Artificial intelligence has moved from concept to reality almost overnight. From predictive analytics to automated decision-making, AI is transforming how businesses manage risk, monitor regulations and engage with customers.
But this progress introduces new compliance challenges that require vigilance, adaptability and strong governance.
Data privacy is the cornerstone of responsible AI
AI depends on data—vast and often sensitive and personal information. That makes privacy the foundation of responsible AI. Managing consent, data quality and storage has become central to how compliance teams ensure systems meet ethical and regulatory standards.
With no comprehensive federal AI law, U.S. states have stepped in to fill the gap, creating a patchwork of rules that compliance leaders must navigate carefully.
California continues to set the benchmark through the California Consumer Privacy Act and the California Privacy Rights Act. In 2025, the state’s Privacy Protection Agency introduced new rules for Automated Decision-Making Technologies (ADMT). These require businesses to conduct risk assessments for AI used in major decisions, like lending, hiring and healthcare, provide pre-use notices in privacy disclosures and limit profiling in sensitive or high-risk cases.
California is also the only state granting consumers a private right of action, allowing lawsuits for certain privacy violations. Unsurprisingly, this has shifted some of the tech industry’s lobbying focus from Washington to Sacramento, as companies like Meta advocate for balanced innovation and privacy protection.
Other states are following suit.
- Utah now requires disclosure when consumers interact with AI in regulated professions and bans advertising in AI-based mental health chatbots.
- Maryland has created a working group to study private-sector AI use and propose policy standards.
- Kentucky has tasked its Office of Technology with developing AI governance policies.
- Arkansas recognizes ownership rights over generative AI outputs and training data.
Meanwhile, Virginia, Connecticut and Texas have enacted broad privacy laws addressing automated decision-making and sensitive data protections.
This state-by-state evolution has created a complex compliance environment. Key challenges include inconsistent definitions of AI, varying consent standards and differing enforcement thresholds. The result is a regulatory checkerboard that complicates compliance for national organizations.
There’s growing support for a cohesive federal framework to streamline oversight and prevent regulatory fragmentation, especially for smaller firms. Still, most laws focus on high-risk AI uses, such as credit, employment, healthcare or deepfake misuse, while low-risk, efficiency-focused tools remain largely unaffected.
Federal response
As states experiment, the federal government is stepping forward to define national AI governance. In 2025, a series of executive actions signaled a more coordinated approach—balancing innovation, ethics and global competitiveness.
In April, the Office of Management and Budget issued two key memos. M-25-21 accelerates federal AI adoption while emphasizing governance and public trust. M-25-22 simplifies AI procurement, promoting efficiency and accountability in federal systems. Together, they aim to modernize government operations without sacrificing privacy or civil rights.
Then, in July, the White House released the AI Action Plan alongside three executive orders: promoting export of the American AI technology stack, accelerating data center infrastructure permitting and ensuring federal AI use remains unbiased. The plan rests on three pillars:
- Accelerate AI innovation: Reduce regulatory barriers, promote open-source research and fund frontier development.
- Build AI infrastructure: Improve cybersecurity, energy resilience and incident response for AI systems.
- Lead globally: Strengthen U.S. influence in ethical standards, trade and international AI diplomacy.
The plan also calls for updates to the NIST AI Risk Management Framework and the creation of an AI Information Sharing and Analysis Center. These efforts align with the administration’s goal of ensuring AI innovation respects civil rights and consumer protections.
The future of AI regulation
AI regulation is advancing quickly—and not just in the U.S. In 2025 alone, more than 50 AI compliance frameworks emerged worldwide. The European Union’s AI Act is already shaping global standards, and U.S. agencies like the Federal Trade Commission and Consumer Financial Protection Bureau are applying existing consumer and fair-lending laws to AI applications.
Two major trends are defining the next phase of compliance.
First, automated governance is becoming reality. AI-driven RegTech tools are evolving into real-time compliance partners—automatically identifying risk, documenting controls and tracking policy adherence across organizations.
Second, global harmonization is gaining traction. Regulators are working toward shared definitions and accountability frameworks focused on fairness, transparency and explainability. As oversight matures, compliance will increasingly rely on cross-border cooperation and data ethics principles that transcend individual jurisdictions.
To keep pace, organizations must embed responsible AI principles into their operations. This includes developing governance frameworks that clearly define oversight responsibilities, training employees to understand AI risks and ensuring vendors meet the same compliance standards. Companies that align innovation with accountability will be better positioned to thrive in the evolving landscape.
Compliance as a strategic enabler
Responsible AI won’t be achieved through regulation alone. It will require a culture that prioritizes ethics, transparency and accountability at every stage of product development and deployment. By building strong governance systems today, we can ensure that tomorrow’s AI advances are both compliant and credible.
Compliance in the age of AI is no longer about avoiding penalties; it’s about earning confidence, from regulators and consumers alike. The companies that recognize this shift will not only navigate the future more smoothly, they’ll define it.
Geoffrey Litchney is managing regulatory counsel and director of compliance at Dark Matter Technologies. With more than a decade of experience in software-as-a-service compliance within the financial services industry, Litchney specializes in building and scaling compliance management systems. As an expert in federal and state lending regulations, his work focuses on transforming legal, regulatory and privacy requirements into practical, business-ready solutions that responsibly drive innovation.