AI Governance & Regulatory Compliance
Which AI rules reach your product, and what each one actually requires. Mapped to your use case, your customers and the states and countries you sell into.
Colorado, Texas, California, New York and Utah have statutes on the books. New York City regulates hiring tools. The FTC polices AI claims. The EU AI Act reaches anyone selling into Europe. We keep this map current for our clients.
The rules arrived before the federal framework did.
A December 2025 executive order directs the Justice Department to challenge state AI laws it considers inconsistent with national policy. Until a court or Congress acts, those laws remain in force and state attorneys general are enforcing them.
Most startups are not frontier developers. They deploy AI in hiring, lending, customer service, health or education, and those uses are exactly what the state laws target.
Investors and enterprise customers now ask for the documentation these laws require: risk assessments, impact statements, disclosures and governance policies. Having them is a sales asset as much as a legal one.
What the AI statutes carry.
Current figures from state and EU authorities. Each one marks a duty with a date or a dollar amount attached.
New York City requires a bias audit within one year before an automated hiring tool is used and 10 business days’ notice to candidates. Utah requires disclosure when a consumer asks whether they are dealing with generative AI. Texas penalties for curable violations run $10,000 to $12,000, with $2,000 to $40,000 per day for continuing violations. Sources: Texas Attorney General, Consumer AI Rights (TRAIGA); Colorado, SB 26-189 summary; Colorado General Assembly, SB 26-189; NY DFS, Information for Frontier Developers; EU AI Act, Articles 2 and 99; NYC DCWP, Automated Employment Decision Tools; Utah Code § 13-77-103; Executive Order 14365, Federal Register.
What we do on AI compliance.
Applicability analysis
Which laws reach your product, as developer or deployer, by use case and by market. Written so you can hand it to an investor or a customer.
Risk and impact assessments
The assessments Colorado, California and the EU expect, scoped to your system and documented in a form regulators recognize.
Notices and transparency
Consumer disclosures for chatbots and AI interactions, candidate notices for hiring tools, adverse-decision notices and the content provenance rules that are arriving.
Policies and oversight
An AI governance policy, human oversight procedures, incident response for AI failures and vendor requirements, sized for a startup rather than a bank.
Marketing and AI claims review
What you say about accuracy, safety and capability, reviewed against FTC expectations and the state laws on deceptive practices.
EU AI Act readiness
Classification of your system, general-purpose model obligations, transparency duties in force since August 2026, and the high-risk requirements arriving in December 2027.
How an AI compliance engagement runs.
Scoped to the product you ship, not to every statute that exists.
Inventory
Every place AI touches your product and operations, including vendors’ models you build on.
Classify
Each use mapped to the laws that reach it, by role, use case and market, with dates.
Build
Assessments, notices, policies and contract terms drafted and put into the product and the sales process.
Maintain
A calendar of effective dates and a review when the product, the market or the law changes.
We draft it. We also defend it.
Fintech and digital assets since 2017.
Max Dilendorf has advised fintech, payments and digital-asset companies since 2017, through the growth of the sector and the regulation that followed. The questions founders ask today about AI, we have worked through before with crypto.
More than 130 arbitrations since 2019.
Software liability, platform and payment disputes, cybercrime losses and AI-related claims before the AAA, JAMS and NAM, and emergency relief in New York courts. What we learn in those rooms shapes how we draft.
Know which rules reach you before a customer asks.
The questions now come in procurement, not just from regulators.
- List every use of AI in your product and which decisions it influences
- Check whether any customer uses your tool for hiring, lending, housing, insurance, health or education
- Disclose AI interactions where a state requires it, and be ready to answer when a user asks
- Document your training data, testing and known limitations
- Decide who in the company owns AI governance and give them a calendar
- Assume the federal executive order has paused state laws; it has not
- Describe your model as ‘unbiased’ or ‘accurate’ without testing you can show
- Sell a hiring tool into New York City without a bias audit and a notice flow
- Treat EU customers as out of reach for EU law; the AI Act applies to providers wherever they sit
- Let a vendor’s compliance statement stand in for your own assessment
From the firm’s writing.
AI Startup Attorney: Legal Guide for Founders & Seed Funding
The legal questions investors ask AI founders, including governance and data.
Read the articleCyber Breach Lawyer: Board Risks After June 22, 2026
What directors are expected to know about technology risk, and when.
Read the articleAI Cyberattacks and Asset Protection Trusts: Who Bears the Loss?
How AI-enabled attacks shift losses, and what the documents say about it.
Read the articleFrequently asked.
Several do, from the first customer. Texas regulates AI deployment regardless of company size. Colorado’s rules reach any company using AI in consequential decisions from January 1, 2027. New York City’s hiring-tool law applies to any employer using one for City candidates. We map which rules actually touch your product.
A developer builds or substantially modifies an AI system. A deployer uses it to make or support decisions about people. Most state laws put different duties on each. A startup is often both: a developer of its own product and a deployer of the models it builds on.
Yes, if you place an AI system on the EU market or your output is used in the EU, regardless of where the company is based. Transparency duties for chatbots and generated content have applied since August 2, 2026. High-risk obligations for uses such as employment and credit apply from December 2, 2027.
That they are true and substantiated, like any other advertising claim. The FTC has brought cases against companies overstating what their AI could do and has opened an inquiry into companion chatbots. ‘AI-powered’ is not a defense to a deceptive claim.
New York’s law for frontier model developers, which are companies training models above a very high compute threshold. Large frontier developers, with revenues above $500 million, register with the Department of Financial Services and publish safety frameworks. All frontier developers report critical safety incidents within 72 hours. Most startups are not covered, but companies building on frontier models should understand what their providers owe.
Other areas of the practice.
Six services for technology companies, from ongoing counsel to the dispute. Back to the overview.
Not sure which AI rules reach your product?
A confidential consultation to map the laws to your use case and your markets. We will tell you what applies, what is coming and what to document first.