 1, 2027. If you use automated technology to make or materially influence significant decisions about California residents (employment, lending, housing, education, healthcare, or essential services), you need published pre-use notices, working opt-out and access workflows, and an explanation of the logic and effects. Employees, applicants, and contractors are included beyond commercial consumers.
Risk assessments—underway since January 1, 2026. As of now, businesses subject to the CCPA must conduct risk assessments for high-risk processing activities and must submit attestations and summaries to the CPPA by April 1, 2028. High-risk processing includes ADMT uses.

California’s Legislature closed its 2026 session with a package of AI and privacy measures, including several laws aimed at regulating business/employer use of AI:

SB 947—Bars sole reliance on automated systems for employee discipline or termination; requires human corroboration, post-use notice, and employee data access. Operative July 1, 2027.
SB 951—Amends Cal/WARN to require additional disclosures when layoffs are caused substantially by AI or automation.
AB 1883—Categorically prohibits employer use of AI tools to infer emotional states or collect neural data, with no wellness-program exception.
AB 1331—Prohibits workplace surveillance tools in restrooms.
Other measures include SB 923 (expanded deletion rights), AB 1609 (chatbot disclosures), and additional rules on data sharing and professional AI use.

The EU AI Act

If your business offers AI-enabled products or services to people in the EU, the EU AI Act can reach you without an EU entity. The EU AI Act applies based on where a system is placed on the market or where its output is used. Compliance obligations scale with risk, and the heaviest requirements fall on “high-risk” uses, which for most US companies means hiring and HR screening tools, credit decisions, and education or admissions systems.

2. Litigation and AI Tool Trends

AI notetakers are a current hot spot. If your company uses an AI notetaker, treat the tool as more than a transcription service. In August 2026, a California court allowed claims against Otter.ai to proceed after plaintiffs alleged that its speaker-tagging feature created voice profiles without the required consent. The same theory has been asserted against other tools, including one tool that took notes without visibly joining the meeting. Before deployment, confirm what data or inputs the tool/vendor records, how long it keeps the data, and whether it uses it for anything beyond providing the service. If so, a court may view it as a separate party and not merely your service provider, and thus subject to heightened notice and consent obligations.

Exposure is not limited to the AI tool/vendor. A company that deploys the tool may also be named, particularly if it helped decide how recordings or voice data were collected, used, or retained. Illinois’s BIPA allows private suits and statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, or actual damages if greater. Recent class actions involving voiceprints from public recordings show how quickly these theories can spread. Speaker identification, voice authentication, and emotion detection are all risk areas.

Chatbots and website tracking. Claims under California’s CIPA involving website chat functions, session replay, and tracking pixels continue to increase and provide statutory damages of $5,000 per violation with no proof of harm required. California’s SB 690 would limit some pen-register and trap-and-trace claims involving websites and apps, but it does not eliminate the broader litigation risk under wiretapping/electronic communication legal theories.

Employment. Using a well-known AI hiring tool or vendor does not shield an employer from discrimination claims. AI screening tools used on an employer’s behalf can expose the employer to liability. Businesses using these tools should run bias audits through counsel where appropriate, and document the scope, methodology, and results.

AI-driven pricing. Dynamic pricing, which involves adjusting prices based on supply, demand, time of day, or competitor pricing, is a long-established business practice, and AI generally makes it faster and more efficient. But risk arises when a system uses personal consumer data, such as browsing behavior, purchase history, location, income proxies, or demographic information, to estimate an individual’s willingness to pay and set a price accordingly. That is personalized, or “surveillance,” pricing.

In August 2026, the FTC proposed an enforcement policy statement making these practices a key focus. Its position is that a business using consumer data to personalize prices should clearly disclose that the price is personalized, the basis for the personalization, and the types of data used; failing to do so may violate Section 5 as deceptive or unfair.

State consumer-protection statutes, privacy laws, and emerging state personalized-pricing legislation create additional risk, and models trained on historical data may produce prices that correlate with race, income, age, or other protected characteristics, creating civil-rights liability even without discriminatory intent. For business clients, the practical line is straightforward: dynamic pricing based on market conditions is generally permissible; personalizing prices from individual consumer data without disclosure is where the legal risk sits. If your business uses AI in pricing, review what data feeds the model and whether consumers know about it.

AI in Litigation and Discovery

Courts are treating AI prompts and outputs as ordinary business records rather than a protected category. For business teams, that means assuming employee chats, meeting transcripts, and AI tool logs may be requested in litigation.

Prompts entered into public AI tools are generally not confidential. Asking a chatbot a legal question does not create an attorney-client communication, and using a consumer-grade tool undercuts any later claim that the exchange was privileged.
Employee prompts can become evidence against the company. Courts have relied on chatbot conversations to establish what decision-makers were actually thinking, including where the stated business rationale differed from the exchange.
Deleting AI logs creates a second problem. Once litigation is reasonably anticipated, AI records carry the same preservation obligations as email, and destroying them invites spoliation arguments on top of whatever the underlying dispute is.
Work product protection may survive when counsel directs the use. Where an attorney structures the prompts or supervises the work, protection is more likely — but the law is unsettled, and the conservative assumption is that prompts, outputs, transcripts, and logs are discoverable unless counsel has directed otherwise.
Update preservation infrastructure now. Litigation holds, custodian interviews, and discovery templates should expressly cover AI prompts and outputs, meeting transcripts and summaries, and related metadata — categories most existing templates do not name.
Recording expands the record. Every AI-generated transcript or summary is a new discoverable document, and one that may not match the formal minutes of the same meeting.

Regulators are Active

State attorneys general are leading AI enforcement by using consumer-protection, civil-rights, and privacy laws that already exist. A coalition of AGs recently warned major AI companies about harmful outputs, and individual states have pursued chatbot operators and AI developers through investigations, injunctions, criminal referrals, and new legislation. Businesses should take note that regulators do not need to wait for AI-specific statutes before acting. They are adapting current laws to these new technologies.

3. Internal AI Use: Risks and Safeguards

Businesses should start from the assumption that AI is already in your workplace. Global survey data puts regular, intentional AI use at roughly three in five workers, and vendors are enabling AI features inside software you already license, sometimes without explicit notice. It is unlikely any business can still represent that they do not use AI, and broad AI tool bans are no longer practical.

Adopt a policy, but do not impose a ban. Prohibition on use of AI tools drives AI use underground, where it cannot be supervised. A workable policy identifies approved and prohibited tools and uses, states what may never be entered into an AI tool, addresses confidentiality and privacy, requires verification, assigns accountability for final work product, and explains consequences. Without a policy, every employee sets their own rules, with many using AI quietly and never disclosing it. Businesses should take a practical approach and reasonably regulate internal AI use. AI policy updates and employee trainings should be expected regularly as AI tools and the legal landscape continue to evolve rapidly.

Watch for AI tools that act, not just advise. Agentic AI systems can approve transactions, send communications, screen applicants, manage workflows, or make decisions with limited human involvement. These tools are arriving quickly, often embedded in software businesses already use, and the compliance stakes rise when the system acts rather than merely provides information. Inventory where AI is taking actions and ensure that appropriate human oversight and audit trails scale with the tool’s level of autonomy.

Use enterprise tools, not free or consumer accounts. Businesses should contract for closed AI systems that prohibit vendor retention, training on your data, and third-party disclosure. The gap between a company’s enterprise account and an employee’s personal free account now has real, legal consequences. Policies should make the distinction explicit and enforce it.

Make a deliberate decision about meeting assistants. We previously addressed these tools here, but the information bears mentioning again. Treat these tools as communications-capture tools rather than productivity :

Designate meetings where they are never permitted—privileged advice, investigations, HR and accommodation discussions, board deliberations, transactions, and anything involving client-confidential, patient, or applicant information.
Provide participant-facing notice and capture consent, keeping in mind all-party consent states and external participants who never agreed to your vendor’s terms.
Disable speaker identification where a plain transcript will suffice. That setting is often the difference between a transcript and a biometric identifier.
Confirm that administrators can set defaults centrally instead of leaving recording, sharing, and training settings to individual users.
Reconcile AI summaries against formal minutes. Discrepancies get scrutinized, and verbatim transcripts preserve offhand remarks that curated minutes would omit.

Set retention and deletion rules. Don’t just let AI tool data sit in your systems. Set retention rules and deletion schedules for each category of data these tools generate, including the audio, transcripts and summaries, voice profiles, associated metadata, downloaded exports, and copies that linger in CRM or collaboration systems even after the original is deleted.

Maintain human oversight for important AI-generated output. Several new laws now require it, and many business contracts are now demanding it.

4. Three Priorities Before January 1, 2027

Build your AI inventory. You cannot govern what you have not mapped. Document every AI tool, system, and AI-enabled feature in use, as well as the data it touches, and the risk tier.
Map your exposure. Based on your AI inventory, identify applicable laws and legal requirements. California’s ADMT compliance, Colorado’s replacement automated-decision law, new state chatbot requirements, and many other laws are going into effect January 1, 2027, and many other laws are already in effect.
Name one accountable owner. When legal, HR, security, and the IT function each hold a piece of ownership, the seams between them are where problems go unnoticed. A single senior executive with a clear escalation path closes those seams.

The Bottom Line

AI can no longer be ignored. Whether or not your company has formally adopted it, AI is almost certainly already in use—in tools your employees chose, and in features your vendors switched on without asking. The starting point is not a policy. It is a set of questions every business should be able to answer:

What AI are we using, including features enabled by default in software we already license?
Have we disclosed that use to the people it affects—customers, employees, applicants, and meeting participants?
What do our AI vendors do with our data, and can we turn it off?
How long do we keep AI-generated content, and can we delete it when we need to?
Who inside the business owns AI compliance and has authority to act?

Few companies can answer all five questions today. The ones that can will find most new obligations are variations on work they have already done—and the ones that cannot will likely discover the gaps through a regulator’s inquiry or a plaintiff’s discovery request. Ensuring your business can answer these questions now will put you in a good position to deal with the continuing evolution of AI laws and regulations.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.