The AI Laws May Be Unsettled. Your AI Use Isn’t. | CLICBrain Weekly Briefing – Issue #3

Compliance Intelligence for Online Businesses.

What Changed. Why It Matters. What to Do Next.

 

The AI Laws May Be Unsettled. Your AI Use Isn’t.

Operational Compliance Intelligence for Internet Businesses.

Welcome to the CLICBrain Weekly Briefing – operational compliance intelligence for internet businesses from CLIClaw.com.

Each week, we identify significant privacy, AI, advertising, data governance, email marketing, and regulatory developments and focus on what they mean operationally: what systems, workflows, governance controls, and evidence organizations should examine in response.

This week, the federal-state debate over artificial intelligence regulation moved into sharper focus. But for businesses, the most important AI compliance question may not be which government ultimately writes the rules.

It may be whether the organization actually knows where and how AI is already being used.

 

 

 

 

 

Don’t Wait for the AI Rules to Settle Before Governing the AI You Already Use.

Federal and state policymakers continue to debate what AI regulation should look like.

In March, the White House released a national AI legislative framework calling for a federal approach and recommending preemption of certain state AI laws.

Meanwhile, states continue developing their own approaches to artificial intelligence, automated decision-making, consumer protection, discrimination, synthetic content, and other AI-related risks.

That conflict became particularly visible on April 24, when the U.S. Department of Justice moved to intervene in xAI’s lawsuit challenging Colorado’s AI law addressing algorithmic discrimination and high-risk AI systems.

Businesses may therefore face substantial uncertainty about what the eventual regulatory framework will look like.

But there is considerably less uncertainty about what organizations can do now.

• Know what AI is being used.

• Know who approved it.

• Know what data goes into it.

• Know what decisions or content it influences.

• Know what controls and evidence surround it.

AI governance does not have to wait for AI legislation to become settled.

 

 

 

 

 

Could You Answer These Questions About AI Use Inside Your Organization?

1. What AI tools are employees currently using for company work? That includes not only dedicated AI platforms, but AI functionality embedded in software the organization already uses.

2. What company, customer, employee, or other sensitive information is being entered into those systems? An AI tool can create a governance issue even when it is used only internally.

3. Who decides whether an AI tool or use case is acceptable? If the answer is effectively “the employee who wants to use it,” the organization may have an approval gap.

 

The Regulatory Landscape is Moving. Internal AI Use is Moving Faster.

AI regulation remains fragmented.

The White House’s March 2026 legislative recommendations call for a national framework and congressional preemption of state AI laws considered unduly burdensome, while preserving certain traditional state authorities.

At the same time, states continue developing laws addressing particular AI systems, risks, industries, and uses.

That creates an understandable temptation for businesses:

Wait until the rules become clearer.

 

Operationally, that may be the wrong response.

AI can enter an organization long before the legal department or compliance team decides that the company has an “AI program.”

• An employee may use a generative AI system to summarize a customer complaint.

• Marketing may use AI to draft advertising copy.

• HR may use software containing automated screening or ranking functionality.

• A customer-service platform may introduce AI-generated responses.

• A vendor may add AI capabilities to an existing product.

• A developer may incorporate an AI service into a business workflow.

None of those activities requires the organization to announce, “We are adopting AI.”

They can simply happen.

That is why the first AI governance problem is often not regulation.

It is visibility.

 

 

 

 

 

1. Federal-State AI Conflict Is Becoming a Compliance Issue.

On March 20, the White House released a national legislative framework for artificial intelligence.

Among other recommendations, the framework calls for Congress to establish federal AI policy and preempt certain state AI laws while preserving specified areas of traditional state authority.

For businesses operating nationally, the policy debate matters because different state requirements can affect how AI systems are developed, deployed, documented, and governed.

But proposed federal preemption should not be treated as permission to ignore existing requirements.

✔ CLIClaw Compliance Tip: A proposed national framework is not the same thing as enacted federal legislation. Organizations still need to identify the laws currently applicable to their operations.

 

2. Colorado’s AI Law Is Now Part of the Federal-State Fight.

On April 24, the U.S. Department of Justice moved to intervene in a lawsuit filed by xAI challenging Colorado’s AI law.

The challenged law addresses high-risk AI systems involved in consequential decisions and includes requirements aimed at preventing algorithmic discrimination.

The federal government’s intervention highlights a larger policy dispute over how far states may go in regulating artificial intelligence and whether some state requirements conflict with federal constitutional or policy principles.

For businesses, however, litigation over one state’s law does not eliminate the underlying governance question:

✔ CLIClaw Compliance Tip: Do we know whether AI or automated systems are materially influencing decisions affecting people? That is a question organizations can investigate regardless of how the litigation ultimately develops.

 

3. Existing Consumer-Protection Law Still Matters.

AI does not operate outside existing consumer-protection law.

The Federal Trade Commission has previously made clear through enforcement and investigative activity that artificial intelligence can be used in ways that implicate existing prohibitions on unfair or deceptive practices.

That matters particularly when businesses make representations about what an AI-enabled product can do, how it performs, what results consumers should expect, or how AI is being used.

An organization does not necessarily need an AI-specific statute before an inaccurate or unsupported AI-related representation can create compliance risk.

✔ CLIClaw Compliance Tip: New technology does not automatically require a new law before existing compliance principles matter.

 

The Operational Problem: Shadow AI.

One of the easiest ways for an organization to lose control of AI governance is also one of the least dramatic:

Employees simply begin using AI tools on their own.

Someone finds a tool that saves time.

They create an account.

They paste in information.

They receive an output.

They use that output in company work.

The process may never pass through information security, privacy, legal, compliance, procurement, or vendor review.

That can create questions involving confidential information, personal information, customer records, intellectual property, marketing claims, output accuracy, vendor terms, retention practices, and human review.

The organization may not even know the activity exists until something goes wrong.

 

 

 

 

 

“We Don’t Use AI – Employees Just Use ChatGPT Sometimes.”

That distinction should get compliance’s attention.

Employee use is organizational AI use when employees use AI systems to perform company work.

If employees are deciding independently which tools to use, what information to enter, how outputs are verified, and whether AI-generated material can be used externally, the organization may already have an AI governance program.

It is simply an unmanaged one.

 

 

 

 

 

Inventory One Department’s AI Use.

Don’t begin by trying to create an enterprise-wide AI governance framework this week.

Pick one department.

Marketing, HR, customer service, IT, sales, or another team that is likely to use AI is enough.

Ask what AI-enabled tools employees currently use, including AI features embedded inside existing software.

For each use, identify:

• What is the tool being used to do?

• What information goes into it?

• What comes out?

• Does the output affect customers, employees, marketing, decisions, or other business activity?

• Who reviews the output?

• Was the tool or use case ever formally approved?

The objective is not to ban AI.

It is to discover whether the organization’s actual AI use matches the AI governance process it thinks it has.

One department is enough to start.

 

 

 

 

 

Q: Do we need an AI policy if employees only use AI tools internally?

CLICBrain: Internal use can still create compliance and governance risk.

Employees may enter customer information, personal data, confidential business information, marketing content, contracts, internal documents, or other sensitive material into AI systems. They may also rely on AI-generated outputs without appropriate review.

A practical AI policy should answer a few basic questions:

• Which tools and uses are permitted?

• What information should not be entered?

• When is human review required?

• Who approves new AI tools or higher-risk uses?

The goal is not to regulate every prompt.

It is to establish boundaries before individual employee practices become the organization’s unofficial AI policy.

Have another compliance question? Ask CLICBrain on CLIClaw.com.

 

Related CLIClaw Solutions.

This week’s CLICBrain Takeaway points to two foundational AI governance needs: identifying how AI is actually being used and establishing basic rules for approved use.

• AI Governance & Enforcement Readiness Toolkit. Use it to establish an organizational framework for AI oversight, roles, risk identification, approvals, and governance.

 

One Question to Take With You.

If you asked every department tomorrow to identify the AI tools employees are using, what would you discover that legal, privacy, security, or compliance has never reviewed?

That may be the best place to begin your AI governance program.

 

CLICBrain Weekly Briefings provide operational compliance intelligence and commentary for internet businesses. Regulatory developments, enforcement activity, and legal requirements discussed herein should be evaluated in the context of your organization’s specific operations, systems, data practices, and risk profile. This briefing is for informational and educational purposes only and does not constitute legal advice.