Picture the first memo of the year from a company's legal team, the kind that lands on a technology leader's desk on the first Monday back. It is invented for this dispatch. Page one lists the AI laws that took effect on Thursday. Page two describes a federal order that sets out to challenge state AI laws, and a lawsuit that asks a court to block one of them. The memo ends with the question everyone wants answered: which of these rules will still apply a year from now? Nobody can say. That question is the wrong place to start.
On January 1 several state laws took effect. California's SB 53 requires the largest developers of frontier models to publish a frontier AI framework, and frontier developers to report critical safety incidents to the state.1 California's AB 2013 requires developers of public generative AI systems to publish high-level information about their training data.2 Texas's Responsible Artificial Intelligence Governance Act prohibits certain uses of AI and gives the attorney general power to investigate.3 And an amendment to the Illinois Human Rights Act makes it a civil rights violation for an employer to use AI that has the effect of discriminating against employees, or to fail to tell them it is using AI for those decisions.4 Two other laws did not start: California's AI Transparency Act was moved to August 2,5 and Colorado's AI Act to June 30.2
My argument is that a technology leader should stop trying to guess which rule will survive and start preparing for what every rule will ask. The laws differ in whom they cover and what they prohibit. They overlap heavily in the facts they need: what a system is for, what data trained it, what it takes in and puts out, how well it works, where it fails, and who watches it after launch. Those facts are useful whatever the courts decide. This is not legal advice, and it is not a prediction about any case.
- Dec 11Federal order directs challenges to state AI laws
- Dec 29Suit asks a court to block California's training-data law
- Jan 1State AI laws take effect in California, Texas and Illinois
Jan 6Open question: what can we show about each system?
The order and the lawsuit
On December 11 the President signed an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence." It directs the attorney general to set up an AI Litigation Task Force within 30 days to challenge state AI laws, and the Secretary of Commerce to publish an evaluation of state laws within 90 days. It also ties some broadband funding to state AI laws, asks the federal communications and trade regulators to consider their own steps, and calls for legislation, while proposing that some state laws, such as those on child safety, be left alone.6 The order does not itself strike down any law, and it says it creates no enforceable rights.6
On December 29, xAI sued California's attorney general to block AB 2013. The complaint argues that the law forces disclosure of trade secrets, amounts to a taking of property without compensation, and compels speech in violation of the First Amendment. Training datasets, it says, are "valuable precisely because they are not public."7 How a court will rule is unknown.
Most companies are not frontier developers
SB 53 is the law that drew the headlines, but it reaches few companies. Its definitions cover models trained with more than 1026 operations, and its framework duty falls on developers with more than $500 million in annual revenue. Penalties run up to $1 million per violation, enforced by the attorney general alone.1 An ordinary enterprise is more likely to meet the rules that apply to using AI: Illinois's rule on employment decisions, Texas's prohibitions and investigative demands, and California's new privacy regulations, whose risk-assessment requirements began on January 1, with rules for automated decision-making technology to follow on January 1, 2027.8 The question for most leaders is not whether they build frontier models. It is where they use AI in decisions about people.
The questions converge
The Texas statute is unusually concrete about what it may ask for. If the attorney general receives a complaint, the office may demand a description of an AI system's purpose and deployment context, the type of data used to train it, the categories of data it takes in, the outputs it produces, the metrics used to judge its performance, its known limitations, and the monitoring and safeguards in place after deployment.3 Set that list beside the other laws and the overlap is plain. AB 2013 asks about training data. SB 53 asks frontier developers about incidents after release. Illinois requires an employer to know, and tell employees, where AI is used in their employment decisions.
What each rule asks · editorial mapping, simplified
| The record | Texas demand | CA AB 2013 | CA SB 53 | IL employment |
|---|---|---|---|---|
| Purpose and context | asks | asks | ||
| Training data | asks | asks | ||
| Inputs | asks | |||
| Outputs | asks | |||
| Performance measures | asks | |||
| Known limitations | asks | |||
| Monitoring after launch | asks | asks | ||
| Use on people, with notice | asks |
A record, not a bet
The Texas law even rewards keeping such a record. A defendant cannot be found liable if it discovered a violation itself, for example through adversarial or red-team testing, or through an internal review while substantially complying with the NIST AI Risk Management Framework's Generative AI Profile or a similar recognized framework.3 It also gives an organization 60 days after notice to cure a violation before the attorney general can sue.3 Sixty days is a short time to reconstruct what a system was for and how it was tested if no one wrote it down.
Two limits keep this honest. The Texas law is about intent: it says that a disparate impact alone does not show an intent to discriminate, so it is not a general bias-audit statute.3 And building the record costs money and time, and it can surface uses of AI that no one approved. That discovery is the point. In the language of this series' first essay, an AI system is something you own and operate, not an appliance you plug in, and owning it includes knowing what it does.
Objections, considered
Why spend money on rules that may be struck down? Because the record is not specific to any one rule. The facts in Figure 2 are what a buyer, an auditor or a board would ask about an AI system even if no state law survived.
Our vendors are responsible for their models. For some duties they may be. But the purpose, the inputs and the decisions a system feeds belong to the organization that deploys it, and only it can describe them.
A written record creates legal exposure. That is a question for counsel, and a real one. It is a reason to involve them in how the record is kept, not a reason to leave the facts unknown.
Three questions for this week
- Where do we use AI in decisions about people? List the systems that touch hiring, promotion, discipline, pricing or service decisions, including those inside vendor products.
- Could we answer the Texas list in 60 days? For each system, check whether purpose, training data, inputs, outputs, performance, limits and monitoring are written down today.
- Who updates the record when the model changes? Ask what happens to the record when a vendor ships a new model version.
Back to the memo. Its last question, which rule will survive, stays open, and the lawyers will keep working on it. Under it goes a second page the technology team can write this week: for each system, eight short answers. Whichever rules survive the year, that page will be asked for.