State AI Laws Explained: What U.S. Businesses Must Know in 2025

In this episode of the Macro AI Podcast, Gary and Scott break down one of the most important — and least understood — topics in American AI policy today: the rise of state-level AI laws. With all 50 states now proposing or enacting AI-related legislation, businesses are no longer navigating a single regulatory landscape — they’re operating inside a growing patchwork. 

Gary and Scott unpack the three big buckets of state AI rules, from comprehensive frameworks in Utah, Colorado, and Texas to targeted laws on deepfakes, hiring algorithms, mental-health chatbots, and digital replicas. They also explore how regulators are using existing consumer-protection laws to police AI even in states without formal AI acts. 

Listeners will hear why 2025 has become a turning point in AI governance, how the federal government’s attempted preemption triggered a tug-of-war with state attorneys general, and what common themes are emerging across the country. 

Most importantly, Scott and Gary translate the entire mess into a clear, practical playbook for executives. They explain how to build an AI inventory, assess high-risk systems, align to the strictest state standards, tighten vendor governance, and prepare for inquiries from regulators — all without slowing down innovation. 

Whether you’re a CEO, CIO, or someone building AI into your products, this episode will help you understand the new regulatory reality and how to thrive in it. 

Perfect for: 
Business leaders, AI COEs, CTOs, product teams, compliance professionals, and anyone deploying AI across multiple U.S. states. 

About your AI Guides

Gary Sloper

https://www.linkedin.com/in/gsloper/

Scott Bryan

https://www.linkedin.com/in/scottjbryan/

Macro AI Website:

https://www.macroaipodcast.com/

Macro AI LinkedIn Page:

https://www.linkedin.com/company/macro-ai-podcast/

Gary's Free AI Readiness Assessment:

https://macronetservices.com/events/the-comprehensive-guide-to-ai-readiness

Scott's Content & Blog

https://www.macronomics.ai/blog

Transcript

00:00
Welcome to the Macro AI Podcast,  where your expert guides Gary Sloper and Scott Bryan navigate the ever-evolving world of artificial intelligence.  Step into the future with us  as we uncover how AI is revolutionizing the global business landscape  from nimble startups to Fortune 500 giants.  Whether you're a seasoned executive,  an ambitious entrepreneur,

00:27
or simply eager to harness AI's potential,  we've got you covered.  Expect actionable insights,  conversations with industry trailblazers  and service providers,  and proven strategies to keep you ahead in a world being shaped rapidly by innovation.  Gary and Scott are here to decode the complexities of AI  and to bring forward ideas that can transform cutting-edge technology  into real-world business success.

00:57
So join us,  let's explore, learn  and lead together.

01:04
Welcome back to the Macro AI podcast. I'm Gary.  And I'm Scott. Today we're tackling a topic that's getting hotter every quarter. US state AI laws. Not the hypothetical ones, not the maybe someday Congress will do something, conversations, but the real laws already shaping how businesses are allowed to use AI in 2025. Yeah.  And the key point  is the states.  Every single one of them  have jumped onto the AI regulatory game. uh Some have.

01:34
full on governance acts. Others have targeted laws around deep fakes or hiring algorithms. And others are using existing consumer protection laws to police AI behavior. But all of them in one way or another are, they're now in the arena. Yeah. So let's start with why the states of all places are leading the way. Yeah. It's, it's pretty straightforward. Congress is still debating. Meanwhile,

02:00
States  are looking at AI exploding across every industry and they're saying, you know, we're not waiting. So over the last two years, every state has introduced something, a bill, a task force, a deep fake law or a fully comprehensive act. Yeah. And then you've got the tension between state and federal powers. ah The White House floated the idea of an executive order, if you recall, that would override state  AI laws and create a unified national...

02:30
approach. That really triggered an immediate pushback, especially from state attorneys general,  who basically said, absolutely not. We want to keep regulating AI.  And really what that nets out is that the patchwork is  here to stay. So if you operate in multiple states, you're already trying to navigate it,  whether you know it or not. Yeah. So really the question becomes,  how do you make sense  of 50 different approaches across 50 different states?

03:00
Yeah, I think one of the frameworks that we use with clients breaks the state AI laws into three buckets. The first is the small but powerful category of comprehensive AI governance laws, the ones coming out of Utah, Colorado, Texas. And these aren't just niche laws. They define how companies must govern and disclose AI and AI use across entire industries. Yeah, I mean, it's a good point around Utah. They were really the

03:30
The first with a law that basically said, you know, if you're using generative AI in customer interactions, be upfront about it. Um, it's big on disclosure and accountability, especially in, you know, the various regulated professions that exist within the United States. And Colorado took it further. Uh, their approach is, uh, much more like a life cycle model. So first identify your high risk AI systems, assess them.

03:56
ah document your decisions, monitor them, and then make sure that you can prove you're not discriminating. And that's the closest thing we have in the US to  the European Union's AI Act.  And that's something that we've gone over in previous shows. Yeah, that's a point. We have talked about that in the past. You also mentioned Texas joined the club with  a law that really blends transparency, civil rights protections, and even in AI sandbox.

04:23
So businesses in Texas really need to think about internal governance,  human oversight and bias prevention as part of their everyday operations to kind of stay within the guardrails there in Texas. Yeah. And then the second bucket  is what we call the  hotspot laws. Those would be targeted rules around things like deep fakes and elections,  hiring algorithms,  mental health bots, which has been getting a lot of attention lately,  digital replicas of people's

04:53
voices or their likenesses. And these are more surgical, but they're extremely important if your company touches any of those areas. Yeah, that's a point. ah The third bucket, I would say, is  the crafty one that's really not a surprise to probably many folks. uh Regulators using existing consumer protection and civil rights laws to go after AI harms, even if the state has no AI specific statute. So if you're listening and thinking about your business,

05:23
kind of coming in your head saying, my state doesn't have an AI law. Trust me, you're probably still on the hook. So just something to be mindful of. Right. Yep. And if we think about, you know, 2025, something's kind of really shifted as kind of the turning point this year. What are your thoughts? Yeah, I agree. This is really the year when state AI regulation really started to sprout up. Like we talked about, Utah updated its law.

05:52
Colorado moved  theirs into implementation and Texas stepped in with their new requirements. uh And meanwhile, more states  started to introduce bills around election deepfakes, hiring bias, biometric surveillance, uh and the chatbots.  And then the federal government escalated things by exploring a preemption move, which immediately turned into a tug of war with states  that want to protect the regulatory turf.  many of you saw that in the news as well.

06:22
Yeah, that common tug of war between the states and the Fed. ah But here's, I think this is kind of the bottom line. uh Don't build your governance strategy hoping the federal government will swoop in with a well-defined framework that kind of wipes away the state complexity. You just can't wait for that. So that's just not going to happen anytime soon, I don't think.  So you need to plan, ah you need to really plan for your business, something that works across multiple jurisdictions.

06:51
today. Yeah, you're absolutely spot on there. mean, I think a common theme or themes business leaders really should  anchor on for their business uh is part of this. And the good news is even though states are all over the place, they're converging around the same ideas. So it's not just being performed in one state as a singular entity. Yeah, I  totally agree with that. So they're like you said, they're starting to converge and um

07:21
in different areas and transparency is one of them. So states want people to know when they're dealing with AI.  Another one is risk management,  understanding which systems are high risk  and  treating them accordingly. uh Fairness and non-discrimination is starting to show up everywhere and that'll be part of the federal structure, I'm sure.  And almost all the laws  reinforce the idea that humans  have to remain accountable, especially in high stakes decisions. eh

07:51
Yeah, that's a good point. And I think those themes map perfectly into areas like the NIST AI risk management framework, the ISO 4201 AI governance standard. So if your organization aligned to those today, you're already preparing for what the law is potentially heading towards. Yeah. And I think the real beauty of that approach is that it gives you one strong baseline. And then you can layer in individual state requirements.

08:21
on top of that without rewriting your entire governance program for each new jurisdiction. Yeah, that's a really good point, Scott. So I think if you're a business leader or a group of individuals in a business, really the question is, what should you actually do about all of this? And let's make this actionable. So how does a company actually operate in this landscape, Scott? are your thoughts there? Yeah.

08:49
The first thing is that  the organization needs a real  detailed AI inventory. So you need to know where AI shows up in your business. So that means the obvious things like chatbots and  generative AI tools, but also the less flashy stuff. know,  risk models, scoring engines, hiring tools. And once you know where everything is, you can map out which states, residents  each system is going to touch.

09:17
Yeah. And that right there usually reveals a few surprises. Yeah, it always does. And then next, categorize your systems by risk level, low risk, medium, high risk with high, meaning the system impacts people's jobs, credit, housing, education, or health. So if it touches any of those things, that would be a high risk system. Yeah, that's a good point. And I think, absent of any state

09:45
mandates that you may have, you could align  your organization to the strictest States. So treat Colorado, Utah, and Texas. Like we just talked about as the high watermark. You meet their standards for high risk AI. Now you'll probably meet everyone else's too in the future, but again, be mindful of what is coming. Um, you know, but in the meantime, where there's, there's gaps, those are three States to kind of benchmark against. Yeah, exactly. And then, and then from there.

10:15
Make sure you have a review process in place.  Really something that forces the team to think through the risk, the bias,  where you're going to have human oversight  and  disclosures before launching or updating an AI system that's going to uh be touching your customers. Yeah. And just talking about an AI system in general, I don't forget about vendors. A lot of organizations assume their vendors handle compliance for them.

10:43
regulators absolutely do not see it that way. You're still responsible for how the AI from your vendor behaves in your environment and under the umbrella of your business. So just keep that in mind, especially as we're seeing a lot of vendors tout their AI products and services. um Just be mindful of that. That's a good point, especially for  procurement and  IT leaders need to check those vendors for sure. uh

11:11
Yeah, and then the last piece is readiness. So if a regulator comes at you about one of your AI systems, and this is becoming more more common, you should be able to quickly show how it works, who owns it, how it was evaluated, how you monitor it. ah You know, and if that makes you as a business leader nervous, then that's probably your starting point. Yeah, that's great. Good points. So I...

11:37
Next, we should probably turn towards  some questions. We've done this in the past, kind of a rapid fire format. So these are the questions executives and, and business users continue to ask us. We've corralled them together.  Scott, why don't you kick off the first one?  Sure. Yeah. I think the uh kind of the easy one is uh do I need a 50 state analysis to deploy AI?  And I think the answer is  no, not right away. What you need is a really strong.

12:06
Baseline governance framework and then once that's in place  You can really focus your legal analysis  on the handful of systems that pose real risk like some of the ones that we mentioned Yep, that's a good one  The next one which  Scott and you and I deal with quite a bit ah On the the customer success side. The question is is it still safe to use artificial intelligence for customer service? Yeah, I would say one. Yeah, so would say yes, but you need to

12:35
Be clear and understand the disclosures that you need to invoke into your business and out to your customers.  Um, and, and a path to a human, especially for financial or health related issues, Utah and others expect you to be upfront about when customers are interacting with AI. So we talked about Utah a little while ago. I've seen a lot of organizations just deploy some sort of AI chat bot, and they're not really sure about the vendor or the, the

13:05
building mechanism of that, you know, uh, entry level agentic environment. So just, just be mindful of that and really try to dig in on what you're using. Um, and certainly, you know, part of the facilitated workshops that folks like Scott have done in the past, you can kind of identify that before you deploy something. So definitely it's safe, but just understand, um, you know, the disclosure and the path to a human in that process. Right. Yeah. And when we've, uh,

13:35
quite a bit is  all around  hiring. We get that one pretty regularly. If you're using an automated resume screening or interview scoring tools, you're already right into that high risk category. uh know, bias testing, transparency and human judgment need to be built into the process. So something you really need to think about and inspect if you're using uh automated screening or interviewing tools. Yeah, that's a good one.

14:05
So the last one we have here, will a federal law wipe out the patchwork? ah We kind of alluded to this earlier, probably not. And even if it did someday happen to wipe everything out, everything you do now, inventory, risk management, oversight will still matter. So those are foundational capabilities, not just compliance asks that you should be mindful in your business. Yep. Yep. Build it right into governance. Yeah. So just, uh

14:34
I think pivot over to some closing thoughts. think really the big takeaway is that AI governance is no longer optional or theoretical. It's really becoming a core competency for leaders. Yeah. And the companies that build AI governance earlier are the ones that will move faster, not slower. Just remember, you can't scale AI if half your organization is worried you're breaking a law in Colorado or Texas. So just keep that in mind too.

15:04
Yeah,  exactly. think you can net that out by good governance is going to help unlock  velocity with the  growth in AI systems. Yes, good governance. Well, that's our episode on the US state AI laws. If you want  us to go deeper on your state or your use case, let us know.  Send us a message  on our website or on LinkedIn.  And thank you again for listening.

15:30
Yep. Thanks for listening. Please like and subscribe and share the podcast with your network. Thank you.