The U.S. is not waiting for Washington

State lawmakers, courts and regulators are already shaping how companies can build and deploy AI. The result feels less like neat lanes on a highway and more like a busy intersection without lights — messy, expensive to navigate, and at once a spur for invention and a legal minefield.

Why this matters now

For years people assumed a federal guardrail was coming. That expectation is collapsing. States are moving to fill the gap with laws and ordinances about biometric privacy, automated employment decisions, consumer protection and data transparency. Two patterns jump out:

• States act faster than Congress. Local politics, high-profile incidents, and plain impatience push legislatures into speedy fixes.
• Rules differ widely by sector and appetite for risk. One state may mandate vendor audits for hiring algorithms; another may ban facial recognition outright.

What’s interesting is how granular this gets. You can end up compliant in one jurisdiction and noncompliant a hundred miles away.

Concrete friction points for businesses

Companies that sell AI tools or embed large models across customers are running into predictable headaches:

• Contracting and SLAs. Buyers expect promises about bias testing and data handling. Sellers end up renegotiating the same clauses state-by-state — and that’s costly.
• Model documentation. Different disclosure standards mean engineers and product teams spend more time on paperwork than product improvements.
• Audit capacity. Independent bias audits are in demand; few providers can deliver them on short notice, so those that can charge a premium.
• Litigation risk. Illinois’s biometric privacy law has been influential for face-recognition products for years. Similar state-level claims are now being tried on other AI uses.

These are practical problems, not hypotheticals.

What companies are actually doing

There’s a pragmatic shift underway. Bigger firms are centralizing: registries for models, standardized risk scorecards, legal playbooks that translate state rules into product guardrails. Think of it as compliance-as-a-platform.

Startups split into two camps. Some design with regulation first and sell audit-ready tools; others shrink their addressable market to regions where rules are lighter. Neither approach is risk-free. Investors have started to treat regulatory resilience as a line item on diligence checklists — sometimes more thoroughly than growth projections in early rounds.

A mixed bag for consumers and civil-rights groups

Patchwork law has trade-offs. Local rules let communities respond faster than a slow-moving federal process. That experimentation can protect people sooner. But inconsistent standards produce uneven protections: one person gets clear disclosure, another gets none.

Civil-rights groups applaud aggressive state action against biased hiring or mass surveillance. Trade associations warn that overlapping mandates will crush smaller innovators without compliance budgets. Both observations are true.

Where federal policy fits

A plausible endpoint is federal preemption: a baseline set of rules that wipes out the most onerous state provisions while leaving room for local variation at the edges. Getting there, though, will take political will and a shared sense of what counts as unacceptable AI risk — and those are in short supply.

Until that happens, firms should be doing three practical things:

• Map the exposure. Inventory where products are used and which state laws apply.
• Prioritize controls. Start with the highest-risk features — hiring, biometric ID, credit decisions — and invest where explainability and audit trails matter.
• Build playbooks. Standard templates for vendor clauses, model docs and consumer notices speed negotiations and cut legal bills.

These are basic, boring steps, but they make a difference.

A slightly contrarian endnote

Yes, regulatory patchwork is chaotic. But it also creates an axis of competition. Companies that tidy governance early win trust and market access. Over time a handful of compliance-savvy providers could turn complexity into a defensive moat.

Treat the current environment as a one-off and you’ll be surprised. Treat it as the new baseline and you’ll probably survive — maybe even do well.

Pedro Marini