Why State AI Laws Are Piling Up

See All Episodes

Listen and follow on:

SHOW NOTES AND RELATED CONTENT

• Congress and State Lawmakers Are Racing to Keep Up With AI
• Trump’s AI Preemption Executive Order Unlikely to Put a Lid on State AI Laws

TRANSCRIPT

The following transcript of this discussion was edited for clarity.

Sarah Cambon: Hi, everyone. I’m Sarah Cambon, and this is “Forces of Law.” It’s a new podcast from Goodwin about the big forces shaping business.

If you’ve been following the news lately, you know there’s been growing concern over AI (artificial intelligence) and a lot of debate over whether the federal government should step in. In the meantime, state governments have been writing their own rules. That’s what this week’s episode is all about.

We’ll look at where these state AI laws are headed, where companies are most exposed, and, with midterm elections this week (November 3, 2026), we’ll also talk about how the results could affect what comes next.

With me to discuss all this is Gabe Maldoff, a partner in Goodwin’s Data, Privacy & Cybersecurity practice. Gabe, welcome to the podcast.

Gabe Maldoff: Thanks so much, Sarah. It’s great to be here.

Sarah: You’ve been focused on privacy law for a while now. When did AI really start to come on your radar?

Gabe: AI has been part of the privacy conversation for a long time. I started practicing in privacy about 10 years ago, and, even then, we were focused on the uses of AI. But it was more in the old-school machine-learning context, so really it was in November 2022 when ChatGPT burst on the scene.

Sarah: It sounds like before 2022 there were some laws that had an AI component.

Gabe: Yes, for sure. There’s a European law called the General Data Protection Regulation (GDPR) that the EU had passed around 2016, which came to be known as the biggest, baddest privacy law in the world. The GDPR included a right that it took from an even older law — from 1995 — that protects individuals from automated decision-making. These concepts are now forming the basis for some of the more recent laws we’ve seen. So even though the technology has changed quite a bit, privacy laws were anticipating a lot of the issues we’re starting to see now.

Sarah: What’s the lay of the land on AI regulation today? What role is the federal government playing, and what role are the states playing?

Gabe: The federal government under the Trump administration has taken a deregulatory posture toward AI. It’s not like there was a federal AI law under the Biden administration, but the direction was toward guardrails. What we’ve seen in this administration has been an attempt to change course.

So we’ve seen an executive order that creates obstacles and reduces funding pathways for states that legislate AI in certain ways; we’ve seen federal agencies rolling back some proposed AI regulations; some agencies are still moving forward. For example, the FDA (U.S. Food and Drug Administration) is rolling out and working on guidance for AI and medical devices. But the direction of travel out of the White House is very much toward not legislating — not overlegislating — AI.

On the other hand, at the state level, we’re seeing a ton of lawmaking. Literally thousands of bills over the last few years have been proposed to regulate AI. And in the last year, what started as a trickle of these bills passing into law has turned into a landslide.

Sarah: So tell me more about some of these laws.

Gabe: There are a few that I think are really interesting. The laws that are passing tend to fall within a few discrete categories. One area is increasing focus on frontier AI models. These laws regulate the developers of those models, as well as any companies that substantially modify those models for their own purposes.

Sarah: Examples of frontier model developers are companies like OpenAI?

Gabe: Yes, that’s exactly right. There, we’re seeing efforts to protect against catastrophic risks — so concerns that a model would be powerful enough that you could take down nuclear facilities or disrupt trains and planes.

One piece of that that I think is really interesting to watch and has the potential to influence other laws — maybe even outside the frontier AI space — is a recent law in Illinois that will require the developers of these models to invite a third-party auditor to verify their compliance with their safety and governance procedures. That idea of third-party vetting is likely to become increasingly popular as we see a trust gap between consumers and what can be perceived as a black box of how these systems work.

Sarah: I think a lot of listeners have probably come across examples of AI being used to screen job applicants or to help make important decisions regarding lending or healthcare. What are these laws asking companies to do?

Gabe: These laws focus on what are called significant or consequential decisions, like a tool that screens résumés and selects candidates for interviews. So if you are subject to these laws, the types of requirements we’re seeing include notifying people ahead of time that AI is being used to make a decision, notifying people after the decision is made that there’s been an adverse decision using AI, and giving people a chance to challenge the decision and obtain human review. Some of these laws require bias assessments to look for risks of discrimination.

Sarah: AI is changing really quickly, and one example of that is agentic AI. Are lawmakers starting to tackle this area, Gabe?

Gabe: This is an area of huge concern because as soon as AI agents start to operate in the real world and take actions autonomously, it creates all sorts of risks systems that operate under human control don’t have.

For example, if you’re a consumer and you’re using an AI agent to help you buy plane tickets, what happens if it buys plane tickets for the wrong day? Is there a way to void the contract?

We are seeing lawmakers start to address this in a few narrow ways, including laws making clear that you can’t blame the agent — the AI system — for the action taken on behalf of a human user or corporation. On the other hand, I heard recently about a proposal in Delaware that would create a new type of legal entity for AI agents so they could operate on their own behalf. So it does seem there are some examples of states moving in different directions on this.

Sarah: If we zoom out, how well is this state patchwork approach to AI regulation working?

Gabe: The best way to think of it is like a bubbling geyser. You’ve got states legislating in lots of different directions. Meanwhile, the European Union has looked a lot more organized — a lot more centralized — in its approach. That piece of privacy law we talked about, the GDPR, was a great example of that.

But what we’re seeing now is that, as technology is changing so quickly and AI is disrupting entire business models, that mode of regulation in the EU can’t keep up with the pace of change. And the way that states legislate (often much more haphazardly, with all the kinks and quirks that come with that) has actually allowed the US to pass some of the most innovative laws in the AI regulation space.

Sarah: That’s a really good point. I hadn’t thought about how the states’ patchwork approach actually enables states to be more nimble.

Gabe: Exactly. But the challenge with the way the US is currently legislating AI is that even keeping track of the bills and laws is a full-time job. The other challenge is that it leaves protections very contingent on which state you live in, which means you can have different outcomes for different people and more complexity for businesses working across the country. I think the other issue, too, is a little more subtle. While the states are nimble and can react quickly, they don’t have the same heft or ability to project a vision that the federal government does or shape entire sectors and so maybe aren’t addressing all the ways that AI could cause harm or all the concerns that we’re starting to see being expressed around its use.

Sarah: This week there are midterm elections in the US as you know. Do you think the results will affect AI legislation going forward?

Gabe: There could be some impacts at the margins. Democratic lawmakers do tend to be more open to regulation than Republican lawmakers are.

But this is a bipartisan issue, so it’s not clear that the midterms will necessarily change the direction of AI regulation. As an example of that … obviously, California is a leader in this space. California has probably more AI bills that have turned into laws than any other state. But Texas is also a leader.

Concerns about AI are pretty widespread. We’re already seeing in states across the country, across political aisles, that groups are getting active. So there’s a market for legislators that want to regulate in this space, and businesses that are developing or deploying AI need to be sensitive to the fact that there is this backlash brewing.

Sarah: So what’s the one thing you want companies to understand about where AI regulation is headed?

Gabe: The key thing for companies is that for a lot of the ordinary uses of AI by businesses, we aren’t seeing specific regulation yet. Lawmakers are grappling with how to promote and incentivize technologies that could have real productivity benefits while trying to legislate in the spaces where there have been tangible harms.

So I think the takeaway for most businesses is: You need to be thoughtful in your approach to AI governance within your organization; you need to be conscious of how your business is using it and aware when you’re rubbing up against the edges of some of these regulated categories.

But this isn’t a situation where every use of AI needs to be firmly policed. This technology is already almost as ubiquitous as Google, and no one wants to be in the business of policing every Google search. So identifying the highest-risk areas for each business and tackling those while letting people experiment in the spaces in between is key.

Sarah: Gabe, thanks so much for a really interesting conversation.

Gabe: Always great to chat, Sarah. Thanks.

Sarah: Gabe Maldoff is a partner in Goodwin’s Data, Privacy & Cybersecurity practice. We have links to more about this topic in the show notes, and you can check out all of our analysis at goodwinlaw.com.

If you’re enjoying “Forces of Law,” please leave us a rating. We’re new, so it really helps other listeners find the podcast.

Bob will be back to host our next episode, which is on the way AI is reshaping drug discovery. Stay tuned, and thanks for listening.

I’m Sarah Cambon, and this is “Forces of Law.” See you next time.