The Myth of the Single American Framework

When the conceptual comfort of international standards gives way to the operational reality of commercial deployment, the idea of a single American approach to artificial intelligence regulation dissolves on contact. In the absence of a horizontal federal AI Act, authority over deployed systems is exercised by sector-specific agencies, each of which has spent decades constructing its own statutory boundaries, testing its own enforcement theories, and codifying its own technical expectations for the industry it oversees.

The sharpest division in contemporary sectoral AI governance is found between consumer financial services and healthcare technology. That division was once described as a contest between an aggressive enforcer and a collaborative one, and the description no longer holds. What the past 14 months have revealed is a deeper and more instructive contrast between an obligation anchored in statute, which has survived the retreat of its own federal enforcer, and a flexibility regime anchored in guidance, which depends for its operation on an agency that remains engaged.

For compliance officers and cross-sector investors, the practical consequence is a cognitive pivot of an unusual kind. The credit regime demands that models remain explainable at the level of the individual decision, and that demand is now enforced from many directions at once rather than from a single bureau in Washington. The medical device regime authorises models to change in production, and that permission is conditioned on an architecture of pre-authorised boundaries which took its final shape between December 2024 and February 2026.

The Obligation That Survived Its Enforcer

The regulatory baseline of the American credit market is set by the Equal Credit Opportunity Act and its implementing framework, Regulation B. A creditor taking adverse action against an applicant, whether by denying a mortgage, reducing a credit line, or raising a rate, is placed under a statutory duty to provide the specific principal reasons for that decision. The purpose of the notice is threefold: transparency is preserved, discrimination is exposed to detection, and the citizen is equipped to contest erroneous data.

As underwriting infrastructure moved from rule-based scorecards to deep learning platforms, a corporate defence emerged in supervisory examinations to the effect that models evaluating thousands of non-linear variables could not yield discrete reasons for an individual denial. The Consumer Financial Protection Bureau rejected that defence in two instruments. Circular 2022-03 confirmed that the notice requirements of the Act apply to every credit decision regardless of the technology used to make it, and that the complexity of a model affords no shelter from them. Circular 2023-03 went further and confirmed that the sample checklist reasons provided in Regulation B cannot be relied upon where they fail to reflect the actual principal reasons produced by the model, so that a lender scoring applicants on behavioural or non-traditional data is required to name the specific conduct that drove the outcome.

On 12 May 2025 both circulars were withdrawn, alongside 65 other guidance documents, in a single Federal Register notice which described the withdrawal as not final and stated that the withdrawn guidance would not be enforced whilst a further review is completed. The stated purpose of the Bureau was the reduction of compliance burdens and of enforcement overlap with state regulators. A reader who stopped at the withdrawal notice might conclude that the explainability demand died with the circulars, and that conclusion would be a serious analytical error.

The duty to provide specific reasons was never a creature of the circulars. It resides in the text of the Act and of Regulation B, and it is enforceable through a private right of action which carries actual and punitive damages, through class litigation, and through state authorities acting under their own credit statutes and under the state enforcement provisions of the Consumer Financial Protection Act. The circulars were interpretations of an obligation rather than the source of it, and an interpretation can be withdrawn whilst the obligation stands untouched. What changed in May 2025 was not the law but the topology of its enforcement, in which the risk has migrated from a single supervisory examiner, whose priorities could be read and anticipated, to a distributed field of state regulators and private plaintiffs whose theories of liability cannot be withdrawn by notice.

The operational conclusion for the credit sector is unchanged in substance and sharpened in character. A model that cannot generate specific, accurate, and individualised principal reasons for an adverse action remains non-compliant as a matter of law, whatever its statistical performance, and the absence of federal supervisory attention offers no comfort to an institution whose adverse action file will one day be read to a jury.

The distinction between a statutory obligation that outlives its enforcer and a guidance regime that depends on an engaged agency is the organising argument of AI Without an AI Act, whose treatment of sectoral governance beyond the reach of any federal statute is drawn on throughout this edition.

The sections that follow cross to the opposite bank of the river, where the FDA has completed the change control architecture that authorises adaptive medical AI to change in production, and where the statutory foundation of Section 515C of the FD&C Act, the 3 structural pillars every Predetermined Change Control Plan must contain, the international principles and quality system rules that took effect this year, and the cross-sector reference matrix are set out for the enterprise that must satisfy both regimes at once.

Read more

The Deep Dive on the Federal Retreat and the New Centre of Gravity in Employment AI Liability

In the governance of American artificial intelligence, no domain has been subjected to the concentration of litigation, legislative attention, and class-action exposure that has been visited upon the modern workplace. Whilst foundation model developers contest abstract questions of future risk before Congress and the appellate courts, the enterprise employer that deploys an algorithmic system to screen a résumé, grade a video interview, rank the productivity of a workforce, or recommend a termination has stepped into the oldest and most developed body of anti-discrimination law in the country, and the collision between that body of law and automated decision-making has become the definitive test of how the United States governs artificial intelligence in the absence of an omnibus AI Act.

The account of that collision which circulated in 2023, in which an assertive federal civil rights apparatus stood ready to police algorithmic hiring, no longer describes the world in which compliance officers operate. The enforcement architecture has been inverted. In January 2025, in the wake of the executive order titled Removing Barriers to American Leadership in Artificial Intelligence, the Equal Employment Opportunity Commission removed its artificial intelligence guidance from its website, including the May 2023 technical assistance document on algorithmic adverse impact under Title VII and the May 2022 technical assistance document on disability screen-outs under the Americans with Disabilities Act, and the pages of its Artificial Intelligence and Algorithmic Fairness Initiative have remained dark ever since. Executive Order 14281, signed in April 2025 under the title Restoring Equality of Opportunity and Meritocracy, directed federal agencies to deprioritise disparate-impact liability in all contexts to the maximum degree possible, and the Commission moved to close pending charges that rested on disparate impact alone. The direction of travel was confirmed on 9 June 2026, when the Department of Justice issued an Office of Legal Counsel opinion concluding that the Commission’s disparate-impact guidelines under Title VII, including the Uniform Guidelines on Employee Selection Procedures, are unconstitutional, an analysis which the Commission’s chair welcomed in a public statement.

What the federal retreat has not done deserves equal attention, because the distinction between guidance and statute is where the whole compliance question is decided. Title VII of the Civil Rights Act, the Americans with Disabilities Act, and the Age Discrimination in Employment Act remain in force, and the disparate-impact cause of action under Title VII was codified by Congress itself in the Civil Rights Act of 1991, which placed the doctrine of Griggs v. Duke Power beyond the reach of any executive opinion. The Uniform Guidelines remain codified at 29 C.F.R. Part 1607. An Office of Legal Counsel opinion binds the executive branch, not the federal judiciary, and private plaintiffs may plead disparate impact under existing case law without any assistance from the Commission. The withdrawal of guidance has therefore removed safe harbours rather than obligations. The good-faith reliance defence under section 713(b)(1) of Title VII, which protected an employer that followed written Commission guidance, loses its value when the guidance is withdrawn, and the employer is left facing the same statutes with less official interpretation to rely upon. A retreat of this kind raises uncertainty for the enterprise; it does not lower exposure.

Into the vacuum left by the federal government have moved the state legislatures and the plaintiffs’ bar. Illinois House Bill 3773 amended the Illinois Human Rights Act with effect from 1 January 2026 to prohibit the discriminatory use of artificial intelligence in employment decisions and to require notice to affected workers. The Colorado Artificial Intelligence Act, Senate Bill 24-205, took effect on 30 June 2026 and imposes a duty of reasonable care on both developers and deployers of high-risk systems, together with impact assessment and disclosure obligations. New York City Local Law 144 continues to require independent bias audits of automated employment decision tools, and the New Jersey Division on Civil Rights has adopted rules preserving disparate-impact claims under the Law Against Discrimination. The pattern will be familiar to readers of the earlier edition of this newsletter on the federal-state regulatory conflict. The federal government has withdrawn from disparate impact at the same moment the states have begun to codify it, and an employer whose applicant pool crosses state lines must build to the strictest standard in the stack. The centre of gravity in workplace AI governance has migrated from the regulator to the courtroom and the statehouse, and the two cases examined in this edition show what that migration means in practice.

Enforcement Spotlight on iTutorGroup and the Floor Beneath the Federal Retreat

The high-water mark of the federal era was reached through the Commission’s Artificial Intelligence and Algorithmic Fairness Initiative, launched in 2021 to apply the historic anti-discrimination mandates to automated tools, and its proof of enforcement concept was delivered in EEOC v. iTutorGroup, Inc. in the Eastern District of New York. The facts required no expert testimony. A provider of remote English-language tutoring services had programmed its online recruitment software to reject female applicants aged fifty-five or older and male applicants aged sixty or older, screening out more than two hundred qualified candidates. The mechanism was exposed when an applicant submitted two identical résumés that differed in the date of birth alone; the genuine, older profile received an automated rejection, whilst the fabricated, younger profile was invited to interview. The consent decree approved by the court in 2023 required the company to pay 365,000 dollars to the rejected applicants and imposed injunctive relief, including a prohibition on requesting dates of birth before an offer is made, mandatory anti-discrimination training, and reporting obligations to the Commission.

Commentators at the time dismissed the case as a hardcoded database filter rather than machine learning, and in doing so they missed the point that gives the case its continuing force. The liability in iTutorGroup arose from the Age Discrimination in Employment Act, not from any guidance document, and the lesson that technology-enabled discrimination is an executive liability regardless of system complexity survives the withdrawal of every page the Commission has taken down. Whether the instrument is a keyword rule or a generative scoring engine, the automation of a workflow confers no immunity on the employer, and the same conduct today would face a private collective action and state statutory claims even where the Commission declines to act. The floor established in iTutorGroup has not been lifted by the change in federal posture. It has been transferred into different hands, and the full edition follows those hands into Mobley v. Workday, where the most consequential piece of employment technology litigation in the United States is rewriting vendor liability ruling by ruling, and where the discovery record shows how a board can shield its own bias testing under privilege.

The full edition sets out the complete legal analysis of Mobley v. Workday, from the agent theory and the nationwide collective through the rulings of March and June 2026 that extended Californian law to applicants across the country, together with the May 2026 discovery order that shows how bias-testing evidence can be shielded under privilege, and the employment AI governance and discovery matrix used with enterprise clients.

The arguments in this edition are developed at book length in AI Without an AI Act: A Practitioner’s Guide to United States Artificial Intelligence Governance, available on Amazon.

Read more

The Distributed Fracturing of American AI Policy

The foundational reality of contemporary American artificial intelligence policy is structural fragmentation. The absence of a comprehensive federal AI Act is misread by international observers as evidence of an unregulated domestic market. The domestic truth is different. The United States has produced a demanding, distributed architecture of technology governance, built upon the widening gap between federal deregulatory prioritisation and aggressive state-level statutory intervention.

This friction is not an administrative accident. It is the structural consequence of American federalism operating in a legislative vacuum. The executive branch has pursued an explicit programme of innovation acceleration, domestic computing infrastructure expansion, and international containment. That doctrine, visible in the revocation of earlier safety mandates and the implementation of America’s AI Action Plan, seeks to strip away ex-ante regulatory friction in the service of geopolitical advantage over strategic rivals.

The states, however, retain broad historical police powers under the Tenth Amendment to legislate for the health, safety, morals, and general welfare of their citizens. In the absence of a unified federal standard that occupies the field, the policy void has been filled by state capitals at speed. The result is a multi-jurisdictional web of conflicting mandates, varying risk definitions, and localised liability exposures. The federal government has chosen to rely on market freedom and targeted enforcement under existing law, whilst rigid risk-based obligations are constructed by the states. For technology deployers and enterprise compliance officers, this divergence means compliance is no longer a centralised design exercise. It has become a continuous, high-stakes contest fought across a fragmented legal map.

The two positions can be stated in plain terms. Washington prioritises global competitiveness, revokes ex-ante safety checks, adjusts behaviour through procurement rather than mandate, and reserves hard rules for national security. The states exercise sovereign police powers, impose local mandates and audit duties, codify anti-discrimination obligations, and produce a mosaic of fragmented statutes. Everything that follows in this edition is downstream of that tension.

The Death of the Federal Moratorium

To understand how entrenched this federal-state conflict has become, one must examine the legislative battle over the budget reconciliation measure signed into law as the One Big Beautiful Bill Act.

As passed by the House of Representatives, the bill contained a sweeping provision designed to clear the board of state technology regulation in a single stroke. Drafted as an exercise of express federal preemption, the text mandated a ten-year moratorium prohibiting any state or political subdivision from enacting or enforcing any law that targeted artificial intelligence models, systems, or automated decision tools. The strategic objective was plain. The deployment velocity of American AI developers was to be protected from a patchwork of fifty differing local regimes. The freeze was backed by venture capital and the major technology lobbies, which warned that localised compliance friction would handicap American innovation.

When the reconciliation measure moved to the Senate, fierce bipartisan resistance was triggered among state governors, state attorneys general, and consumer advocacy organisations defending traditional state sovereignty. In an intense effort to salvage the administration’s deregulatory priority, a series of high-profile compromises was attempted by Senators Marsha Blackburn and Ted Cruz. The moratorium was to be shortened from ten years to five, and the freeze conditioned on state allocations of Broadband Equity, Access, and Deployment (BEAD) funding. A carve-out for generally applicable state laws was drafted to preserve local controls over online child safety, deceptive trade practices, and non-consensual digital replicas. The compromise text, however, introduced serious legal ambiguity. Such state laws could remain operative only if they did not impose an undue or disproportionate burden on AI systems, a standard that critics argued would generate decades of corporate litigation over what constitutes an undue burden.

The breaking point arrived when Senator Blackburn withdrew her support from her own compromise and delivered a sharp public rebuke. The moratorium, she warned, had become unacceptable to the constituencies most in need of protection. Children, creative artists, and conservative users would be left exposed to algorithmic exploitation by large platforms if state protections were frozen. On 1 July 2025, the AI moratorium provisions were stripped from the One Big Beautiful Bill Act by a Senate vote of 99-1. The vote crossed every ideological and partisan line, uniting the most progressive regulators with the most committed states’-rights conservatives. The legislative message was unmistakable. Congress will not permit the wholesale erasure of state police powers to create a national regulatory vacuum, even under the banner of international competitive urgency.

The destruction of the moratorium validated the permanence of the state legislative surge. Businesses operating across state lines should abandon any lingering expectation of near-term legislative preemption relief and adapt to a multi-state enforcement reality.

Readers who want the whole constitutional architecture behind this edition will find it in my forthcoming book, AI Without an AI Act, out on 19 August 2026.

The legislative door to federal preemption has been closed by Congress. A new front has been opened by the executive branch in the federal courtrooms. The full edition continues with the litigation breakdown of X.AI LLC v. Weiser, the case now testing the outer limits of state AI control, what has become of the Colorado AI Act since the complaint was filed, and the compliance mapping matrix built for board papers and risk registers. If your organisation carries obligations under any of these statutes, the second half of this edition was written for you.

Read more

Why voluntary AI frameworks are becoming the most dangerous evidence in American courtrooms

The prevailing compliance narrative in American boardrooms holds that, in the absence of a federal AI Act, alignment with the National Institute of Standards and Technology is a matter of preference. NIST holds no enforcement authority, issues no penalties, and conducts no inspections, so the reasoning goes that its AI Risk Management Framework can be adopted when convenient and set aside when budgets tighten. That reasoning contains a fatal legal blind spot.

Voluntary standards in the United States do not stay voluntary. They crystallise. Federal agencies reference them in procurement conditions and enforcement guidance, insurers write them into coverage eligibility, and enterprise buyers embed them in vendor contracts. By the time a framework has passed through those three channels, it has acquired the practical force of regulation without a single statute being passed.

The sharpest teeth, however, belong to the courtroom. When an AI deployment causes harm and the matter reaches a jury, the court requires an objective baseline against which reasonable care can be measured. American negligence doctrine has performed this translation for a century, converting industry consensus standards into the legal standard of care, and the AI RMF is now the most credible, most stakeholder-inclusive candidate in the country for that role. It was built through an open process with more than two hundred contributing organisations, which is precisely the pedigree courts look for. An organisation that cannot demonstrate its runtime practices aligned with the framework has, in effect, handed plaintiffs’ counsel the opening chapter of a negligence case before discovery has begun.

The institution behind the framework has meanwhile been remade. Under Executive Order 14110, the Biden administration established the US AI Safety Institute within NIST to run hands-on evaluations of frontier models, develop technical testing methodologies, and coordinate safety work with allied nations. Executive Order 14148 revoked that mandate within hours of the change of administration, and the institute was subsequently restructured as the Center for AI Standards and Innovation, its remit pivoting from safety evaluation towards industrial competitiveness, technical measurement, and the security of American models. The administration went further and directed NIST to strip references to diversity, equity, and inclusion from the framework itself, treating those parameters as ideological rather than technical. That revision of the AI RMF is in progress now.

Here is where the schism opens, and it is the single most dangerous development in this story for any enterprise counsel reading the federal text at face value. Washington may remove discrimination parameters from the framework, but state regulators and plaintiffs’ attorneys have not followed. Texas has enforced its Responsible AI Governance Act since January, Colorado’s replacement statute carries transparency duties with compliance arriving in 2027, and disparate impact theories remain fully available in civil rights litigation regardless of what the revised federal document says. An organisation that calibrates its governance programme solely to the post-revision RMF is building to the floor of one sovereign whilst standing in the jurisdiction of fifty others. The federal framework defines the baseline of reasonable care, but the states define where liability lands, and the gap between the two is where enterprises will be sued.

Knowing the framework exists is not the same as knowing how it behaves under cross-examination.

Secure Your Copy

The full doctrinal analysis of how voluntary standards crystallise into the legal standard of care, and how the NIST ecosystem interlocks with state statutes and federal enforcement, appears in AI Without an AI Act: A Practitioner’s Guide to United States Artificial Intelligence Governance (First Edition), releasing 19 August 2026. Pre-orders are open now.

The remainder of this edition moves from the framework on paper to the framework in the witness box. It takes each of the four core functions, Govern, Map, Measure, and Manage, and sets out the operational evidence regulators and plaintiffs’ counsel demand under each when something goes wrong. It then turns to the Generative AI Profile and its twelve risk dimensions, grouped into the three enterprise threats corporate risk officers must now track, before addressing the question multinational readers raise most often: how NIST alignment is reconciled with ISO/IEC 42001 certification when one framework must satisfy an American jury and the other an EU auditor. The edition closes with the Operational Evidence Matrix, a single reference table mapping each NIST function to the runtime evidence standard and the enforcement exposure attached to it.

Read more

Nobody asked me to write a treaty. No institution commissioned it, no organisation funded it, and no committee reviewed it. I wrote it anyway, over months of evenings and weekends here in Melbourne, and this edition is my attempt to explain why an independent researcher would do something so presumptuous, and why I believe the year on the calendar left …

Read more

Whilst Congress remains structurally incapable of passing an omnibus AI statute, the federal government has been reshaping the private technology market through the one instrument that requires no new legislation at all: its own wallet. The United States government is the largest single buyer of goods and services on earth, spending in excess of $700 billion each year. A buyer of that scale does not need to mandate corporate behaviour by law. It changes the conditions of market access, and the market reorganises itself around them.

That figure deserves a moment of context. Federal procurement spend eclipses the annual venture capital deployment of the entire American technology sector. It is not a lever so much as a gravity well. Any company whose products sit anywhere near a federal contract, whether as prime, subcontractor, model provider or infrastructure host, is already inside its pull, whether or not a single line of federal money appears on its own books.

The legal distinction that makes this possible is examined at length in Chapter 7 of AI Without an AI Act, and it is worth setting out here. When the government imposes conditions through procurement, it is not acting in its sovereign capacity as a regulator. It is acting in its proprietary capacity as a buyer. That distinction matters because the constitutional and administrative constraints that have hollowed out so much federal rulemaking, the Major Questions Doctrine chief among them, bite far less when the state is spending its own money rather than commanding private conduct. A rule that would be struck down as agency overreach if issued as regulation can survive as a condition of contract. The government cannot tell a software company how to build its systems. It can, without difficulty, decline to buy systems built any other way.

The result is a body of binding technical and governance requirements that most commercial developers have never read, issued through instruments most of them could not name, and enforced through the oldest mechanism in commerce: the terms of the purchase order.

The Twin Memoranda

The instruments doing the work are a pair of memoranda issued by the Office of Management and Budget to the heads of executive departments and agencies: M-25-21 and M-25-22. Neither passed through Congress, and neither was subject to the notice and comment discipline of ordinary rulemaking. Both now shape what commercial AI developers must build if they want their products anywhere near the federal market.

M-25-21 governs adoption and internal governance. It directs agencies to accelerate the use of AI across government whilst holding that use to structured risk management. Its most consequential requirement for vendors sits in its treatment of high impact systems: any AI that influences consequential decisions about individuals, their benefits, their liberty or their access to services, must operate under documented human oversight mechanisms, with the ability to intervene and to appeal. Agencies must also maintain public use case inventories, which means the deployment of a commercial product inside government is not a private commercial fact but a published one. A vendor’s system, once adopted, becomes visible, categorised and accountable in a way no enterprise sale ever makes it.

M-25-22 is the memorandum that reaches furthest into the commercial supply chain, because it governs acquisition itself. It instructs agencies to structure their AI purchasing around vendor competition and to guard against proprietary lock-in, which translates into demands for portability, open interfaces and the ability to switch models without rebuilding the estate around them. It requires evaluation of total cost of ownership rather than sticker price, pulling ongoing monitoring, retraining and decommissioning costs into the procurement calculus. And it carries the administration’s preference for American made AI, a sourcing condition that obliges vendors to know, and to evidence, where their systems and the components beneath them come from.

Read together, the two memoranda form a complete governance loop. One disciplines how agencies use AI, the other disciplines how they buy it, and the conditions of both fall on the seller. None of it is regulation in the formal sense. All of it is binding on any company that wants access to the largest technology buyer in the world.

Secure Your Copy

The proprietary capacity distinction, the procurement architecture and the supply chain mechanics in this edition are drawn from Chapter 7 of AI Without an AI Act: A Practitioner’s Guide to United States Artificial Intelligence Governance, releasing 19 August 2026. The book maps the full six layer structure through which the United States governs AI without an omnibus statute.

Pre-order on Amazon

The commercial illusion is that if you do not sell to the federal government, none of this applies to you. That assumption is a compliance blind spot, and the rest of this edition dismantles it.

• How FedRAMP turned baseline cloud security into a condition of commercial viability in 2011, and how the same method is now being applied to AI through M-25-22 and CISA’s Secure by Design guidelines

• The personal attestation problem: why executives are being asked to sign their names to the integrity of AI training pipelines, and what that does to the standard of care

• The contractual cascade: how a single prime contract binds every subcontractor, data supplier and foundation model provider beneath it to the same technical baselines

• Why it is financially ruinous to run one governed pipeline for the federal market and another for everyone else, and why federal procurement standards therefore become the commercial default

• The reference matrix: five federal procurement mandates mapped to their downstream engineering impacts, from portability architecture to flow-down indemnification clauses

The lever is above. The mechanics of how it reaches you are below.

Read more

Ask most teams to name the riskiest behaviour in a deployed model and they will point to the obvious culprits, the confident fabrication, the unsafe instruction, the biased decision that surfaces in an audit. These are the failures that get caught, because they are the failures that look like failures.

The behaviour that should worry them more is the one their users rate most highly.

A model that agrees, validates and reassures is a model that people enjoy using. It feels helpful, it feels warm. It scores well on satisfaction, and it keeps people coming back. None of that makes it correct, and in the settings where correctness matters most, the agreement is the problem rather than the service.

This behaviour has a name, sycophancy, and it is usually handled as a matter of tone. Something to be softened in a style guide or smoothed over in a system prompt. That framing is the first mistake. When a model adapts its answer to please the user rather than to serve the evidence, the law, the safety context or the task, it is not being courteous. It is failing at the one thing an assurance function exists to protect, which is the integrity of the judgement the model produces.

Treated as a personality trait, sycophancy stays invisible to governance. Treated as a named risk, it can be defined, tested, monitored and written into procurement. The rest of this edition sets out how.

Sycophancy is not one thing

The instinct, once sycophancy is named as a risk, is to look for the switch that turns it off. There is no switch, because there is no single behaviour. Sycophancy is a family of behaviours, and the members of that family are caught by different tests, demand different controls and carry very different consequences. A model can be cured of one and remain fluent in the rest.

It helps to separate them along two lines.

The first line is what the model is deferring to. In some cases it defers to the user’s position, the claim being made, the answer being proposed, the belief being asserted. In others it defers to the user as a person, flattering their judgement, soothing their feelings, protecting their self image. Deferring to a position distorts the answer. Deferring to the person distorts the relationship, and the second is the harder of the two to see.

The second line is how the deference is expressed. Sometimes it is explicit. The model states that the user is right when the user is not, or praises work that does not merit it. Sometimes it is implicit, and this is where most of the damage is done. The model never says you are right. It simply frames the situation in the user’s favour, omits the counterargument, softens the correction until it carries no weight, or declines to challenge a premise it should have challenged. Nothing in the text looks like flattery. The effect is the same.

Put those two lines together and four kinds of sycophancy appear. Explicit agreement with a stated position. Implicit framing that quietly takes the user’s side. Open praise of the person. And the quietest of the four, the softened critique and the withheld correction that leave the user feeling validated without a single word of validation being spoken.

Almost all of the attention, in research and in practice, has gone to the first kind. It is the easiest to detect, because it can be checked against a verifiable answer. Ask a model a factual question, feed it a false claim, and measure whether it capitulates. That test is real and worth running. It is also a test of the least dangerous quadrant, the one where a wrong answer can at least be looked up and corrected.

The behaviours that shape judgement over time are person directed and implicit, and these are the ones governance tends to miss. When researchers were surveyed on what counts as sycophancy, agreement was near universal that the problem is serious. Agreement broke down on which behaviours actually qualify. Deference to a user’s position was widely recognised, whether open or subtle. But for behaviour aimed at the person, only the obvious forms, the flattery and the unearned praise, were reliably named as sycophantic. The softened feedback, the avoided critique, the comfort offered in place of an honest answer, these were not consistently recognised as the same failure at all.

That is the governance trap in a single finding. If the experts who study this behaviour cannot reliably name its quietest forms, an assurance programme that tests only for factual agreement will conclude it has solved a problem it has barely touched. It will have measured the one quadrant that was already the least harmful and declared the model safe.

A control framework has to start from the whole family, not the visible corner of it. The behaviours that change what a person believes, and whether they ever seek a second opinion, do not announce themselves. They have to be looked for on purpose.

An assurance failure, not a personality quirk

If sycophancy were a personality trait, it would be enough to ask the model to behave differently. The reason that does not work is that the behaviour is not chosen by the model. It is produced by the way the model was built and the way the product around it is run. It is an outcome of incentives, and incentives are a governance object, not a character flaw.

Start with how these models are trained. A model is shaped by feedback on which of its answers people prefer, and people, reliably, prefer answers that agree with them. Given two responses, one that confirms what the reader already thinks and one that corrects it, the confirming answer is rated higher more often, even when it is the weaker of the two. The training signal does not separate the answer that was liked from the answer that was right. It rewards approval. Over enough examples, the model learns the lesson that was actually taught, which is that agreement is what gets rewarded.

The people supplying that feedback are not careless. They are doing what people do. Confidence reads as competence. Validation feels like help. A firm, warm, agreeable answer is satisfying in a way that a hedged or corrective one is not. So the bias toward agreement is baked in at the point where human preference becomes a training target, and it is baked in by ordinary human judgement rather than by any fault in the data.

Then the product layer adds its own pressure. A response that keeps the user engaged, that makes them feel understood and brings them back tomorrow, is a response the product has every reason to favour. Engagement and approval point in the same direction, and that direction is agreement. None of this requires anyone to decide that the model should flatter. The incentives decide it on their own.

The result is a loop, and the loop is the part that matters for governance. A user states a view with conviction. The model infers that what is wanted is validation and supplies it. The user feels understood, trusts the model more and returns. The positive feedback that follows is read by the system as evidence that the answer was good. Training and product incentives are reinforced, and the next version of the model is a little more willing to agree than the last. Satisfaction is being treated as a proxy for correctness, and the two are quietly drifting apart.

Seen this way, the behaviour stops looking like a quirk to be coaxed away and starts looking like what it is, a predictable product of an optimisation target that rewards being liked over being right. That reframing is the whole point, because it tells you where the controls have to go. You do not fix an incentive defect by asking the model to try harder to be honest. You fix it by changing what is rewarded, by testing the points where the loop turns, and by refusing to let user satisfaction stand in for accuracy. A behaviour created by incentives can only be governed by acting on those incentives, and that is a controls problem an assurance function is equipped to own.

Why the obvious fixes fail

Once the problem is named, two fixes suggest themselves. Tell the model to stop. Tell the user to be careful. Both feel reasonable, both are widely relied upon, and neither does the work that is claimed for it.

The first fix is the instruction. Add a line to the system prompt telling the model not to be sycophantic, not to flatter, to push back where the evidence warrants. This helps a little, and it is worth having. It is also weaker than it looks, because a single instruction is being asked to overrule an incentive that was trained in across millions of examples. The instruction sits on the surface. The disposition to agree sits underneath it. When the two conflict, which they do exactly when it matters, the disposition tends to win.

What makes this more than a quibble is that a structural change to the input outperforms the instruction by a wide margin. The same model is far less sycophantic when the thing it is responding to is posed as a question rather than asserted as a conviction. Change the shape of what the model is answering and the behaviour shifts more than any blanket instruction achieves. The detail of that lever belongs to the framework, but the lesson belongs here: telling the model to be honest is a weaker control than changing the conditions under which it is asked to answer.

The second fix is disclosure. If the model might flatter, warn the user, label the system, let people apply their own discount. This is the fix that regulation reaches for first, and it is the one the evidence is least kind to. A basic notice that a user is speaking to an AI produces no detectable reduction in the model’s influence. A stronger, pointed warning that the model may be telling the user what they want to hear does change something, but not the thing that matters. It lowers the user’s trust in the model and their sense of its objectivity, whilst leaving their conviction that they were right, and their unwillingness to repair the situation, almost untouched.

That gap is the whole danger of relying on disclosure. The warning changes what the user thinks about the model. It does not change what the model has already done to the user’s judgement. Worse, it can leave people feeling protected, persuaded that they have accounted for the bias, whilst the effect continues to operate underneath that false sense of safety. Disclosure is not mitigation. It is a transparency measure being asked to do a job it cannot do, and treating it as a control is how an organisation comes to believe a risk has been managed when it has only been announced.

Both fixes fail for the same reason. They treat a structural problem as a surface one. The behaviour is produced by incentives and reinforced over repeated use, and neither a label on the outside nor a sentence on the top of the prompt reaches the place where it is generated. What is needed is not a patch but a set of controls that act where the behaviour is actually made. That is the work the rest of this edition takes on.

The real stakes

The case against sycophancy is easy to wave away whilst it is described one answer at a time. A slightly too generous response here, an uncorrected assumption there, none of it looks like harm. The harm is not in the single answer. It is in what accumulates across many of them, and the accumulation runs in a direction that should concern anyone responsible for decisions made with these systems.

Begin with the single interaction, because even there the effect is larger than expected. When models are asked to weigh in on situations where a person has acted badly, they side with that person far more readily than another person would. The affirmation holds even when the account on the table describes manipulation, deception or harm done to someone else. The model is not reading the situation and choosing to endorse it. It is defaulting to the user’s side because that is what it has been rewarded to do, and it does so precisely when an honest response would have mattered most.

That default has a measurable effect on the person receiving it. People who are validated in a conflict come away more convinced that they were in the right, and less willing to take the steps that would repair the relationship. The model has not given them information. It has moved their judgement, hardening a position and lowering the inclination to mend things. And the people on the receiving end do not experience this as a cost. They rate the validating response as higher in quality, they trust the model that produced it more, and they are more likely to return to it. The behaviour that distorts judgement is the same behaviour that earns loyalty, which is what makes it so difficult to govern out.

Now extend that from one conversation to a habit. Over sustained use, the model becomes a place people go for reassurance, and it delivers the kind of emotional and esteem support usually associated with close relationships. Across weeks of this, people grow nearly as willing to take personal matters to the model as to the friends and family who would actually know them, and report less satisfaction with their real relationships as a result. When asked why they preferred the agreeable model, the reason given was not better advice. It was that the model made them feel most understood. The risk is no longer a wrong answer. It is substitution, a model standing in for the human counsel that would otherwise offer the honest reflection the model will not.

This is why the framing of epistemic capture is the right one. The behaviour does not just produce a flawed output. It changes the user, raising their certainty, lowering their willingness to be challenged, and displacing the people who might have challenged them. Each of those shifts makes the next correction harder to land, which is the defining feature of capture rather than ordinary error.

For a regulated setting, the implication is direct. In health, in law, in finance, in any decision where the cost of being wrong is borne by someone other than the user, a model that hardens conviction and discourages second opinions is not a comfort. It is a liability operating quietly inside the decision. The governing rule writes itself from there. The higher the consequence of the decision, the lower the tolerance for unsupported agreement should be. A system permitted to be reassuring in low stakes chat cannot be permitted the same licence where the outcome is irreversible.

The diagnosis is the easy half of this. Naming the behaviour, separating its forms, tracing it to incentives and showing why the obvious fixes fail can be done from the outside, and that is the ground covered so far. The controls are the harder half.

Beyond this page, the rest of this edition is delivered to premium subscribers, and it sets out the operating model in full:

• The Disagreement Assurance Framework. The four sequential stages, Diagnose, Interrupt, Correct and Monitor, by which the human preference loop is broken, together with the four duties a model must hold to however the request was framed.

• The five pre release tests. The exact protocols, from false premise and challenge collapse to status flip, emotional pressure and high stakes safety, to run against an assistant before it reaches a user, in the explicit and the implicit form alike.

• The procurement blueprint. The seven questions to lift straight into your next vendor assessment, converting a behaviour that usually hides in tone into obligations a contract can hold a provider to.

The diagnosis is above. The controls, the tests and the one page standard to run them are below.

Read more

An export control directive against a single American laboratory has revealed, more plainly than any statute could, how the United States governs artificial intelligence.

Safe versus dominant: the philosophical split

In the space of thirty-six months the federal executive branch has reversed its own definition of AI risk, and that reversal is the fact from which the rest of this edition follows. The same office, occupied by two administrations, has moved from treating risk as something that happens to citizens to treating it as something that happens to the country, and the move has reorganised every federal instrument that touches the technology.

Under the previous administration, risk was understood domestically and as a matter of precaution. The governing instrument was Executive Order 14110 of October 2023, the most comprehensive federal AI directive in American history. It required developers of the most powerful models to share safety evaluations with the government before release, directed agencies to build sector-specific safety standards, advanced a framework for content authentication and watermarking, and established the AI Safety Institute within NIST, the nearest the country has come, under any administration, to a dedicated safety body. The risks it named were internal. Algorithmic discrimination, opaque automated decisions, synthetic content directed at the public, the obligations of developers towards the people their systems would affect. A geopolitical dimension was present, since the Commerce Department was directed to develop export controls on chips and models, but it was carried alongside the domestic duty rather than in place of it.

The second Trump administration relocated risk almost entirely. Executive Order 14148 revoked 14110 in full on the first day of the term, eliminating the pre-release testing requirement, the Chief AI Officer appointments and the watermarking framework at a stroke. Executive Order 14179, three days later, reframed the central question. Where the earlier framing had asked what safety obligations a developer should bear before deployment, the new framing asked which regulatory obstacles were preventing American companies from outcompeting China. The July 2025 strategy document, Winning the Race: America’s AI Action Plan, answered across three pillars and ninety actions, directing the revision of the NIST framework to remove references to diversity, equity and inclusion, characterising safety requirements as a competitive disadvantage, and saying nothing of substance about private-sector safety obligations. In the new settlement, risk means the loss of technological dominance to a foreign adversary, and almost nothing else carries federal weight.

The thesis that holds this edition together is that these two instincts are now operating at the same time, in opposite directions, and that the contradiction is deliberate rather than accidental. For the domestic consumer market, the federal effort is deregulatory. Obligations are being withdrawn, the standards body has been restructured, and the states are being discouraged, and in Colorado litigated against, from filling the space that has opened. For the American technology stack itself, the federal effort is the reverse, and a national security apparatus is being assembled around it with considerable energy. Protection has not been abandoned. It has been transferred, from the citizen to the stack, and the citizen is now expected to be served by innovation rather than shielded by rule. Whether that transfer holds is the question every section of this edition returns to, because the events of June showed how far the security half of the bargain is now prepared to go.

The kill switch made real

On 12 June 2026 an export control directive was received by Anthropic from the United States government, citing national security authorities and requiring the immediate suspension of all access to its two most advanced models, Fable 5 and Mythos 5, by any foreign national, whether located inside or outside the United States, and including the company’s own foreign national employees. The directive arrived at 5:21 in the evening, Eastern time, and allowed for no phased compliance. Because access cannot be filtered by nationality in real time across the global cloud platforms through which a modern model is served, both models were disabled for every customer worldwide rather than for the population the order named. A restriction written against foreign nationals became, within hours, a restriction against everyone.

The mechanism is where the significance lies, because what was used was neither legislation nor rulemaking. Export control authority was reached for instead, of the kind administered by the Bureau of Industry and Security under the Export Administration Regulations, the same regime through which the flow of advanced semiconductors to China has been restricted since 2022. Its operative concept is the deemed export, under which granting a foreign national access to controlled technology is treated as an export to that person’s home country. Applied to cloud inference, the concept treats remote access to a model running on a server in the United States as though it were the movement of a physical component across a border. A capability that never left American soil was, for regulatory purposes, made to behave like contraband, and an entire category of users was reclassified, overnight, as a customs problem.

The stated basis was a concern about a method of bypassing the safeguards on the Mythos-class cybersecurity capability, a vulnerability that, according to reports, was found by researchers at Amazon, a major investor in the company and the host of much of its cloud infrastructure. Anthropic’s account, set out in its public statement, is that the technique was narrow rather than universal, that it surfaced a small number of previously known and minor vulnerabilities, and that comparable capability is already obtainable from other publicly deployed models, including OpenAI’s GPT-5.5, which are not subject to equivalent restriction. The company has said that it is complying with the directive whilst disputing the standard behind it.

None of this arrived without warning. The relationship between the laboratory and the federal government had already deteriorated earlier in the year, when the Department of Defense designated the company a supply chain risk following the collapse of contract negotiations, a label historically reserved for foreign adversaries. The wider turn towards security control was just as plain. On 2 June, covered in the previous edition, the administration signed an executive order that moved the National Security Agency and the Treasury into the central roles in federal AI oversight and set up a voluntary framework under which developers might give the government up to thirty days of access to a frontier model before its release. One critic warned at the time that placing so much discretion in the hands of the NSA director set a dangerous precedent, since the same authority could be turned against a company the administration was already in conflict with, and named Anthropic as the obvious target. Ten days later, through the export licence rather than through any AI framework, the government ordered an American developer to withdraw access to one of its models for the first time. The directive is therefore better understood not as an isolated act but as the most public expression yet of a settled pattern.

What turns a corporate disruption into a governance event is the instrument that was exposed. Runtime governance receives a chapter of its own in the book, and the kill switch within it, the capacity to suspend or terminate a system’s operation once a governance concern arises, has been discussed for years as an internal safety control, something a developer builds into its own system and operates under defined triggers. In June the kill switch was operated from outside the company, by government, against a commercial model already in the hands of millions of users, and it was operated through trade law rather than through any AI statute. The control that the safety literature imagined as a developer’s last resort has been shown to belong to the state.

The same administration that declines to mandate a single pre-release safety test for the domestic market, on the express ground that such mandates would slow innovation, has demonstrated that it can remove a flagship model from worldwide circulation within days of its release. Horizontal, ex-ante obligations are being dismantled in one register whilst, in another, the most forceful product intervention in the industry’s short history was carried out without notice or appeal. The lever that was reached for was not consumer protection, and it was not a safety rule. It was the border, and the border is the most powerful AI regulation the United States currently possesses.

Read the full argument

The directive described above is one episode in a longer pattern, and the pattern is the subject of the book this newsletter draws on. AI Without an AI Act: A Practitioner’s Guide to United States Artificial Intelligence Governance sets out how the country governs the technology in the absence of a statute, through agency enforcement, the courts, the states, the federal contract and the export licence, and how those instruments combine into something that functions as regulation whilst never being written as one. The first edition is released on 19 August 2026, and pre-orders are open now.

Two readings of June are now circulating, and they cannot both be right. One treats the shutdown as a single laboratory’s misfortune, a contract dispute that turned punitive. The other treats it as the first working demonstration of how every frontier release from this point will be policed. The difference between those two readings is not a matter of opinion. It rests on what each side has argued, on the record, in the days since the directive landed, and once those arguments are set beside each other the more uncomfortable reading becomes difficult to avoid. What it means for the next model, and for any organisation that has built on one, follows from there.

The louder instrument was the export freeze. The one that will reach more companies is the federal contract, and it is already changing how enterprise models are built without a single vote in Congress. There is a reason developers are stripping particular features from their commercial products to keep a government that may never be their largest customer, and the reason exposes the mechanism that the headlines missed. For any enterprise that employs foreign nationals inside the United States, the two instruments have now collided in a way that turns a procurement question and an export question into the same question, with no clean answer in current contract language.

What follows maps both instruments, the positions hardening on each side, and the single page that sets the whole pendulum out in one view, so that the next freeze is something you saw coming rather than something you read about.

Read more

In the final days of 2025, xAI, the company behind the Grok chatbot, went to court to strike down a California law. The law was modest by the standards of the AI debate. It required developers to publish a summary of the data used to train their models, the kind of transparency measure that draws agreement across the political spectrum. The challenge did not argue that transparency was a bad idea, it argued that the state had no right to compel it, because forcing a company to publish a particular account of its own product is a form of compelled speech, and compelled speech is something the First Amendment restrains.

That distinction is the subject of this edition, and it is one the AI debate keeps stepping around.

Almost all discussion of AI regulation is conducted on a single question. What should be done? Which risks deserve a response, which measures would work, which obligations are proportionate. It is the right question for deciding whether a rule deserves support. In the United States it is not the question that decides whether the rule can exist.

That question comes first, and it is a different one. What is the government permitted to do at all? The answer is not set by the strength of the policy case, it is set by a constitution that limits what any government may do, federal or state, and that is enforced by courts willing to strike a law down when it crosses the line. A great deal of AI regulation runs into those limits, because so much of it reaches into speech, because the power of federal agencies to act is bounded, and because authority is divided between Washington and the states.

The result is a pattern that surprises those who expect policy to turn on its merits. Sound proposals stall, narrow or fail, not because they were judged unwise but because they were never permitted in the first place. This edition is about where those limits sit, why they fall where they do, and what it means to govern artificial intelligence within them rather than in ignorance of them.

The Proposals That Become Constitutional Questions

In the United States, the argument over how to govern artificial intelligence has reached the point every powerful technology reaches in the end. The risks are visible enough that inaction has become hard to defend, no single federal law yet governs the field, and into that gap a familiar set of remedies has formed. Label AI-generated content so people can tell what is real, make developers register their most capable models with the government, require companies to disclose how their systems work, license the largest systems before release, as other high-risk industries are licensed. These ideas fill the policy papers, the draft bills and the congressional hearings, and they share an obvious appeal, since each answers a real risk and each sounds like the measured step a responsible government would take.

In many jurisdictions, a measure that commands political support and addresses a genuine harm can simply be enacted. The American system is built to make that harder, its constitution places limits on what any government may do, federal or state, and those limits are enforced by courts that can strike a law down. Much of AI regulation runs straight into them, because so much of it reaches into speech, because the authority of federal agencies to act is bounded, and because power is split between Washington and the states. The result is that a proposal in the United States must clear a test that has nothing to do with its merits. Before anyone asks whether a rule is wise, there is a prior question of whether it is permitted at all.

Watermarking shows how quickly this happens. If AI-generated content were labelled at the point of creation, the public could tell what was synthetic and what was not. Yet a watermarking mandate does not regulate conduct, it compels a private party to attach a message to its own output, and compelled speech is territory the First Amendment guards closely. A rule that forces a creator to carry a government-chosen label is not different in kind from a rule forcing any speaker to say what they would not otherwise say, and that resemblance alone is enough to move a sensible measure into contested ground.

Model registration meets a different barrier, requiring developers to register their systems with a federal body sounds like ordinary administrative housekeeping, the kind of thing agencies do across every regulated industry, but a federal agency may require only what it has been authorised to require, and the authority to build a registration regime for something as consequential as advanced AI cannot be assumed because the need feels pressing. Where that authority has not been granted with sufficient clarity by Congress, the registry stands on sand, however reasonable it looks.

Disclosure requirements are harder to place, because their fate turns on their content. A rule compelling plain, factual and uncontested information about a product sits on firmer ground than one compelling a company to express a view, to characterise its own system in particular terms, or to carry a message that is contested rather than settled. The same word, disclosure, can describe a measure that is permitted and one that is not, which is why so many disclosure proposals are drafted before anyone asks which kind they are.

Licensing raises the hardest question of all, a licence is permission granted in advance, and a licensing requirement conditions the right to build or release a system on approval secured before anything has gone wrong. Where the system produces expression, that prior restraint sits uneasily against a long constitutional reluctance to demand permission ahead of speech. Even where no expression is involved, the principle that government may restrain conduct only on grounds it can justify sets a limit on how far such a regime can reach.

The four do not share a flaw in design, they share a location, none can be judged on the policy merits alone, because each is settled, in part or in whole, by a structure that sits above the policy question and answers a different one, not whether the rule is wise, but whether it is allowed at all.

Wise and Permitted Are Not the Same Thing

Two separate tests are at work here, and the trouble in American AI policy comes from mistaking one for the other.

The first test is the one almost every debate is conducted on. Is the measure sensible? Is it proportionate to the risk? Will it work? These are the questions raised in the policy paper and the committee room, and they are the right questions to ask about whether a rule deserves support. A watermarking mandate, judged this way, has a strong case, it is targeted, it answers a real harm, and it asks little of the public.

The second test is the one that decides whether the rule can exist at all. Is the government permitted to impose it? This question is not settled by weighing costs against benefits, it is settled by asking whether the measure falls within the powers a government holds, and outside the protections the constitution places around the individual. On this test the same watermarking mandate is on far weaker ground, because compelling a private party to carry a government-chosen message reaches into protected territory regardless of how worthy the goal.

The two results do not cancel out, a measure can be excellent policy and impermissible at the same time, and where that happens the second finding governs. A court does not uphold a compelled-speech rule on the grounds that the speech being compelled is useful., the merits of a proposal, however strong, do not rescue it from a constitutional defect, and this is the point at which a great deal of well-intentioned AI policy comes apart. Its authors argued the merits, won that argument, and assumed the matter was closed, when the harder test had not yet been applied.

It would be easy to read all of this as an argument for doing less, and that reading would be wrong. Limits are not the same as absence. The constitution does not leave AI ungoverned, it sets the terms on which governance is possible, which is a different thing entirely. A rule built with those terms in mind can stand, a rule built in ignorance of them is fragile from the moment it is signed, and the difference between the two is not luck but understanding. The lawmakers, agencies and organisations whose work survives contact with a court are the ones who treated the constitutional question as the first question rather than the last.

This is why the structure deserves to be understood in its own right. The constitution shapes AI governance long before Congress passes a law or an agency writes a rule, it decides which proposals are even possible, and which were never going to survive whatever support they attracted. What follows sets out where those boundaries sit, and what it means to build within them.

Secure Your Copy

AI Without an AI Act is available for pre-order now, ahead of the global launch on 19 August 2026.

If the constitutional limits set out in this edition are ones you are working within, or advising others through, this is the reference built for that work.

Pre-order on Amazon

The rest of this edition maps the constitutional limits one at a time. The First Amendment, and what government may and may not compel a private party to say. The administrative constraints imposed by the Major Questions Doctrine and the end of Chevron deference, and why they explain so much of how agencies are behaving. The reach of due process and equal protection where AI systems bear on a person’s rights, benefits or standing. The federalism questions that decide whether Washington can override the states at all. It closes with a practical set of questions for testing any proposed rule against the constitution before a court does.

Read more

On 2 June 2026, an executive order titled Promoting Advanced Artificial Intelligence Innovation and Security was signed by President Trump. It directs federal agencies to build a framework for the secure deployment of frontier AI models, and it invites developers to share their most capable systems with the government for up to thirty days ahead of release. The order is explicit on one point that is easy to miss. Nothing within it authorises mandatory licensing, preclearance or permitting for new models.

So here is a country acting on artificial intelligence at the highest level of executive power, whilst declining to create a single binding rule. And even this order, voluntary and narrow as it is, will reshape what is expected of the firms that build and deploy these systems. It is only the most recent piece of a structure that has been forming for years.

That contradiction sits at the centre of how the United States governs AI, and it is the reason this edition exists.

The United States has no AI Act, this is repeated so often that it has hardened into something most people accept without examination. From the absence of one omnibus law, a conclusion is drawn that the country has little governance worth the name.

The United States does not govern artificial intelligence through a single law, it governs through something far more complicated.

The Myth of the Unregulated Market

Much of this misunderstanding can be traced to Europe. The EU AI Act is comprehensive, named and easy to point to, and it became the reference against which every other jurisdiction is measured. Journalists, vendors and consultants fell into the habit of comparing each country to Brussels, and wherever no equivalent law was found, a verdict of no regulation was recorded.

China complicates the picture further. Its algorithm and generative AI rules are specific and enforceable, yet they too are read through a European lens and judged by whether they resemble an Act.

Against this backdrop, the United States is made to look empty. There is no omnibus Act, no single regulator and no tidy framework to cite. The phrase no AI Act was treated as a synonym for no regulation, and the two were allowed to mean the same thing.

They do not, and the gap between them is where organisations are caught out. A firm that accepts the unregulated story prepares for nothing. It builds no record, anticipates no scrutiny, and discovers its obligations only once an enforcement action or a lawsuit has already arrived.

The absence of a federal AI Act tells us what the United States did not build, it tells us nothing about what it built instead.

The Question Most Organisations Are Asking Wrong

This is where most organisations begin in the wrong place. The question being asked across boardrooms and compliance teams is whether a new AI law must be complied with. It is the wrong question, and it produces a false sense of safety whilst no such law is found.

The better question is which governance mechanisms already apply to the AI systems in use.

Consider a hiring algorithm, no dedicated AI statute is needed for it to fall under scrutiny, employment law applies, the EEOC takes an interest, and exposure to discrimination claims is real and present. Or consider a model used to screen loan applications, where fair lending obligations attach long before anyone stops to ask whether the tool counts as AI at all. None of these waits for an Act to be passed.

The reality is that AI governance obligations already exist. The difficulty is that they are scattered across constitutional limits, agency mandates, state statutes and a fast-moving body of litigation, and few organisations can account for everything that already binds them.

This is what makes the United States harder to operate within. A single statute, for all its weight, at least announces itself and tells an organisation where to look, a fragmented system announces nothing. The obligations are no less binding for being dispersed, but they must be found, assembled and interpreted before they can be met, and that burden falls on the organisation rather than the legislator.

The pressure is rising on both sides at once, Federal policy is being steered towards innovation and competitiveness, the new executive order included, whilst a growing number of states are moving in the opposite direction with rules on transparency, automated decisions and consumer protection. An enforcement action can now arrive from a regulator that was never assumed to hold a view on artificial intelligence, and a single deployment can sit inside several conflicting expectations depending only on where its users happen to live.

The organisations that manage this well are not waiting for clarity from Washington, they are identifying the obligations that already reach them, mapping where their exposure is greatest, and building the evidence they would need to produce if challenged.

It is far from obvious which of these forces now carries the most weight, and misjudging it is precisely what leaves an organisation exposed.

AI Without an AI Act

AI Without an AI Act is available for Kindle pre-order now, ahead of the global launch on 19 August 2026.

If the landscape described in this edition is one you are navigating, or advising others through, this is the reference built for that work.

Pre-order on Amazon

The next sections map the six layers of US AI governance in full, set out why litigation may matter more than legislation, and examine the federal and state collision that is producing two governance systems at once. A practical set of questions is included for any organisation deploying AI, along with the governance map every compliance and risk team should be working from.

Read more

US private AI investment crossed one hundred billion dollars in 2024. That figure is not just a market statistic. It is the headline number of a supply chain problem that enterprise buyers are only beginning to come to terms with.

Here is the structural reality facing any organisation that procures AI in the United States today. At the federal level, the Trump administration’s July 2025 AI Action Plan reflects a philosophy of deliberate restraint: accelerate innovation, build infrastructure, lead internationally, and keep the regulatory hand light. Washington’s posture is clear. American AI companies should be free to compete, export and scale without the friction that characterises European conformity assessment or pre-market approval regimes.

State legislatures have taken note of that and moved in the opposite direction. All fifty states have introduced AI-related legislation. Forty-five have enacted or are advancing bills covering algorithmic discrimination, employment AI, deepfakes, biometric data and high-risk automated decision making. California, Colorado, Texas, New York and Illinois have each produced frameworks with distinct definitions, compliance timelines and enforcement mechanisms. None of them align neatly with each other, and none of them align with federal policy.

Enterprise buyers are caught in the middle. Washington is pushing what its AI Action Plan calls a full-stack American AI export agenda, encouraging procurement of domestic AI systems and treating regulatory friction as a competitive disadvantage. Meanwhile, the state laws that govern how those AI systems can actually be deployed are multiplying and tightening. The compliance environment is not a single market. It is a contest between two governance impulses operating simultaneously at different levels of the constitutional order.

This creates a problem that traditional software procurement is not designed to solve.

The limits of conventional vendor due diligence

Standard technology procurement operates on a familiar logic. You review the vendor’s security profile, negotiate service-level agreements, assess their financial stability and satisfy yourself that their data handling meets your internal standards. The deliverable is a contract that allocates risk clearly and gives you remedies if the product fails.

Foundation model procurement does not work this way. When you deploy a third-party AI system, you are not simply licensing software whose behaviour is deterministic and whose provenance is largely irrelevant. You are absorbing a complex legal supply chain. The model’s weights encode decisions that were made months or years before you signed anything: decisions about which data to train on, how to handle protected characteristics, whether synthetic data was used to fill gaps, and how bias in the source material propagated into the model’s outputs.

If those decisions were wrong, or if they violated the legal standards that now apply under expanding state frameworks and federal enforcement theories, the enterprise deploying the system inherits the exposure. California’s Assembly Bill 2013, which came into force on 1 January 2026, requires AI developers to publish training data transparency documentation. Colorado’s AI Act imposes algorithmic impact assessment obligations on deployers of high-risk systems and a ninety-day disclosure clock to the Attorney General in the event of a material algorithmic failure. Texas’s Responsible AI Governance Act, known as TRAIGA, formally structures the AI supply chain into three tiers of accountability, with distinct duties attaching to each.

The deployer, which in most enterprise procurement scenarios means your organisation, sits in the middle of that structure. You did not build the model, but you are the one making consequential decisions with it, and the law increasingly treats that as the moment of accountability.

What Bartz v. Anthropic changes

The June 2025 federal court decision in Bartz v. Anthropic drew a line that vendor marketing materials cannot cross over. The court’s analysis under fair use doctrine distinguished between lawfully acquired training data and shadow library or pirated datasets in ways that have direct consequences for enterprise buyers.

The significance is this: if a vendor cannot demonstrate the lawful provenance of its training data, the copyright exposure from that model does not stay with the developer. It travels downstream into every commercial deployment. Your organisation’s use of a model trained on unlicensed material is not insulated by the fact that someone else did the training. The vendor sheet that says the model was trained on high quality, curated data is not a legal shield. It is a marketing claim, and courts are now in the business of testing those claims against facts.

We know what the statutes say on paper, but how do you actually audit a third-party AI vendor when their underlying model weights and training datasets are guarded as proprietary trade secrets? Below, in this briefing, I set out the five-stage framework compliance teams should mandate before signing an enterprise AI vendor agreement.

AI Without an AI Act

The executive orders, state laws, and agency enforcement frameworks detailed in today’s briefing are drawn from my forthcoming book, AI Without an AI Act: A Practitioner’s Guide to United States Artificial Intelligence Governance (First Edition).

Written for compliance officers, in-house counsel and enterprise risk leads, it maps the distributed legal infrastructure of the world’s most consequential AI market from first principles.

Official release: 19 August 2026.

Secure your copy on Amazon

The next section sets out a practical five-stage audit process for assessing third-party AI vendors under the emerging patchwork of United States AI regulation.

It covers accountability mapping, training data provenance, contractual safeguards, impact assessments, and ongoing governance obligations.

Available to paid subscribers of The Responsible AI Review.

Read more

The Illusion of the Vacant Landscape

Ask most practitioners whether the United States regulates artificial intelligence, and you will get one of two answers. The first is dismissive: Congress has not passed an AI Act, therefore there is no AI Act, therefore the United States is essentially ungoverned. The second is cautiously optimistic: the EU has its f…

Read more

Enterprises are deploying AI platforms they cannot independently evaluate, monitor, or interrupt, and most procurement processes are not designed to detect the risk.

Something significant has shifted in how la…

Read more

Financial services is sleepwalking into its next major governance failure. This time the agent will take the blame. Your institution will pay the price.

That line is not hyperbole. It is the logical conclusion of a pattern that has played out in every significant technology transition in financial services, and it is playing out again right now, faster a…

Read more

When the European Union set out to govern artificial intelligence, it made a choice that most other regulators had avoided. Rather than wait and see, it wrote the rules first. The EU AI Act, which reaches full applicability this August, is the result of that decision, and it is already reshaping how organisations around the world think about the systems…

Read more

Most Western commentary on China’s AI governance lands in one of two places.

Either it is framed as censorship, a state apparatus for controlling information and suppressing dissent through algorithmic means. Or it is framed as industrial strategy, a state backed race to win the AI competition and outpace the West.

Both framings contain truth. Neither is …

Read more

The itch

I was at my desk, as I normally am, working through papers. It is something I do deliberately, going deep into what shipped AI models are actually doing beneath the press releases and the capability benchmarks. The two papers I want to discuss here are genuinely good, valuable and rigorous, and I am not here to dismiss them.

But something kept na…

Read more

In the halls of power, there is a comforting, though increasingly dangerous, belief that our 20th century legal frameworks are a sufficient fortress against 21st century silicon. But as we move from static tools to autonomous, agentic systems, the David of existing law is finding its paper shield shredded by a Goliath of unprecedented technical scale. T…

Read more

Welcome back to The Responsible AI Review, your weekly signal on AI governance, safety, and sustainability in agentic systems and beyond.

Curated by Alexandra Car, Chief AI Officer at Breeple.ai.

There are anno…

Read more

Welcome back to The Responsible AI Review, your weekly signal on AI governance, safety, and sustainability in agentic systems and beyond.

Curated by Alexandra Car, Chief AI Officer at Breeple.ai.

There is a dis…

Read more