Understanding Legal and Regulatory Shifts in AI Policy Compliance

A presentation by John Pavolotsky of Stoel Rives given at University of California, Davis School of Law highlighted the fast-evolving legal and regulatory landscape of AI policy and emphasized the need for a tailored, up-to-the-minute understanding of legal developments.

AI’s global and multifaceted nature, including developers, deployers, investors, and infrastructure providers, means risks and opportunities are highly context-dependent. A strategic framework is essential for organizations to assess how these developments apply to their operations.

The AI legal environment is marked by rapid innovation and regulatory movement at both the state and federal levels as well as internationally. In California alone, the number of AI-related bills surged in early 2025, with key proposals such as AB 222 focusing on energy reporting for data centers and SB 53 potentially setting new guardrails for AI frontier models.

Other states and countries are similarly active, signaling a fragmented and increasingly complex compliance environment around AI policy. Meanwhile, state regulators, such as the California and Oregon Attorneys General, have reinforced the concept that existing laws concerning consumer protection and privacy apply broadly to AI.

Federal efforts remain piecemeal, with thirteen AI bills introduced at the presentation, and a Trump executive order shifting the focus to promoting US AI leadership.

While the European Union AI Act’s compliance deadlines loom, particularly for high-risk systems, guidance remains murky. In parallel, enforcement bodies like the FTC are targeting deceptive AI claims rather than issuing broad regulations.

The regulatory momentum underscores the importance of businesses understanding not only headline-grabbing developments but also how discrete AI use cases are scrutinized.

Lawyers advising clients on AI should move beyond general awareness and help implement actionable strategies, including tailored legal digests, compliance tracking, disclosure protocols, AI-specific contract terms, and policies for AI-generated content.