How CIOs can navigate federal, state AI regulation uncertainty

The AI regulatory landscape

Organizations face a growing mix of AI rules from governing bodies around the world. CIOs must understand how these laws affect governance and deployment decisions.

EU AI Act

The EU AI Act is one of the most significant AI regulations for multinational organizations. The law takes a risk-based approach, with stricter requirements for AI systems that could affect areas such as employment, healthcare and finance.

For multinational companies, the regulation has become a key consideration as they build AI governance programs and decide how to deploy AI across different markets.

"The EU AI Act represents a serious attempt at comprehensive, principled regulation. Whatever its specific provisions, the ambition -- to evaluate use cases on their risk and set clear, consistent expectations -- is the right one," said Jonas Hansson, CIO of Axis Communications.

U.S. state AI laws

While federal policymakers debate a national approach to AI regulation in the U.S., states have continued to pass their own AI laws. These rules create a patchwork of requirements that organizations must consider when they deploy AI systems, particularly in areas where AI can influence important decisions about people.

• Colorado. Colorado's AI law focuses on automated decision-making technology used in consequential decisions and establishes transparency, disclosure and accountability requirements for organizations using these systems.
• California. California has passed several AI-related measures focused on transparency, consumer protection and automated decision-making, adding to the state's broader technology and privacy requirements.
• Connecticut. The Connecticut AI Act establishes requirements for high-risk AI systems, including risk assessments, transparency measures and governance practices.
• Utah. The Utah AI Policy Act focuses on consumer disclosures, including requirements that companies tell users when they interact with generative AI systems in certain situations.
• Illinois. Illinois regulates certain uses of AI in employment, including transparency requirements and protections for employees when employers use automated decision-making tools.

Colorado's law has received the most attention because it was one of the U.S.'s first and broadest regulatory frameworks for AI-driven consequential decisions. The state initially proposed stricter requirements on algorithmic decision-making, but lawmakers later amended parts of the law after companies and industry groups raised concerns about the burden it could impose on organizations developing and deploying AI.

There's just a huge pushback on anything AI regulation right now.

"What you saw after is so much outside money, and then outside lawsuits from xAI coming in and trying to stop the Colorado law. That climate is so key for anybody at this level to understand -- there's just a huge pushback on anything AI regulation right now," said Tyler Thompson, partner and attorney at Reed Smith's Emerging Technologies practice group.

Trump's December 2025 executive order

In December 2025, President Trump signed an executive order aimed at establishing a more uniform federal approach to AI policy. The order directed federal agencies to evaluate existing state AI laws and develop recommendations for a national framework that would limit what the administration views as overly burdensome state-level regulation.

The order argued that a patchwork of state AI laws could slow innovation and create compliance challenges for companies operating across multiple jurisdictions. It called for a minimally burdensome federal AI policy framework and directed agencies to identify state laws that conflict with that approach.

The executive order does not eliminate existing state AI laws, and companies must continue to follow requirements already in place. However, the order shows the Trump administration's stance on AI regulation.

"It doesn't seem like anything is going to be happening at the federal level, at least in the near term, which I think is a correct read. Even at the state level, it showed that there is going to be a rough path forward for state-level AI legislation," Thompson said.

Trump's June 2026 executive order

In June 2026, President Trump signed another executive order focused on the security risks of advanced AI systems, often referred to as frontier models. Unlike the December 2025 order, this action did not focus on state AI laws. It created a voluntary process for developers of the most advanced AI models to share information with the federal government before public release.

The order focuses on national security and cybersecurity concerns, including how frontier models could expose vulnerabilities or affect critical infrastructure. It aims to help the government identify potential risks while avoiding mandatory approval requirements that could slow AI development.

For most CIOs, the executive order does not create new compliance requirements for everyday enterprise AI deployments. The order primarily affects developers of advanced frontier models.

A framework for AI governance

While AI regulations remain in flux, organizations can build governance programs that adapt to changing requirements.

1. Create an AI governance committee

Organizations should first create a cross-functional governance committee with representatives from IT, legal, security, risk, compliance, HR and any other relevant business units. The group can review proposed AI use cases, evaluate risks, establish policies and oversee internally developed systems and third-party tools.

"We have a bimonthly meeting where that group gets together. They review all the requests for AI that are coming into the organization," said Jason Landrum, global CIO of Sedgwick.

As AI adoption grows, manual reviews may not scale. Landrum and his team are working to automate parts of the approval process by routing lower-risk requests through predefined workflows and reserving in-depth human review for higher-risk use cases.

For example, an AI request that uses an approved vendor and accesses only low-risk data might move through an automated workflow, whereas one involving sensitive customer information or a new model might be escalated to the committee for manual review.

Governance should also extend beyond a formal committee, Hansson said. Organizations can establish AI ambassador networks across business units to find emerging risks and ensure governance becomes part of day-to-day operations rather than remaining a policy on paper.

2. Inventory AI systems and use cases

Organizations cannot govern AI if they do not know where it's used. Before they build policies or respond to new regulations, AI committees should identify every AI system in use, understand what it does and determine whether it could create legal or business risks.

Do that fact-finding, that diligence and understand the use cases ... Trying to get a handle on that is definitely the first step.

"Do that fact-finding, that diligence and understand the use cases ... Trying to get a handle on that is definitely the first step," Thompson said.

The inventory should include both approved AI tools and shadow AI. Organizations should also identify AI capabilities embedded in third-party software, as employees may be using AI without realizing it.

3. Conduct AI risk assessments

After the committee identifies AI systems, it should evaluate the risks each one creates. The review should examine risks such as bias, privacy, security and compliance, as well as potential business benefits and determine which controls they need before the AI system moves forward.

"We assess it for auditability and risk assess it. IT assesses it for the ability to work in our ecosystem, and then we have a couple of business people," Locandro said.

4. Establish standards that work across jurisdictions

Organizations operating in multiple states or countries cannot create a separate AI governance program for each jurisdiction. Instead, CIOs should build one set of internal rules based on core principles such as transparency, accountability, human oversight and risk management. That approach helps organizations comply with requirements across jurisdictions and reduces the need to rewrite policies every time a new law takes effect.

Have principles that can cover multiple jurisdictions.

"Have principles that can cover multiple jurisdictions, because regulatory uncertainty shouldn't freeze the AI strategy or programs," Locandro said.

Organizations that set high internal standards for AI governance often require fewer changes as new regulations emerge. Instead of creating a new governance process for every regulation, they can make small tweaks to existing policies to meet new requirements.

"When you prioritize long-term planning, you tend to find yourself already aligned with where regulation is heading, sometimes before the rules are even finalized," Hansson said.

5. Require AI governance from vendors

Organizations should apply the same governance standards to AI vendors that they apply to internal systems. Before adopting an AI tool, CIOs should understand how it works, what data it uses and whether it aligns with the organization's security, privacy and compliance requirements.

"We assess risk profiles, data security practices, intellectual property handling and the vendor's own chain of subprocessors," Hansson said.

The review should involve more teams than just IT. Business leaders can help determine whether the tool meets operational needs, while legal and security teams can evaluate contractual, regulatory and data protection risks.

Organizations should prepare to reject AI tools that do not meet their governance standards. A useful feature may not be worth the risk if the organization cannot control or track how the tool uses its data.

"We've knocked back two or three because when some of these software tools come into your organization, they extract data to use for their learning models that then go out again to a broader environment. We have not adopted them because we cannot have the traceability of the data once it leaves our premises for their models," Locandro said.

6. Build in flexibility

As regulations evolve, organizations should continuously monitor the regulatory landscape and build governance programs that can adapt without requiring major updates across every system. Centralized policies and controls make it easier to apply new requirements consistently and reduce the burden of managing compliance across the organization.

"The framework we're putting in place … allows us to implement tools that are going to automatically monitor what [our] agents are doing. So, as changes come about, you're making a change in one spot in your infrastructure, and it's actually cascading that through your entire environment," Landrum said.

Tim Murphy is a site editor and writer for the IT Strategy team at TechTarget.