What happens to your AI stack when the compliance rules change every time you cross a state line?
I test tools for a living. I install things, break them, write down what happened, and tell you whether the thing was worth your money. That job used to be mostly technical. Does the API hold up under load? Is the pricing honest? Does the agent actually finish the task or just claim it did? Lately a different question keeps forcing its way into my notes, and it has nothing to do with model quality: am I allowed to use this, and where?
The reporting stacking up right now paints a picture worth paying attention to. Spencer Fane published a piece titled “When the Models Move Faster Than the Rules: Inside America’s AI Policy Crisis.” Tech-insider.org ran a headline that says the situation about as plainly as it can be said: “US AI Policy Crisis: 29 States, No Federal Law.” ChinaTalk asked how AI becomes a political crisis. The Carnegie Endowment published two pieces in the same window, one on building AI infrastructure across allied countries and one laying out three competing views on AI and the future of work.
Five separate outlets, five different framings, one shared premise. Nobody is driving.
Why This Lands on Your Desk, Not a Lawyer’s
Twenty-nine states with their own rules and no federal standard tying them together is not an abstract governance problem. It becomes an engineering problem the moment your product has users in more than one place, which is to say immediately.
Think about what that means for the tools I normally review. An AI hiring screener. A customer support agent that logs conversations. A document analyzer that touches medical records. Any of these can be perfectly legal in one state and a liability in the next. The vendor’s marketing page does not tell you which. The pricing tier does not tell you which. You find out from your legal team, months after you have already built on top of it.
I have started treating this as a product quality signal. When I evaluate a tool now, I look for a few things that used to feel like paperwork:
- Does the vendor publish where data is processed and stored, specifically, not vaguely?
- Is there real audit logging, or just a dashboard with charts?
- Can you turn off training on your data, and is that in writing?
- Does the company say anything at all about state-level compliance, or does it pretend the question does not exist?
Most tools fail at least two of these. The ones that pass tend to be boring, expensive, and built by people who have been sued before.
The Infrastructure Question Nobody Asked You About
Carnegie’s piece on building AI infrastructure across free-world countries is operating at a level most of us never see. Compute agreements, allied coordination, where the chips and data centers physically sit. It reads like foreign policy because it is foreign policy.
But it filters down. Every one of those decisions eventually shows up in your bill and your latency numbers. If compute capacity gets shaped by geopolitics rather than market demand, the cost of the model call you make ten thousand times a day is shaped by geopolitics too. You will not get a memo about it. You will just notice your inference costs moved.
Three Views on Work, Zero Consensus
The other Carnegie piece lays out three competing views on AI and labor. I find that framing more honest than most of what I read. Three views means the smart people disagree, and disagreement at this stage is the accurate state of things.
Which is exactly what makes the policy vacuum so awkward. You cannot write good rules about labor effects when the people who study labor effects cannot agree on what those effects are. So states write rules anyway, each one guessing differently, and you inherit twenty-nine guesses.
What I Would Actually Do
I do not think the answer is to wait. Waiting for federal clarity is a bet on a timeline nobody can see.
What I would do instead is build for portability. Assume the tool you picked this year becomes a compliance problem next year. Keep your prompts, your evaluation sets, and your data pipeline separate from whichever vendor you happen to be calling. Abstraction layers are annoying to build and they will save you when the rules shift.
And be skeptical of any vendor whose pitch treats regulation as someone else’s problem. ChinaTalk’s question about how AI becomes a political crisis is worth sitting with. Tools built as if politics does not exist tend to get expensive fast, and the bill lands on the person who deployed them.
That person is you. Pick accordingly.
đź•’ Published: