drkarenosburn.com

Bloomberg Law In-House Forum Tackles AI Regulatory Challenges for U.S. Companies

The rapidly evolving landscape of artificial intelligence regulation has become a focal point for corporate legal departments across the United States. At the recent Bloomberg Law In-House Forum, legal experts, corporate counsel, and regulatory specialists gathered to discuss the complex web of AI governance, with particular emphasis on the European Union’s AI Act and its significant implications for U.S. companies. The forum provided a platform for in-depth exploration of how American businesses must adapt to a changing international regulatory environment while navigating domestic AI oversight developments.

As AI technologies continue to transform business operations globally, companies face mounting pressure to implement responsible AI practices while complying with emerging regulations. The Bloomberg forum offered timely insights into this challenging landscape, highlighting both the opportunities and risks that AI presents to corporate America.

Understanding the EU AI Act: A Game-Changer for Global AI Governance

The European Union’s AI Act, widely recognized as the world’s first comprehensive legal framework for artificial intelligence, emerged as a central topic at the Bloomberg Law In-House Forum. Panelists emphasized that despite being an EU regulation, its impact extends far beyond European borders, creating significant compliance requirements for U.S. companies operating internationally.

Key Provisions of the EU AI Act

The EU AI Act introduces a risk-based approach to regulating AI systems, categorizing them based on their potential harm:

• Unacceptable Risk: AI applications deemed to pose an unacceptable risk to people’s safety, livelihoods, and rights are prohibited outright, including social scoring by governments and certain forms of biometric identification.
• High Risk: Systems that could harm health, safety, or fundamental rights face strict obligations before market entry, including risk assessments, high-quality datasets, logging capabilities, human oversight, and detailed documentation.
• Limited Risk: AI applications with specific transparency requirements, such as chatbots and deepfakes, where users must be informed they are interacting with AI.
• Minimal Risk: The vast majority of AI systems fall into this category and face minimal regulation, though voluntary codes of conduct are encouraged.

Forum speakers highlighted that the Act’s extraterritorial scope means U.S. companies offering AI systems or services within the EU market will need to comply regardless of whether they have a physical presence in Europe. This aspect particularly resonated with in-house counsel in attendance, many of whom represent companies with global operations.

Compliance Timelines and Enforcement Mechanisms

A critical aspect discussed during the forum was the implementation timeline of the EU AI Act. Experts outlined that following its adoption, companies face a phased compliance schedule:

• Within 6 months: Prohibitions on unacceptable risk AI systems take effect
• Within 12 months: Governance structures and transparency obligations become applicable
• Within 24 months: Requirements for high-risk AI systems become fully enforceable

Penalties for non-compliance are substantial, potentially reaching up to €35 million or 7{1fdce5344563ab5a80cc9264b2d1e04e67416106819158a47bf0bfd08f96b90e} of global annual turnover, depending on the violation and company size. This stringent enforcement mechanism underscores the EU’s commitment to establishing robust AI governance.

Panelists noted that even companies currently developing AI systems need to incorporate these requirements into their design processes now, as products launched in the coming years will need to demonstrate compliance with regulations that are already taking shape.

U.S. Regulatory Landscape: Fragmented but Evolving

The Bloomberg Law In-House Forum also examined the current state of AI regulation in the United States, which presents a stark contrast to the EU’s comprehensive approach. Speakers described the U.S. regulatory environment as a patchwork of federal agency guidance, state laws, and industry-specific requirements.

Federal Initiatives and Executive Action

Participants discussed President Biden’s Executive Order on Safe, Secure, and Trustworthy AI, issued in October 2023, which directs federal agencies to develop guidance and standards for AI use. While not creating binding legislation, the executive order signals increasing federal attention to AI governance.

The forum highlighted several key federal initiatives:

• The National Institute of Standards and Technology (NIST) AI Risk Management Framework
• Federal Trade Commission enforcement actions against deceptive AI claims and unfair algorithmic practices
• Equal Employment Opportunity Commission guidance on AI in hiring and employment decisions
• Food and Drug Administration frameworks for AI in medical devices

Corporate counsel at the forum expressed both appreciation for the flexibility of this approach and concern about the uncertainty it creates for compliance planning. Many noted that the absence of comprehensive federal legislation leaves companies navigating different requirements across jurisdictions.

State-Level AI Regulations

Several panelists highlighted the growing importance of state-level AI regulations, with California, Colorado, and New York emerging as early leaders. The California Consumer Privacy Act (CCPA) and its expansion under the California Privacy Rights Act (CPRA) were noted for their provisions on automated decision-making and profiling.

The recently proposed New York City AI hiring law was discussed as an example of municipal regulation that creates additional compliance considerations for businesses operating across multiple jurisdictions. This fragmentation presents particular challenges for national and multinational companies seeking to implement consistent AI governance frameworks.

Impact on U.S. Companies: Compliance Challenges and Strategic Responses

A significant portion of the Bloomberg Law In-House Forum focused on practical implications for U.S. businesses across various sectors. Panelists shared insights on how companies are responding to the dual pressures of EU compliance requirements and evolving domestic regulations.

Global Standards vs. Jurisdictional Compliance

A recurring theme in the discussions was whether companies should adopt a single, globally compliant approach to AI governance or tailor their practices to different jurisdictional requirements. Many participants indicated that their organizations are leaning toward the former, using the EU AI Act as a baseline for global compliance due to its comprehensive nature and stringent requirements.

One chief legal officer from a technology company shared: “While it may seem efficient to create market-specific AI products, the operational complexity and potential reputation risks of varying standards have led us to implement a unified compliance framework based on the most stringent requirements we face globally.”

This approach, sometimes called the “Brussels Effect,” demonstrates how EU regulations are effectively setting global standards as companies find it more efficient to standardize their practices at the highest compliance level rather than maintaining different systems for different markets.

Industry-Specific Considerations

The forum broke out into industry-specific sessions that highlighted unique challenges across sectors:

Financial Services

Representatives from banking and financial institutions discussed the intersection of AI regulations with existing financial compliance frameworks. They noted particular concerns around explainability requirements for AI used in credit decisions, fraud detection, and investment recommendations.

Compliance officers emphasized the need to document model governance processes and maintain human oversight for high-risk financial applications. Several mentioned implementing more robust model validation procedures and establishing AI ethics committees with cross-functional representation.

Healthcare and Life Sciences

For healthcare companies, the forum addressed the complex interplay between AI regulations, HIPAA compliance, and FDA requirements. Speakers highlighted challenges in implementing AI for clinical decision support while maintaining regulatory compliance across jurisdictions.

One panelist from a pharmaceutical company described their approach: “We’re implementing privacy-by-design principles in all AI development, ensuring data minimization and purpose limitation are built into our systems from the start. This helps address both EU requirements and domestic privacy concerns.”

Technology and Software

Technology companies face particularly complex challenges as both developers and users of AI systems. Discussions centered on how to implement compliance measures without stifling innovation and how to address liability concerns when deploying AI products in highly regulated markets.

Several speakers noted the competitive advantage that could come from demonstrating strong AI governance, with one chief technology officer stating: “We’re positioning our AI compliance program as a market differentiator, especially when selling to enterprise clients who have their own regulatory obligations to consider.”

Practical Strategies for Compliance and Risk Management

The Bloomberg Law In-House Forum provided actionable guidance for legal departments navigating the complex AI regulatory landscape. Experts outlined several key strategies that emerged as best practices:

Comprehensive AI Inventory and Risk Assessment

Speakers emphasized the importance of conducting a thorough inventory of all AI systems used within an organization as a crucial first step. This inventory should identify:

• AI applications currently in use or development
• Data sources feeding these systems
• Purposes and use cases for each application
• Potential risk categories under relevant regulations
• Cross-border implications of each system

This baseline assessment enables legal teams to prioritize compliance efforts based on risk levels and regulatory exposure. Several panelists recommended establishing cross-functional AI governance committees to oversee this process, including representatives from legal, IT, data science, privacy, and business units.

Documentation and Technical Requirements

The forum highlighted documentation requirements as a significant compliance challenge, particularly for high-risk AI systems under the EU AI Act. Speakers outlined key documentation needs:

• Technical documentation of AI systems and their development process
• Risk assessment procedures and results
• Data governance measures
• Monitoring systems for identifying and addressing bias
• Human oversight mechanisms
• Incident response protocols

One panelist noted: “Documentation isn’t just about compliance—it’s about creating institutional knowledge and accountability for AI systems that may be maintained by different teams over time.” Several participants mentioned implementing AI governance platforms to streamline documentation requirements and ensure consistency across their organizations.

Contractual Protections and Vendor Management

With many companies relying on third-party AI solutions, the forum dedicated significant attention to managing vendor relationships and contractual protections. Key recommendations included:

• Updating vendor assessment procedures to include AI-specific risk factors
• Revising standard contract terms to address AI compliance requirements
• Implementing right-to-audit provisions for high-risk AI applications
• Clarifying liability allocation for AI-related compliance failures
• Requiring vendors to maintain appropriate documentation and testing

Legal departments were advised to work closely with procurement teams to ensure AI vendors can demonstrate compliance with relevant regulations and provide necessary documentation to support the company’s own compliance efforts.

The Role of In-House Counsel in AI Governance

A central theme throughout the Bloomberg Law In-House Forum was the evolving role of corporate legal departments in AI governance. Speakers emphasized that in-house counsel must become strategic partners in AI implementation rather than merely addressing compliance after systems are deployed.

Building AI Literacy Within Legal Teams

Panelists discussed the importance of developing AI literacy among legal professionals. Many organizations represented at the forum have implemented training programs to help their legal teams understand AI technologies, their capabilities, and their limitations. This knowledge enables more effective risk assessment and more productive collaboration with technical teams.

One general counsel shared their approach: “We’ve created a specialized AI legal task force within our department, combining attorneys who have expressed interest in the technology with those who support business units deploying AI. We provide them with additional technical training and opportunities to work directly with our data science teams.”

Establishing AI Ethics Committees and Governance Structures

The forum highlighted the growing trend of establishing formal AI governance structures within organizations. These typically include:

• AI Ethics Committees with cross-functional representation
• AI Review Boards for evaluating high-risk applications
• Clear escalation pathways for AI-related concerns
• Regular reporting to executive leadership and boards

Legal departments often play a central role in these structures, helping to translate ethical principles and regulatory requirements into operational policies. Several speakers noted that these governance mechanisms help demonstrate compliance with the human oversight requirements in the EU AI Act and similar regulations.

Balancing Innovation and Compliance

A recurring challenge discussed at the forum was how legal teams can support innovation while ensuring compliance. Panelists emphasized the importance of early engagement with business and technical teams to incorporate regulatory considerations into the design process rather than attempting to retrofit compliance after development.

One chief innovation officer described their collaborative approach: “We’ve implemented a ‘legal by design’ framework where our attorneys participate in product development sprints and AI training sessions. This prevents legal review from becoming a bottleneck and helps technical teams understand the ‘why’ behind compliance requirements.”

Future Outlook: Preparing for an Evolving Regulatory Landscape

The concluding sessions of the Bloomberg Law In-House Forum looked ahead to anticipated developments in AI regulation and how companies can prepare for continued evolution in this space.

Anticipated Regulatory Developments

Experts predicted several key trends in the regulatory landscape:

• Global Regulatory Convergence: While approaches may differ, core principles around transparency, fairness, and human oversight are likely to appear across jurisdictions.
• Sectoral Regulation: Industry-specific AI requirements will continue to emerge, particularly in highly regulated fields like healthcare, financial services, and transportation.
• Technical Standards: International standards bodies will develop technical specifications that may be incorporated into regulations by reference.
• Enforcement Actions: As regulations mature, enforcement actions will provide important guidance on regulatory expectations and interpretation.

Several panelists noted that even in the absence of comprehensive legislation, U.S. regulators are increasingly using existing authorities to address AI-related harms, particularly regarding consumer protection, privacy, and discrimination.

Building Adaptive Compliance Programs

Given the dynamic nature of both AI technology and its regulation, speakers emphasized the importance of building flexible compliance frameworks that can adapt to changing requirements. Recommendations included:

• Implementing modular compliance programs that can incorporate new requirements
• Establishing regular review cycles for AI governance policies
• Monitoring regulatory developments across key jurisdictions
• Participating in industry associations and standard-setting bodies
• Developing relationships with regulators where appropriate

One panelist advised: “Don’t wait for perfect regulatory clarity before acting. Implement strong governance based on established principles, and you’ll be better positioned to adapt as specific requirements evolve.”

Implications for Business Strategy and Competitive Positioning

Beyond compliance considerations, the Bloomberg Law In-House Forum explored how AI regulation affects business strategy and competitive positioning. Several speakers framed effective AI governance as a potential source of competitive advantage rather than merely a compliance burden.

Responsible AI as a Market Differentiator

Participants discussed how demonstrating strong AI governance can build trust with customers, partners, and regulators. Companies with robust compliance frameworks may find advantages in:

• Accelerated procurement processes for enterprise clients with strict vendor requirements
• Enhanced brand reputation in privacy-sensitive markets
• Reduced risk of regulatory enforcement actions and associated penalties
• Greater agility in entering regulated markets

One chief marketing officer noted: “We’re finding that our investments in explainable AI and strong governance are becoming selling points, particularly with European clients who have their own compliance obligations to consider.”

Strategic Considerations for International Operations

For U.S. companies with global operations, the forum addressed strategic questions about market entry and product development in light of varying regulatory requirements. Speakers discussed approaches ranging from developing market-specific AI products to implementing globally consistent standards based on the most stringent requirements.

Several participants noted that regulatory considerations are increasingly influencing decisions about where to develop and deploy AI systems, with some companies choosing to establish AI research centers in jurisdictions with clear regulatory frameworks to ensure compliance from the earliest stages of development.

Conclusion: Navigating the Complex Intersection of Innovation and Regulation

The Bloomberg Law In-House Forum provided a comprehensive exploration of the challenges and opportunities presented by the evolving AI regulatory landscape. As U.S. companies navigate the requirements of the EU AI Act and domestic regulations, in-house legal teams are taking on increasingly strategic roles in AI governance and implementation.

Key takeaways from the forum included:

• The EU AI Act’s extraterritorial impact makes it relevant for U.S. companies operating globally
• A fragmented but evolving U.S. regulatory landscape requires adaptable compliance strategies
• Industry-specific considerations shape AI governance approaches across sectors
• Practical compliance strategies should include comprehensive AI inventories, robust documentation, and vendor management
• In-house counsel play a critical role in balancing innovation with regulatory compliance
• Forward-looking companies are positioning AI governance as a competitive advantage

As one forum participant summarized: “The companies that will thrive in this environment are those that view AI governance not as a checkbox exercise but as a fundamental aspect of responsible innovation. By embedding compliance considerations into AI development from the start, they can deploy powerful technologies while managing risks effectively.”

The discussions at the Bloomberg Law In-House Forum highlighted that while regulatory compliance presents challenges, it also creates a framework for responsible AI development that can build trust with customers, employees, and society at large. As the technology and regulatory landscape continue to evolve, ongoing dialogue between legal experts, technologists, and business leaders will be essential to navigating this complex terrain successfully.