In today’s column, I examine an emerging phenomenon that hasn’t been getting much attention but deserves a suitable airing, namely that, with state-level AI laws popping up rapidly and differing mightily, AI makers are faced with a quite challenging problem of how to ensure that their generative AI and large language models (LLMs) are legally compliant with those Byzantine laws.
Here’s the deal. Most of the major AIs are constructed on a one-size-fits-all basis. This generally includes popular LLMs such as OpenAI ChatGPT and GPT-5, Anthropic Claude, Google Gemini, xAI Grok, Microsoft Copilot, and so on. The AI maker makes their AI available to all comers and assumes that a one-size-fits-all can satisfy everyone across the board. People use the AI like it is a massive Swiss Army knife and can do just about anything they want to have done.
Meanwhile, new state-level AI laws are being enacted that restrict how AI is to act when the AI is being utilized by someone in a specific state at hand. For example, California has AI laws that say AI can only do X or Y if being used in California, or cannot do this or that while being used in California, while some other state, such as New York, might indicate that AI can do this or that while being used in New York but cannot do X or Y. It is an entirely messy and widely variable set of legal conditions across the states, and it keeps getting worse as states pass more AI laws and more states opt to start passing their own distinct AI laws. AI makers are getting pinched and having to dance on the head of a pin to keep their AI from veering into untoward legal trouble, forcing them to radically shape or reshape their AI into a formulation that is a jurisdictionally compliant chatbot model.
Let’s talk about it.
This analysis of AI breakthroughs is part of my ongoing Forbes column coverage on the latest in AI, including identifying and explaining various impactful AI complexities (see the link here).
AI And The Law
As a quick background, I’ve been extensively covering and analyzing a myriad of facets regarding the intersection of AI and the law for many years. You can find my writings not only in my Forbes column but also as posted in Bloomberg Law, ABA Law Journal, The National Jurist, The Global Legal Post, Lawyer Monthly, The Legal Technologist, MIT Computational Law Journal, and so on.
There are two major perspectives on the mixture of AI and law:
- (1) Law & AI. The application of laws to the governance and regulation of AI.
- (2) AI & Law. The application of AI to perform legal reasoning.
Thus, you can apply the law to AI, and conversely, you can apply AI to the law. For my big picture overview of both of these exciting and rapidly evolving realms, see my discussion at the link here and the link here.
When it comes to applying the law to AI, the aim is to establish suitable regulations and provide appropriate governance on how AI should be devised and implemented. There are longstanding concerns that AI makers aren’t giving due attention to the ethical ramifications of their wares. Ethical issues are construed as “soft laws” and aren’t as formidable as legally enacted laws, known as “hard laws”. To level the playing field and keep AI makers on the up-and-up, some believe that we need more AI laws.
On the other side of the coin is the application of AI to the law. This consists of using AI to aid legal activities. Lawyers tap into the latest AI to devise legal strategies, brainstorm to find creative legal arguments, draft court filings, and prepare for cases by having the AI pretend to be an able adversary. For my extensive coverage on AI for legal reasoning (AILR), see the link here.
The Current Situation Legally
I’ve been diligently scrutinizing AI laws that are being enacted in the U.S. and throughout the globe, including:
- For my overarching analysis of state-level AI laws (proposed and passed), see the link here.
- For my analysis of the AI laws in Tennessee, see the link here and the link here.
- For my analysis of the AI laws in Illinois, see the link here.
- For my analysis of the AI laws in Utah, see the link here.
- For my analysis of the AI laws in Nevada, see the link here.
- For my analysis of the AI laws in California, see the link here and the link here.
- For my analysis of the AI laws in New York, see the link here.
- For my analysis of AI laws in Colorado, see the link here.
- For my analysis of AI laws in Vermont, see the link here.
- For my analysis of the AI laws in Europe and the EU, see the link here and the link here.
- For my analysis of the AI laws in China, see the link here.
- For my analysis of the AI laws in South Korea, see the link here.
- For my analysis of the AI legal recommendations of the United Nations, see the link here and the link here.
- And so on.
In terms of the AI laws in the United States, they have not yet stood the test of time, meaning that we won’t really know how well they stand up until there are court cases that test these new laws. It is too early to know whether the laws will survive legal battles waged by AI makers and other contenders. Just because AI laws are enacted does not mean they are proper. All sorts of improper provisions and constitutionally contentious stipulations are undoubtedly buried within these shiny new AI laws.
Congress has repeatedly waded into establishing an overarching federal law that would encompass AI. So far, no dice. The efforts have ultimately faded from view. Thus, at this time, there isn’t an overarching federal law devoted to these controversial AI matters. The big question will be to what degree a sweeping federal law would impact the numerous state-level AI laws. The odds are that many of the state-level laws would run afoul of a federal mandate, and a tsunami of legal cases would arise as a tussle between federal law and state law is undertaken. It surely will be a legal mess.
The Big Picture Viewpoint
Here’s my coverage of AI laws on an overarching basis:
- For numerous examples of what makes new AI laws a bad formulation when not crafted properly, see my discussion at the link here.
- For my 30,000-foot-level look at how policies and laws about AI ought to be determined, see my discussion at the link here.
- For the impact of President Trump’s recent Executive Order on the legal landscape of AI and especially regarding state-level AI laws, see my discussion at the link here.
- For the various ways that new AI laws often open fresh opportunities for AI startups that jump on the legally directed bandwagon, see my discussion at the link here.
- For the moves and rumblings of how the FTC seeks to oversee commercial uses of AI, see my discussion at the link here.
- For a heady exploration of how AI laws parlay into the movement toward National AI Sovereignty, see my discussion at the link here.
- Etc.
The crux is that there is intense and pervasive interest in using the law to govern AI. It is an abundantly burgeoning realm. AI companies would be wise to keep a close eye on what is happening in the hallways and byways of regulators and legislative bodies. I have repeatedly noted that a profitable specialty for budding lawyers is to consider concentrating on the exciting and dynamic field of AI and the law; see my predictions and suggestions at the link here.
The Jurisdictional Morass
For a moment, put yourself in the shoes of an AI maker. You have been lucky and fortunate to create a product that can be used by anyone, anywhere on a 24/7 basis. In the use case of the United States, your AI is available in all 50 states, the federal district of Washington, DC, and the five major territories. Things are coming along swimmingly.
The federal government has not yet established a comprehensive AI law that your AI needs to comply with. Instead, on a one-by-one basis, sporadically, each of the fifty states is crafting various new AI laws. Each state is deciding what aspect of AI restrictions is of most interest to it. Some states might coincide, but if so, it is more a matter of coincidence than any grand design. This is leading to vast legal inconsistencies, legal vagaries, legal pitfalls, legal confusion, and a legal quagmire for AI makers and their AI.
Your headache is that your AI is expected to operate only within the state-specific legal stipulations when the AI is being used in any given state. In a broad sense, the AI can mention yellow in one state, or perhaps many states, but cannot do so in some other states. There isn’t a consistency or pattern to this. It is all idiosyncratic to each particular state. On top of that, states are rushing to produce more AI laws. Maybe tomorrow, a state will say that orange cannot be mentioned. And a state that had no restrictions whatsoever ends up passing a new AI law that bans the mention of red, orange, and purple.
As an AI maker, you must keep up with the unrelenting conveyor belt of new AI laws being enacted by fifty differently minded states. Which state lets your AI do this or that? Which state prohibits your AI from doing that or this? There are a lot of gray areas, too. Many of the AI laws are relatively imprecise, and you cannot be certain of what the law is prohibiting. The laws are often written without a grasp of what AI is and how it works.
Difficulties Aplenty
You can likely envision the challenges of the legal landscape governing AI.
Each state does its own thing. The AI law in a state is likely to be poorly specified and be legally ambiguous. States are also amending their AI laws that they previously thought were perfect. Other states that haven’t been enacting AI laws are opting to jump into the waters with both feet. They might borrow wording from other states, change it up, and put it into their legal books.
A twist to this is the nature of the legal ramifications associated with not being compliant. A state might have an AI law that says if an AI maker isn’t compliant, they get nothing more than a stern warning to become compliant. In that same state, a different AI law that the state has passed might indicate that violations of this law will require that an AI maker pay a financial penalty of $10,000 per violation. Suppose that there are 50,000 users in that state, and the AI is violating the law; this would mean that the AI maker is facing a $500 million penalty. Plus, each day that the AI continues to be used, the number gets higher.
I suppose that one smarmy perspective is that this is simply the cost of doing business. AI makers are making lots of dough. Maybe life isn’t as easy as it seems. They merely need to ensure that their AI conforms with the state-specific AI laws. No big deal. Hire a few more AI developers and get the job done. Count your blessings on the way to the bank.
Let’s explore the challenges involved.
Localization Versus Jurisdictional
Astute software makers know that they typically must devise their software to fit the needs of geographical or cultural norms. For example, if your software interacts only in English, this limits where in the world your software can be readily utilized. You might be prudent to ensure that the software interacts in multiple languages.
Other kinds of software localization are common. Besides the language used by the software, there are matters of currencies that the software handles (dollars versus Euros), the units of measurement (inches versus meters), and so on. The gist is that any savvy software maker would certainly know about and ensure that their software is sensibly localized.
Going across jurisdictional boundaries when it comes to legal stipulations is a lot harder than those other forms of localization. Indeed, in the case of AI, things get extraordinarily tougher. Legal jurisdictional shaping and reshaping of AI go much further. It changes how the AI reasons, what it is willing to say, what questions it asks, what warnings it gives, and, in some cases, what answers it refuses to provide, all because the governing AI law differs from one state to another.
How To Attain Jurisdictional Compliance
There are deep ways to attain jurisdictional compliance, and there are surface-level ways to do so. The deeper the approach is, the less likely the AI is to slip up and inadvertently veer from the jurisdictional restriction. The shallower approaches tend to leave the door open to a possible risk that the AI will proceed into a jurisdictionally prohibited or limited provision.
The deeper focus involves revamping these keystones:
- Being more selective about data that is scanned during the initial training of the AI.
- Altering the AI algorithms at their roots to comply with the jurisdictional stipulations.
- Shaping the AI infrastructure to match the jurisdictional aspects.
- Undertaking the RLHF (reinforcement learning with human feedback) based on the jurisdictional constraints.
- Etc.
The shallow approach involves these AI elements:
- Changes to the system prompt.
- Additional policy layers inside the AI.
- Reinforcement learning updates.
- Safety classifiers that are added or changed.
- Retrieval filters configuration or reconfigured.
- Routing to specialized models.
- Post-processing of outputs.
- And so on.
As a rule of thumb, the shallow options are easier to set up, less costly to implement, and can be done on-the-fly as new AI laws get enacted. They allow adjustment to an already underway AI. But they are less rigorous and could expose the AI maker to potential legal liabilities. For the deeper approaches, those are not especially nimble and rely on knowing beforehand what AI laws require. It is difficult to guess what might be coming down the pike.
The Compliance Engineering Challenge
An AI maker that keeps aiming at the classic one-size-fits-all model is going to eventually be laden with an LLM that is as grotesquely patchworked as the myriad states’ AI laws. The AI will resemble a contraption that has become a Frankenstein of disparate parts, cobbled together to try to meet varying jurisdictional requirements. It won’t be pretty. Worse still, it might not work as intended.
If you count up the currently known state AI laws and their voluminous provisions, there are thousands of behavioral stipulations associated with what AI is legally allowed to do and legally prohibited from doing. Yet we are only at the start of the legal AI tsunami. The one thing you can bet on in life is that there will be a lot more AI laws and a lot more legal provisions to be heeded.
Some AI makers are hoping that a nationwide harmonization of AI laws might be on the horizon. Sorry to say, this seems far-fetched and dreamy. Even if Congress were to pass a comprehensive federal AI law, there is still likely to be ample room for states to diverge and have their own idiosyncratic AI legal provisions. Do not for a moment assume that a magic wand is going to fix this.
The World We Are In
In my view, the realistic option is to assume at the get-go that deeper approaches to devising AI are going to be required. The shallow band-aids won’t be sufficient. A crucial consideration is that the base design of foundational AI models will need to incorporate jurisdictional compliance at its core. This needs to be flexible enough to accommodate the state-by-state differences, along with a future federal comprehensive AI law.
Furthermore, other countries are equally pressing ahead with AI laws, too. Thus, the overarching engineering must not only encompass the US compliance provisions but also be shaped to accommodate AI laws throughout the globe. An AI maker will be on the hook to ascertain the location of the user, the governing jurisdiction, the applicable legal requirements, and to perform the appropriate AI behavioral policies and actions.
The Law Is The Law
Jurisdictional model tuning is likely to become a defining characteristic for AI.
The significance of this development extends beyond compliance costs. It means that AI systems will no longer be singular products with uniform behavior. Instead, they will become collections of legally differentiated behavioral variants that share a common interface but operate under different rules depending on where the user is located. This will foster a world in which two people using what appears to be the same AI receive materially different experiences, not because of different prompts or preferences, but because the law has quietly shaped the AI behind the screen.
As Thomas Hobbes famously said: “The law is the public conscience.” AI is going to transform from the Wild West to a lawful expression of the public conscience, though it won’t be a smooth ride to get there.
