How Federal Deregulation Isn't Making AI Compliance Easier—Just Harder To Navigate
David Talby, PhD, MBA, CEO at John Snow Labs. Solving real-world problems in healthcare, life sciences and related fields with AI.
gettyIn the US, conversations about AI regulation in 2026 have focused largely on deregulation. The White House has challenged state-level restrictions, federal agencies have withdrawn AI guidance and policymakers have proposed reducing certain technology requirements. But for companies actually deploying AI, that’s only part of the story.
The library of global AI-related laws, regulations, standards and frameworks grew from around 250 instruments in March to 619 in September. More than 200 come from US states alone. For technology leaders, it’s not about whether Washington is regulating more or less. It’s what rules apply to the AI systems we operate, and how we can prove those systems comply.
Federal policy has shifted. In December 2025, Executive Order 14365 directed the Justice Department to challenge state AI laws the administration considers inconsistent with federal policy. Federal agencies have also withdrawn guidance concerning AI in areas such as employment and credit. But withdrawing guidance doesn’t repeal the underlying statutes, and state legislatures continue to act.
These state laws cover issues ranging from deepfakes and election advertising to privacy, healthcare, employment and automated decision-making. The intent behind them is positive. But the result is an increasingly fragmented compliance environment.
For companies operating nationwide, a state law rarely stays neatly contained within the state’s borders. Texas and California, for example, both brought major AI legislation into effect in 2026. Colorado replaced its original AI Act with a new automated decision-making law. Several states have also enacted requirements governing conversational AI.
Companies could theoretically maintain different AI behavior for every jurisdiction. In practice, many will find it simpler to engineer systems around the strictest requirements that affect a meaningful share of their users. That makes state legislation important even without federal preemption. A requirement adopted by several large markets can effectively influence product design nationwide.
The most consequential regulatory change is not simply the number of laws but what some of them require AI systems to do. Consider conversational AI—Oregon has enacted requirements for AI companion operators to maintain protocols for detecting suicidal ideation or self-harm and providing crisis resources. Colorado has adopted similar requirements for conversational AI services.
For engineering teams, that creates a concrete question: Does the system respond correctly when a user expresses suicidal intent? Answering it requires testing multiple direct, indirect and adversarial formulations, and then repeating those tests as models, prompts and surrounding applications change.
Healthcare provides another example. California requires certain AI-generated communications involving patient clinical information to disclose the use of generative AI and provide clear instructions for contacting a human healthcare provider. As such, compliance can’t simply live in a policy document. Teams need to verify that required disclosures and escalation paths actually appear in the product.
The same principle applies to discrimination. When AI contributes to consequential decisions involving employment, lending, healthcare or other sensitive areas, organizations increasingly need processes to identify risks, evaluate outcomes and respond when systems change.
This shift changes what AI governance programs need to accomplish. First, organizations must maintain inventory of applicable requirements organized by jurisdiction and use case.
Second, those requirements should be translated into concrete controls: disclosures, prohibited behaviors, escalation rules and documentation requirements.
Third, every AI system needs a repeatable risk assessment tied to those controls.
Fourth, teams need release testing that verifies required behavior before deployment.
Finally, they need production monitoring for drift, failures and incidents.
Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 can provide structure for this process. But a framework cannot determine every law that applies to a particular system or automatically translate those laws into test cases. That operational layer is becoming the difficult part.
A central committee can review a handful of AI systems manually. That approach becomes difficult to sustain when an organization operates dozens or hundreds of systems across jurisdictions and the applicable rules keep changing. The scalable model is a continuous loop that involves tracking requirements, mapping them to systems, translating them into controls, testing those controls and monitoring them in production.
At the federal level, there are meaningful deregulatory signals. But technology leaders should not mistake that for a shrinking compliance burden. For deployed AI, the rulebook is becoming larger, harder to keep up with and more operational. Increasingly, compliance will not be demonstrated by what an organization says its AI should do, but instead, by what the system actually does in production.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
