AI Regulations and the Chatbot Laws Already in Force

Also watch and listen

The signals

• Mike: privacy law was a patchwork; AI law is a minefield without a map. The state privacy build-out of the last five or six years produced roughly two dozen general privacy laws, and they rhyme: about 85% is the same template, so a company can comply with the common core and then handle California and the outliers. The AI laws arriving now share no template at all. They do not look like each other, they do not have commonalities, and some are starting to contradict each other outright. His other deflation, from watching GDPR land in 2018: EU enforcement went after Meta, Amazon, and Google, not small American companies, and the EU AI Act's December 2027 high-risk deadline deserves the same calibration. The exposure that should sit at the top of a US operator's risk ranking is domestic, state by state, and already in force.
• Sam: 63 legal instruments that were never made to work together. Building the legal graph layer under [EveryAILaw](https://everyailaw.com/) means splitting provisions mechanically, and the same week the show aired that meant separating the Article 50 transparency obligation from the Article 13 one, two different duties aimed at different people that travel under one word, and re-citing a Connecticut cure period that used the same words to mean different things in different sections. The instruments are inconsistent in a way that makes the inconsistency your problem: nobody upstream is going to clean it up, so someone has to break the ontology down until it is machine readable. Mike's on-air reaction: the best argument for why you need lawyers he has heard in a while.

The subtractions

• Mike: have AI write a lot less. A Claude user since it was just Claude, no numbers, no fantasy names, and he still uses it when he is stuck, for outlines, for something to throw ideas at. What he subtracted is the drafting. The tell that finally did it is all over LinkedIn, and it is not the em dashes or the "it's not just X, it's Y" constructions; it is prose written the way Captain Kirk talked, everything a short dramatic sentence. One or two of those work in a brief. An entire article of them does not, and he was publishing them.
• Sam: sensitive material never goes to a cloud model, and there is now an easy alternative. Legal material shared before the episode looked sensitive, so it never touched a cloud service. A local model running offline on the laptop stripped anything identifying and boiled eight pages down to about two while keeping the concepts, Sam read the output against the original to confirm nothing critical was dropped, and only that redacted version went to Claude for episode prep. A year ago that workflow was for the deeply technical; today it is a slow-but-easy default for anyone. It does not need to be instant, it needs to not share what should not be shared. Mike's counterpoint from the leak history: assume anything typed into a consumer chatbot can surface, ChatGPT has done it and Claude was reported doing something similar, and a lawyer's duty to protect confidential information starts at first contact, before any engagement is signed.

About this episode

The center of the episode is the rundown: the chatbot obligations already in force, state by state, stacked in one pass so the cumulative weight is visible. New York, reasonable measures against content promoting self-harm, up to $15,000 per incident from the Attorney General. California, the same plus preventing sexually explicit material reaching minors, an annual disclosure to a suicide-prevention agency, and a private right of action. Washington, no simulating distress, no dark-pattern pleas to stay or pay, no "don't tell your parents," private right of action. Oregon, the self-harm measures published openly plus a mandatory interrupt-and-refer when a user shows signs of suicidal ideation, private right of action again. Connecticut, no implying the bot is a mental health professional. Iowa, four duties: prevent creation of sexually explicit material, never claim to be human, do not create dependency on the chatbot, and provide privacy tools for minors and parents. Then healthcare on top: Illinois, Texas, Nevada, and claims-substantiation rules in California, Tennessee, and Colorado.

The jurisdictional hook is the part operators most often get wrong: if you have a website offering products or services to anyone in the US, these laws reach you. Most of the AI statutes skip the revenue thresholds privacy law uses; impacting consumers in the state is enough, and the internet goes everywhere.

The liability point lands through a hobby Mike picked up from a security-minded CEO: open any customer-help chatbot and treat it like ChatGPT. More often than not it behaves like a free frontier-model instance, set to do anything, like the dealership bot that offered a Chevy Suburban for $20. Contracting with a vendor does not move the liability; the laws put the deploying company on the hook for what the bot does. His standing advice: you do not want to be a test case, because the companies in those cases spend millions just to get back to where they were.

Mike is a lawyer, not your lawyer: nothing in the episode is legal advice. He practices at Law+Data and is part-time chief strategy officer at Bells Up AI.

This week's links:

• EveryAILaw — Sam's free index of AI regulations, referenced throughout
• Law+Data — Michael Simon's firm
• Bells Up AI — AI for law firms, where Mike is part-time CSO
• Michael Simon on LinkedIn — mention the show in the invite

This episode is sponsored by EveryAILaw, the free index of AI regulations cited on air as the episode's source. Disclosure: EveryAILaw is built and owned by Sam, the show's host.

Want to bring your own signal and subtraction? Find yours. Sponsored by EveryAILaw.

The newsletter

Issue 63 · Sunday 9 August 2026 · sent on Substack and LinkedIn.

One signal, one subtraction, one analogy, in five minutes. It draws on this episode but stands on its own. Every issue.