States Introduced Over 1,000 AI Measures in 2025. Enforcement Still Falls on Employers

U.S. state legislatures introduced more than 1,000 AI-related measures in 2025, even as Executive Order 14365 pushes a lighter national framework — and the practical burden of reconciling all of it lands on the companies deploying AI systems, according to a new analysis of the gap between AI policy and enforcement.

The piece, published as a thought-leader essay on Unite.AI, argues that AI is being deployed faster than governance frameworks can mature. The EU is now actively enforcing parts of the AI Act, while U.S. federal policy explicitly favors a less burdensome national approach. Historically, AI applications were governed through existing consumer protection, privacy, and industry-specific regulations plus companies' internal policies. Governments are now issuing AI-specific requirements, but those remain fragmented and offer limited guidance on how systems should actually operate.

What does that mean for employers?

Four federal regulators — the FTC, DOJ, CFPB, and EEOC — have said jointly that they will enforce their existing authorities on automated systems. The EEOC's involvement means AI tools that screen, rank, or evaluate people fall squarely in scope. As the analysis puts it: someone will eventually ask a company to explain how its system decides.

That's the crux. A policy can say "prevent discrimination" or "allow meaningful human review," but an operational system has to answer far more specific questions:

• At what threshold does it act, based on what evidence and with what confidence?
• When is human review required?
• What gets logged?
• What happens when the system is uncertain?

The essay's sharpest point: no policy document settles those tradeoffs in advance, so someone inside the company has to decide them, document them, and revisit them. "That person is effectively writing policy whether or not the org chart says so." For HR, the implication is direct — whoever configures an AI screening tool's thresholds and escalation rules is making consequential employment decisions.

The author uses a content-moderation example to show why this is hard. A message containing profanity may be harmless banter between friends; a seemingly innocuous message may be part of a harassment campaign. Lowering detection thresholds catches more harmful behavior but suppresses legitimate conversation. Requiring human review improves judgment but delays intervention. None of those decisions comes from the general policy — yet together they determine how the policy is actually enforced.

What does responsible AI require in practice?

The analysis lays out three principles:

• Governance should be proportional to consequence. A system that recommends copy, approves a loan, flags a security threat, or supports a medical decision creates very different risks, and controls should scale accordingly.
• Accuracy alone is insufficient. Different errors carry different costs — a false positive in moderation may suppress legitimate speech, while a mistake in lending, healthcare, or security carries far heavier consequences. Governance has to reflect real-world impact, not just model performance.
• Continuous evaluation and feedback are essential. Overrides, appeals, incidents, edge cases, and downstream outcomes should all feed ongoing evaluation.

The NIST AI Risk Management Framework takes a similar view, the author notes, emphasizing ongoing measurement and management rather than treating governance as a standalone compliance exercise. Requirements flow down; evidence flows back up.

How can companies build the audit chain?

Four practices anchor the recommended internal governance framework:

• Treat governance requirements as product and system requirements from the start — compliance controls added after deployment tend to be costly and brittle, while privacy, transparency, auditability, and review mechanisms are easier to design in than retrofit.
• Build an auditable chain from policy to decision, connecting each governing requirement to the control applied and the resulting decision.
• Assign clear ownership: who owns the policy, who determines acceptable risk, who monitors performance, and who has authority to intervene when the system behaves outside bounds.
• Build shared, adaptable governance infrastructure — data controls, audit trails, configurable policies, review workflows, and measurement that support multiple regulatory requirements, with thresholds adaptable by jurisdiction, application, and risk.

The author, who writes from experience in cybersecurity, risk modeling, and operating AI systems at scale, closes with a plain warning: "Every company that deploys AI at scale is already writing policy through its thresholds, its review rules, and its escalation paths, and the only open question is whether it does so on purpose."

Regulators will keep defining outcomes and won't always agree with each other, the analysis concludes — so companies that build clear ownership, measurable controls, auditability, and adaptable infrastructure now will be better positioned as regulation keeps evolving.