Editor's note — September 12, 2026: Removed unsupported bill counts and blanket claims of present non-compliance, automatic injunctions and obligations in dozens of jurisdictions. This is an operating recommendation, not individualized legal advice.
The take
AI-related requirements differ by jurisdiction, system use, organization and effective date. A count of introduced bills does not establish enforceable obligations.
For example, the California Privacy Protection Agency publishes the adopted text and rulemaking record for its automated decisionmaking, risk-assessment and cybersecurity-audit regulations. An applicability review must use the adopted provisions and their relevant compliance dates, not a summary of proposals.
My operating recommendation
Maintain a system inventory linked to the jurisdictions and decisions it affects. Ask counsel to identify the actual requirements, thresholds, exceptions and dates. Give engineering a versioned requirement for notices, explanations, review and records wherever those obligations apply.
Human involvement is a fact to evaluate under the relevant rule, not a universal exemption. Neither the presence of an algorithm nor a customer's state alone establishes that every requirement applies. The board should ask for the documented assessment and unresolved questions.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.