Podcast - Regulating Artificial Intelligence: What It Means for Compliance Management

Anthony DiResta: Welcome to another podcast of Clearly Conspicuous. As we've noted in previous sessions, our goal in these podcasts is to make you succeed in this current regulatory and governmental environment that's quite interestingly aggressive and progressive, make you aware of what's going on with the federal and state consumer protection agencies and give you practical tips for success. It's a privilege to be with you today.

Today we discuss the regulation of artificial intelligence (AI) and what it means for compliance management. Obviously, AI has moved from the innovation lab into the core of how companies operate. Businesses now use AI to screen job applicants, set prices, approve loans, answer customer questions, detect fraud, write marketing copy and make countless other decisions that once required human judgment. That shift brings real value. But it also brings real legal exposure. Regulators and law enforcement officials at both the federal and state levels have made clear that there is no "AI exemption" from existing law. The rules that already govern consumer protection, privacy, civil rights, financial services and securities apply with full force when the decisionmaker is an algorithm. At the same time, new AI-specific laws and guidance continue to emerge, particularly at the state level.

My remarks today are organized in two parts. First, I map the regulatory and legal landscape: what regulators care about and which legal frameworks are in play. Second, I turn to practical compliance and outline what a strong AI compliance management program looks like, with a framework really designed for a chief compliance officer. I'll close with a few thoughts on where things are headed and what companies should be doing now.

What Draws the Attention of the FTC and State Attorneys General

As you know, the Federal Trade Commission, or the FTC, is the primary federal consumer protection agency, and state attorneys general play a parallel role within their own states. Both have signaled that AI is a priority, and their concerns tend to fall into a few recurring categories.

The first is AI-related marketing claims. When a company says its product is "powered by AI," "unbiased," "accurate" or able to do something it cannot actually do, regulators view that as a potential misrepresentation. Overstating what AI can do, sometimes called "AI washing," is a central concern.

The second is harm to consumers from AI-driven decisions. Regulators focus on systems that deny people access to credit, housing, employment, insurance or other important opportunities, especially when the people affected cannot understand or challenge the outcome.

The third is data. AI systems are hungry for data, and regulators are watching how companies collect it, whether they have permission to use it for training models, whether they keep promises made in privacy policies and how they protect sensitive information such as health, biometric, location and children's data.

The fourth is fraud and impersonation. Generative AI, meaning tools that create text, images, audio or video, makes it easier to produce convincing fake reviews, cloned voices and deceptive content. Regulators are very concerned both about companies that misuse these tools and about companies whose products make that misuse very easy.

Finally, there is a growing focus on vulnerable populations, including children, older adults and communities that have historically faced discrimination.

Legal Principles at Play

Section 5 of the FTC Act prohibits "unfair or deceptive acts or practices." These two concepts, along with the related concept of abusive practices found in some consumer laws, provide a useful lens for evaluating almost any AI practice.

A practice is deceptive if it involves a representation or omission that is likely to mislead a reasonable consumer about something that matters to them. In the AI context, think about claims regarding what a tool can do, how accurate it is, whether it was tested for bias, whether a human is involved or how customer data will be used. Deception can also arise from what is left unsaid. If a consumer believes they are chatting with a person but in fact talking with a bot, or if a company quietly changes its terms to allow customer data to be used for AI training, that silence can be misleading.

A practice is unfair if it causes, or is likely to cause, substantial injury to consumers that they cannot reasonably avoid and that is not outweighed by benefits to consumers or competition. This standard does not require any false statement. An AI system that produces discriminatory outcomes, that is deployed without reasonable testing or that relies on data obtained in ways consumers would not expect could all raise unfairness concerns. Importantly, this means a company can face liability for how its AI behaves, not just for what it says about it.

There's yet another concept at play: abuse. A practice is abusive if it materially interferes with a consumer's ability to understand a product, or takes unreasonable advantage of a consumer's lack of understanding, inability to protect their own interests or reasonable reliance on the company. AI systems that are opaque, that steer consumers toward worse outcomes or that exploit behavioral patterns to drive choices, sometimes called "dark patterns," fit squarely within these concerns.

State Laws and Regulations

Every state has its own consumer protection statute, often called a "UDAP" or "UDAAP" law, short for unfair, deceptive or abusive acts or practices. Many of these laws are modeled on the FTC Act, but some even go further. State attorneys general can enforce them directly, and in many states private plaintiffs can bring their own claims, sometimes with statutory damages or attorneys' fees. The practical result is that a single AI practice can draw scrutiny from multiple regulators at once, each applying a slightly different standard.

Now broadly stated here, beyond general consumer protection law, AI touches nearly every area of regulation.

• Privacy: A growing number of states have adopted comprehensive privacy laws.
• Civil Rights: Federal and state laws prohibit discrimination in employment, housing, credit, insurance, education and public accommodations. These laws apply regardless of whether a decision is made by a person or by a model.
• Lending: Lenders using AI in credit decisions must still comply with fair lending laws and provide specific and accurate reasons when they deny credit, even when the underlying model is complex.
• Securities Regulation: For public companies, statements about AI capabilities and AI-related risks in filings, earnings calls and investor presentations must be accurate and complete. Overstating AI use or understating AI risks can create disclosure exposure.

AI also implicates intellectual property, product liability, employment law, antitrust  – including the risk that pricing algorithms facilitate coordination among competitors – and government contracting requirements for companies that sell AI to public agencies.

What This Means for Compliance: A 5-Point Framework

A strong AI compliance management program is not a separate silo. It builds on the compliance infrastructure most companies already have and adapts it to the particular features of AI: rapid change, technical complexity, heavy reliance on vendors and the potential for harm at scale. The best programs share a few characteristics. They are risk-based, meaning they focus the most attention on the uses that matter most. They are documented, so the company can show its work. They are cross-functional. And they living programs that evolve as the technology and the law change.

So for a chief compliance officer, a simple five-stage framework should be considered: inventory, assess, govern, control and monitor. It aligns well with widely used voluntary standards, and it maps neatly onto the elements regulators typically expect in any effective compliance program: leadership commitment, risk assessment, policies and controls, training, monitoring and response.

• Inventory: Know what AI the company uses, builds and buys.
• Assess: Classify each use by risk and identify the legal requirements that apply.
• Govern: Assign clear ownership, decision rights and escalation paths.
• Control: Put policies, testing, vendor terms, training and documentation in place.
• Monitor: Test, audit, respond to incidents and update the program over time.

I plan on publishing a client alert to dig deep into these five frameworks, as well as to talk about governance issues for boards of directors and C-suite executives. So please be on the lookout.

Key Takeaway

If there is one message to take away, it is this: The law of AI is being written in real time. At the federal level, agencies continue to apply long-standing authorities to new technologies while policy priorities shift. At the state level, legislatures and attorneys general are moving quickly, producing new privacy, automated decision-making and AI-specific requirements that do not always align with one another. For companies operating nationally, that patchwork will only grow more complex. In that environment, waiting for regulatory certainty is itself a risk.

Companies that build their AI compliance programs now, grounded in the principles that already apply, will be far better positioned to adapt as new requirements arrive. They should actively monitor legal and regulatory developments, revisit their programs regularly and make sure their boards are informed and engaged. Most importantly, companies should engage experienced legal counsel now, not after a regulator's letter arrives. Counsel can help inventory and classify AI uses, design governance structures, negotiate vendor contracts, conduct privileged risk assessments, prepare boards for their oversight role and anticipate emerging obligations before they take effect. The companies that act today will not only reduce their legal exposure, they will earn the trust of customers, employees, investors and regulators that responsible AI demands.

Again folks, I will soon be publishing a client alert on this topic with much more detail, but let me know if you have any questions. So please stay tuned to further programs as we identify and address the key issues and developments and provide strategies for success. I wish you continued success and a meaningful day. Thank you.