Congress didn’t just reshape tax codes with the “One Big Beautiful” bill; it also quietly reshaped the future of artificial intelligence. A lesser-known provision of the sweeping legislation is now on its way to becoming law: a 10-year freeze on state-level AI regulation.
In other words, no individual state can pass rules that govern how businesses develop or use AI systems. The message is clear for companies rushing to embed AI in daily operations: govern yourselves or risk learning the hard way why guardrails matter.
AI isn’t a side project anymore. It’s already embedded in cybersecurity platforms, CRMs, internal chat tools, reporting dashboards and customer-facing products. Even mid-size organizations are training AI models on proprietary data to speed up everything from supplier selection to contract analysis.
However, the adoption curve has outpaced internal checks. Many teams are greenlighting tools without understanding how they were trained, what data they retain or how outputs are validated. IT leaders often discover AI use well after it’s already operational. This kind of shadow Ai creates a major risk surface.
And now, with state-level oversight blocked for a decade, there’s no outside pressure forcing organizations to establish policies or baseline rules. This shift pushes businesses to take even more responsibility for what happens inside their walls.
Without guardrails, AI can drift; fast
AI models aren’t static. Once deployed, they learn from new data, interact with systems and influence decision-making. That’s powerful but also unpredictable.
Left unchecked, an AI-driven forecasting tool might rely too heavily on outdated patterns, causing overproduction or supply chain bottlenecks. A chatbot designed to streamline customer service could unintentionally generate biased or off-brand responses.
Meanwhile, generative models trained on sensitive business documents can inadvertently expose proprietary information in future prompts. For example, a study released in January 2025 found that nearly 1 in 10 prompts used by business users when interacting with generative AI (GenAI) tools could inadvertently disclose sensitive data.
These aren’t abstract dangers; they’ve already appeared in public incidents. But it’s not just PR damage that’s at stake. AI errors can affect revenue, data security and even legal exposure. The absence of regulatory pressure doesn’t make these issues go away – it makes them easier to miss until they’re too big to ignore.
The smart play is internal governance: before you need it
Organizations are eager to integrate GenAI, with many teams already using these powerful tools in daily operations. This rapid adoption means that just passively monitoring things isn’t enough; a strong governance structure is crucial, one that can adapt as AI becomes more central to the business.
Setting up an internal AI governance council, ideally with leaders from IT, security, compliance and operations, offers that vital framework. This council isn’t there to stop innovation. Its job is to bring clarity. It typically reviews AI tools before they’re rolled out, sets clear usage policies and works with teams so they fully understand the benefits and limits of the AI they’re using.
This approach reduces unauthorized tool usage, makes auditing more efficient and helps leadership steer AI strategy with confidence. However, for governance to be effective, it must be integrated into broader enterprise systems, not siloed in spreadsheets or informal chats.
GRC platforms can anchor AI governance
Governance, risk and compliance (GRC) platforms already help businesses manage third-party risk, policy enforcement, incident response and internal audits. They’re now emerging as critical infrastructure for AI governance as well.
By centralizing policies, approvals and audit trails, GRC platforms help organizations track where AI is being used, which data sources are feeding it, and how outputs are monitored over time. They also create a transparent, repeatable process for teams to propose, evaluate and deploy AI tools with oversight so innovation doesn’t become improvisation.
Don’t count on vendors to handle it for you
Many tools advertise AI features with a sense of built-in safety, which includes privacy settings, explainable models and compliance-ready dashboards. But too often, the details are left up to the user.
If a vendor-trained model fails, your team will likely bear the operational and reputational costs. Businesses can’t afford to treat third-party AI as “set and forget.” Even licensed tools must be governed internally, especially if they’re learning from company data or making process-critical decisions.
The bottom line
With the U.S. blocking states from setting their own rules, many assumed federal regulation would follow quickly. However, the reality is more complicated. Draft legislation exists, but timelines are fuzzy, and political support is mixed.
In the meantime, every organization using AI is effectively writing its own rulebook. That’s a challenge and an opportunity, especially for companies that want to build trust, avoid missteps and confidently lead.
The organizations that define their governance now will have fewer fire drills later. They’ll also be better prepared for whatever federal rules eventually arrive because their internal structure won’t need a last-minute overhaul.
Because whether or not rules are enforced externally, your business still depends on getting AI right.
We’ve featured the best business plan software.
This article was produced as part of TechRadarPro’s Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
Add Comment