A separate body of law from anything governing your own practice — and the one clients assume you already track.
Start a conversation with the AI Adoption Concierge, already scoped to AI statutes. Pick a starting point, or describe your situation directly.
This is the third rulebook, and it is the one that generates work rather than obligation. It regulates AI systems and the organisations that build or deploy them, and it reaches a firm's clients long before it reaches the firm. Two features make it difficult to summarise honestly. It is genuinely volatile — effective dates have moved, at least one comprehensive US state statute was repealed and replaced before it ever took effect, and a major European regime had significant obligations deferred by more than a year. And it is contested at the federal level in the United States, where preemption of state AI law has been actively pursued. Anything written about this area without dates attached is unreliable, and a good deal of what circulates has none.
The clusters that generate the most client questions, in rough order of volume.
The most litigation-adjacent cluster. Several US states have imposed notice, testing or anti-discrimination obligations on automated decision tools, with divergent effective dates and at least one enforcement pause.
Staged obligations with extraterritorial reach. Prohibitions and transparency duties came into force earlier; the heavier high-risk obligations were deferred.
Duties to label synthetic content or disclose that a person is dealing with a machine — including, in some jurisdictions, in advertising.
Automated decision-making provisions in state privacy law, biometric statutes, and enforcement over AI capability claims.
Copyright in AI outputs, and the training-data litigation whose appellate outcomes will shape client advice for years.
Product-liability and misrepresentation claims involving AI systems, developing case by case rather than by statute.
How to advise in a field this volatile.
Partly to advise, and increasingly because clients treat it as a test of whether the firm is paying attention.
In a single eighteen-month window a comprehensive US state AI act was delayed, judicially stayed, then repealed and replaced before ever taking effect; and a European regime deferred a major tranche of obligations by more than a year while leaving others in force. Any client memo in this area needs a date on its face and a re-check before it is relied on.
Possibly. The regime's reach is drafted to extend beyond providers established in the Union, and commentary has consistently drawn the parallel to the extraterritorial structure of European data protection law. The analysis turns on the client's role — provider, deployer, importer, distributor — and on where output is used, rather than on where the company is incorporated. That threshold question is worth resolving before any substantive compliance work, because getting the role wrong changes which obligations apply and when.
Most of the practical work is inventory before it is compliance: knowing which systems the client uses, whether they influence consequential decisions, and in which states the affected people are. Employment is the cluster to start with, both because obligations have taken effect and because the litigation risk is concrete. Beyond that, note that this area has moved in both directions — obligations have been delayed and narrowed as well as added, and a federal preemption effort has been actively pursued — so a compliance programme built to a single fixed deadline is fragile by construction.
Firms have treated it as both. Directory recognition of AI as a practice area, and named AI practices at large firms, suggest it has become a category rather than a topic. The work being sold is recognisable: governance programmes, policies, risk assessments, vendor contract review, readiness assessments against specific regimes, training, and incident-response planning. Much of it is accessible to smaller firms on a fixed-fee basis because the substrate is repeatable — which is covered in more depth under new service lines.
Less than it appears. This is a field where a large volume of undated, unsourced secondary content circulates, some of it evidently machine-generated, and where genuine primary-source developments are frequently reported inaccurately — wrong effective dates, superseded rule numbers, statutes described as in force when they have been stayed or repealed. The discipline that survives contact with a client is to read the instrument, note its status and date, and record what you could not verify.
Tell the Institute what they are asking. We will help you work out what is actually in scope.