/>iBusinesses increasingly rely on AI and generative AI for myriad uses. A new body of “AI law” is forming—and some legal requirements are now live. AI governance is a mandatory compliance function right now rather than next quarter or next year.
AI law is a patchwork across jurisdictions and can be hard to pin down. While some jurisdictions are enacting new laws, others are pulling back. As the political pendulum continues to swing, regulatory retrenchment is among the key themes coming into focus in 2025.
Some hardline AI regulatory regimes that dominated headlines in 2024 are being walked back. For example, at the U.S. federal level, the Trump administration has undone Biden-era AI executive orders, and federal agencies are recalibrating enforcement priorities accordingly. Consistent with broader deregulation impacts, observers expect that the FTC, SEC, and other agencies will focus primarily on clear cases of fraud, rather than pursuing broader or more innovative regulatory actions.
At the state level, the Colorado AI Act is under scrutiny for possible amendments, including through a new bill introduced in April 2025. Meanwhile, the governors of California and Virginia recently vetoed high-profile AI bills. And the U.S. House Energy and Commerce Committee proposed a 10-year moratorium on the enforcement of state AI laws in a recent draft budget reconciliation bill. Across the pond, the EU Commission recently withdrew the draft AI Liability Directive and is reportedly considering amendments to the EU AI Act to soften certain requirements.
But AI regulation is not dead. Newly enacted state laws in the U.S. (e.g., California, Illinois, New York, Utah) address algorithmic discrimination and automated decision-making; disclosure of AI use; impersonation, digital replicas, and deepfakes; watermarking of AI-generated content; data privacy and biometric data; and more. State attorneys general (e.g., California, New Jersey, Oregon) have reiterated that they will enforce existing laws against unlawful uses of AI. And, of course, the AI “copyright war”—testing the boundaries of copyright infringement and fair use for AI training and outputs—wages on in dozens of lawsuits in the U.S. and elsewhere.
The first requirements of the EU AI Act went live in February 2025. For example, companies using AI within the EU are now subject to the “AI literacy” requirement mandating “measures to ensure, to their best extent, a sufficient level of AI literacy” for employees or others who operate or use AI systems. The AI Act is extraterritorial. It applies to U.S. companies using AI systems within the EU or whose AI systems produce outputs intended for use in the EU. Employee training regarding the responsible use of AI is now mandatory for such companies.
Bottom line: while there may be a trend towards softening AI regulation in some areas, this is not a universal truth, and enterprise AI governance remains essential. Some new “AI law” requirements are now live, while others will be soon. In addition, regulators, state AGs, and plaintiffs will seek to apply existing laws to new technology. And, of course, there's the potential self-inflicted wounds (like data leakage) and the reputational and public relations risks from an AI-powered snafu.
Luckily, there are some common threads in the AI regulatory thicket, and established guidance may ease the governance burden. Voluntary AI compliance frameworks like the NIST AI RMF and ISO/IEC 42001:2023 not only provide useful, detailed guidance for responsible AI governance, but they also form the basis of statutory safe harbors or affirmative defenses under laws like the Colorado AI Act. They provide a wise starting point for compliance programs, in addition to choosing AI model providers, models, and use cases wisely.
Luckily, there are some common threads in the AI regulatory thicket, and established guidance may ease the governance burden.
