AI Rules Multiply as Enforcement Lands on Companies

By Grace Kim

More than 1,000 AI-related measures were introduced by U.S. states in 2025, according to the commentary “The Widening Gap Between AI Policy and Real-World Enforcement.” It says AI deployment across industries and applications is outpacing the maturity of policies and governance frameworks.

The EU is actively enforcing parts of the AI Act, according to the commentary. U.S. federal policy favors a less burdensome national framework. Executive Order 14365 seeks to limit conflicting state requirements.

The commentary says each authority describes a different destination. Companies building and deploying AI must reconcile those rules with their own risk tolerance, product objectives and operational realities. Before AI-specific requirements, companies governed deployments largely through consumer protection, privacy and industry-specific rules, alongside internal policies. New AI-specific requirements remain fragmented and often provide limited guidance on how systems should operate.

What changes when rules reach production?

Broad obligations must become operating controls and individual AI decisions, according to the commentary. No framework can anticipate every application, context or tradeoff. Organizations must connect governing requirements and internal policies to system behavior, measurable outcomes, and audit or review.

The commentary cites the NIST AI Risk Management Framework, which takes a similar view by emphasizing ongoing measurement and management rather than treating governance as a standalone compliance exercise.

The operating logic is direct: “Requirements flow down, and evidence flows back up: regulators and executives may define the desired outcomes, but organizations must demonstrate whether their systems are actually producing them.”

Deployers must provide that evidence, the commentary says. In plain terms: regulators set the goal, and companies must prove the system reaches it.

Who decides when AI acts?

The commentary notes that the FTC, DOJ, CFPB and EEOC jointly said they will enforce their existing authorities on automated systems. That means a company will eventually have to explain how its system decides.

A policy can address discrimination, user protection, transparency and meaningful human review. At the operating layer, the source says teams still have to answer:

• At what threshold should the system act?
• What evidence, and what level of confidence, should support action?
• When is human review required?
• What gets logged?
• What happens when the system is uncertain?

A profanity-laden message may be harmless banter between friends, while an innocuous-looking message may form part of a sustained campaign targeting another user, the commentary says. The system must judge which context it can use reliably and how much evidence is enough to intervene.

The available interventions are concrete: block the message, warn the sender, escalate for human review, or take no action. Lowering detection thresholds can catch more harm but suppress legitimate conversation. Human review can improve judgment but delay intervention.

None of those tradeoffs is settled by a general anti-harassment policy. An internal decision-maker must set, document and revisit them. The commentary puts the responsibility plainly: “That person is effectively writing policy whether or not the org chart says so.”

In plain terms: the policy does not act; the system’s thresholds and review rules do.

What does responsible AI require?

The commentary treats responsible AI as a property of daily system behavior, not a statement of intent. Companies must manage how AI is used, measured and corrected over time, rather than stop after approving a policy or passing an initial evaluation.

• Match governance to consequence. Recommending copy, approving a loan, flagging a security threat and supporting a medical decision carry different risks. Organizations should add stronger controls, review and oversight where consequences warrant them.
• Look beyond accuracy. A false positive in moderation may suppress legitimate speech, while errors in lending, healthcare or security carry heavier consequences. Governance should reflect real-world impact, not model performance alone.
• Evaluate continuously. Overrides, appeals, incidents, edge cases and downstream outcomes should feed ongoing evaluation.

In plain terms: a high model score cannot carry every risk, and governance cannot stop after launch.

How should companies build governance?

The commentary recommends four practices for translating principles into production systems:

• Embed governance from the start. Treat governance requirements as product and system requirements. Controls added after deployment tend to be costly and brittle; privacy, transparency, auditability and review mechanisms are easier to design in than retrofit.
• Build an auditable chain from policy to decision. Connect each governing requirement or internal policy to the control applied, the resulting decision and the evidence needed to evaluate it.
• Assign clear ownership and accountability. Name who owns the policy, determines acceptable risk and monitors performance. Give someone authority to intervene when the system behaves outside those bounds.
• Build shared, adaptable infrastructure. Data controls, audit trails, configurable policies, review workflows and measurement should support multiple regulatory requirements and use cases. Adjust controls and thresholds by jurisdiction, application and risk. Teams can then respond to changing rules without rebuilding systems.

In plain terms: governance works when it is designed, owned and measurable from launch.

What should companies prove next?

Internal governance is an operating responsibility, not merely a compliance exercise, according to the commentary. Every company deploying AI at scale already writes policy through its thresholds, review rules and escalation paths. The open question is whether companies do so deliberately.

The commentary’s author says they have seen this problem from several sides: in cybersecurity environments, building risk models and operating AI systems at scale. Their lesson is consistent: a framework works only when teams translate it into clear decisions, measure it in practice and improve it when reality exposes gaps.

Regulators will keep defining desired outcomes, and they will not always agree, the commentary says. Companies must turn those expectations into controls and show with evidence that the controls work. Those that build clear ownership, measurable controls, auditability and adaptable infrastructure now will be better positioned as regulation continues to evolve.