Who Governs AI?

Risk-Based Regulation

The approach, used by the EU AI Act and borrowed by several states, that sorts AI uses by the harm they could do and scales obligations to match. A chatbot that recommends dog food faces disclosure rules; a system that decides who gets a job, a loan, or parole faces documentation, notice, and appeal requirements.

Developer and Deployer

The two roles most AI laws regulate separately. The developer builds or substantially modifies the model, and the deployer uses it to make or support decisions about people. A Florida business that licenses a screening tool is a deployer with its own duties, whatever the vendor promised.

Transparency Obligations

Duties to tell people that they are dealing with a machine, to label synthetic images and audio, and to disclose when an automated system made a decision about them. These are the obligations most likely to apply to a small business first because they attach to ordinary chatbots and marketing content.

Automated Decision-Making Technology

Software that makes or substantially influences a consequential decision about a person, such as hiring, housing, credit, or benefits. Colorado’s 2026 law and the EU’s high-risk category both center on this idea, and they require notice before use and a path to human review after an adverse outcome.

Preemption

The rule that valid federal law displaces conflicting state law. Preemption normally comes from a statute Congress passes, which is why an executive order that calls state AI laws burdensome can direct lawsuits and funding conditions but cannot by itself erase a state statute.

Enforcement Authority

Who can actually bring a case. Most state AI laws give exclusive enforcement to the state attorney general, the FTC polices unfair and deceptive practices under Section 5 regardless of any AI statute, and a few laws create private rights of action that let individuals sue.

Compliance Map

A working document that lists, for each jurisdiction a business touches, which law applies, what it requires, when, and who enforces it. It is the artifact a paralegal or compliance analyst actually produces, and it has to be rebuilt as the laws change.

Part 1: Build the Map

Meet Beacon Pet Supply, a Daytona Beach company that sells online to customers in Florida, Texas, Colorado, and Germany. It has just launched a customer service chatbot on its website and licensed an AI tool that screens job applicants’ résumés and ranks them for interviews. Use the Map Builder to produce a compliance map with one row for each combination of jurisdiction and system: which law applies, what it requires, when it applies, who enforces it, and what the penalty exposure is. Have the AI cite the statute section or article for every requirement it lists. Treat the output as a first draft, because that is what it is.

Part 2: Verify Every Row

Open the statute or regulation for each row in the Resources and check the AI’s claims against the text, using the Statute Verifier to help you find the relevant section and to state plainly what the law does and does not say. Mark each row as confirmed, corrected, or unsupported, and keep a verification log of what you changed and why. Pay special attention to effective dates, because the AI’s training data may predate the delays in Colorado and the EU, and to any claim that federal law preempts a state rule, which you should test with the Preemption Explainer.

Part 3: Write the Memo

Use the Memo Drafter to turn your verified map into a memo of about 400 words to Beacon’s owner. Recommend the two obligations the company should satisfy first, explain why those two, and identify the one entry on the map most likely to change in the next year and what event would change it. Edit the draft so every recommendation traces to a row you verified.

Part 4: Post Your Deliverables

Create a single new discussion thread containing your compliance map as a table, your verification log, and your memo. In the log, state how many rows the AI got right on the first pass and describe the most serious error you found.

Part 5: Share Chat Link

Include one AI chat link with a 1–2 sentence explanation of what the conversation shows and why you chose to share it.

Map Builder

Act as a regulatory compliance analyst who specializes in artificial intelligence law. I will describe a business, the AI systems it uses, and the jurisdictions it operates in. Build a compliance map as a table with one row for each combination of jurisdiction and system. For each row give: the law or regulation that applies, the specific obligations it imposes, the date those obligations apply, who enforces the law and whether individuals can sue, and the penalty exposure. Cite the statute section or article for every obligation so I can verify it. If you are unsure whether a law applies or what it currently requires, say so in the row rather than filling the gap. Ask me to describe the business to begin.

A structured table with citations you can check. The fixed columns keep the AI from wandering into generalities, and requiring a citation and an admission of uncertainty for every row makes Part 2 a verification exercise rather than a rewrite.

Statute Verifier

Act as a legislative research librarian. I will paste a claim from an AI-generated compliance map along with the text of the statute, regulation, or executive order it cites. Tell me whether the text supports the claim, quoting the exact language that does or does not, and note anything material the claim leaves out, such as an effective date, an exemption for small businesses, or a limit on who may enforce the law. If the pasted text does not address the claim at all, say so. Do not rely on your own memory of the law; use only the text I provide.

Grounding the check in the text you supply. Confining the model to the pasted statute turns it into a careful reader rather than a source of new claims, which is the only mode in which its answer is worth trusting.

Preemption Explainer

Act as a constitutional law professor explaining federal preemption to a college student. I am looking at a claim that a federal executive order preempts a state artificial intelligence law. Explain what preemption is, where it comes from, what an executive order can and cannot do to a state statute, and what would have to happen for a state AI law actually to be displaced. Then apply that explanation to the specific claim I paste. Where the answer depends on pending litigation or legislation, say what is pending and that the outcome is unknown rather than predicting it.

Doctrine before application. The prompt makes the model lay out the rule before touching the facts, and the instruction to name what is pending rather than predict it is what keeps a fast-moving question honest.

Memo Drafter

Act as a compliance consultant writing for a small business owner with no legal training. I will paste a verified compliance map for a company that uses a customer chatbot and an AI résumé screener in several jurisdictions. Draft a memo of about 400 words that recommends the two obligations the company should satisfy first, explains why those two matter most, and identifies the one entry most likely to change in the next year and what event would change it. Every recommendation must trace to a row in the map; do not add obligations that are not there. Write in plain language with no legal jargon the owner would need to look up.

Prioritizing from verified inputs. Because the memo can use only rows you confirmed, the drafting step cannot smuggle in new law, and the requirement to pick two obligations forces a judgment about risk rather than a list.