Volume II · Episode 6 · Transcript
AI Regulations and the Chatbot Laws Already in Force
Full transcript of the recorded conversation.
Back to the episode · timestamps jump to the video · lightly machine-transcribed, may contain errors
0:00 Michael Simon
We're really into a minefield here. It's a minefield without a map.
one of the things I tell clients constantly is, you do not want to be a test case.
0:19 Sam Rogers
Welcome to Signals and Subtractions. I'm your host, Sam Rogers. On Sunday, Article 50 of the EU AI Act went into effect, and with it, California's new AI transparency law. Most of the attention went to these big headlines. But what didn't is probably what matters to you. There are already chatbot laws in force in nine states, and more AI regulations landing with
Every legislative session, so the rules are changing all the time. Maine just six days ago. Colorado more happens a week from now. There's been lots of flip-flopping European schedule slippage and suits in many states. So it makes you wish you knew someone with 30 years experience watching organizations
And what they do when a rule meets a system that nobody's documented yet. And lucky for us, our guest today is Michael Simon. He practiced as a trial attorney for seven years, I believe it was,
1:22 Michael Simon
Almost seven, yes.
1:23 Sam Rogers
and left to found a legal technology startup, spent more than a decade building privacy and e-discovery products, went back to practicing law, now advises companies on data privacy.
And AI governance. He co-chairs the ABA Business Law Subcommittee on Consumer Privacy and Data Analytics. He's the perfect person to talk to about AI legislation. Mike, I'm so glad you're here.
1:49 Michael Simon
And I'm glad to be here, Sam.
1:50 Sam Rogers
So you were writing papers about AI like way back in the the before times of twenty eighteen. Yeah.
1:56 Michael Simon
Well before it was cool, man.
1:59 Sam Rogers
saying that AI automation was already shaping what counts as legal work. And eight years later, a few things have changed. what would you say still surprises you now?
2:11 Michael Simon
Wow, that's a good question. two things. The suddenness of the arrival of the era we're in. most people I talk to, when you talk about AI, they're like, Yeah, Chat GPT is so cool. I love this AI.
The phrase AI was invented in like 1957. Hey everybody, let's take a guess as to when the first chatbot came about. Nobody gets 1967 with the program Eliza, the first chatbot.
2:41 Sam Rogers
Eliza chat, yeah.
2:42 Michael Simon
the degree to which we went from really cool, difficult to use.
by serious nerds and occasional quasi-nerds like me, to things that everybody can access, everybody can vibe code, everybody can do things with. wow.
that's fast second thing at least in legal the absolute lack of us doing anything about it in terms of impacting the legal profession we are slowly getting to it in the laws and that's by the way one of the reasons I love what you have available which is the list of those laws
3:19 Sam Rogers
Yeah, thanks. I I made that because I needed it. what Mike's referencing is everyailaw dot com. And that has been my goal is to capture all of the AI regulations in one spot just so as someone running a business, I can figure out what my obligations are.
I wish I didn't have to make that. I I've talked to you of course, Mike. I've looked for other like things in the world, but apparently things like that aren't generally open and free, so I'm I'm hoping to
3:48 Michael Simon
No.
3:49 Sam Rogers
change that.
3:49 Michael Simon
There's a few
around some of the big law firms have trackers, but they tend to track way too much, and
3:55 Sam Rogers
Yeah.
3:55 Michael Simon
they tend to track it in ways of like, hey, let's play a game here. Let me click on Washington. Cool, done with that. Let me click on New Jersey. Go fish. Do you have any Connecticuts? You know, it's it's a simple list that breaks everything down, is a godsend, and I've done it with privacy laws. I would invent one for AI, but you've already done it, so thank
Thank you.
4:24 Sam Rogers
Well,
yeah, thanks for the thanks for the plug. although Mike is a lawyer, he is not your lawyer, so whatever disclaimers you want to make about that, Mike, feel free.
4:33 Michael Simon
all right, disclaimers. I am a lawyer. This is not legal advice. This does not form an attorney-client relationship.
if you have a problem you'd like to get assistance with, I think we'll do all that contact info at the end.
4:45 Sam Rogers
So
the EU AI Act
we don't need to get too deep in. I just wanted to make sure that people are aware, as the context for this conversation,
All this did just change on Sunday. Yes, that's a real thing. and Mike, if you could just give like like one minute of overview on what
5:04 Michael Simon
All right.
5:04 Sam Rogers
is different now and if it affects people, how?
5:08 Michael Simon
absolutely and absolutely also not. So the words to focus on here is annex three: high risk.
If your AI system is listed in Annex 3, then there's a lot of things that apply to you. Disclosures, monitoring, testing, certifications, unless you're doing something like large-scale mass public monitoring. yeah, I don't I don't do that stuff. I'll just tell you to stop. Otherwise you're not at at
At a particular risk that's going to have a lot of requirements. The second thing is to note December 2027. That's one of the two reasons why we're not going to pay much attention to this after this part of the segment. The second reason is that it's a lesson learned from GDPR by everybody. GDPR is the EU's data privacy protection law. It became effective in 2018, and a lot of people, perhaps maybe even me, jumped up and down and
And said, everybody look out. we did the the Kermit the Frog thing. you know, it's coming for all of ya. Look out, and it was a resounding thud. Just just look, the EU under GDPR has indeed gone after American companies. It's gone after Meta? Amazon? Google?
Do see any pattern there? If if you are not a multi-billion dollar business trading huge amounts of data back and forth and acting within the EU,
GDPR is not really a major issue to you unless you are very deliberately targeting the EU. I have some clients who do that. We get them set up the right way, but by and large, it is not a major issue for American companies. And yes, I know I'm not supposed to say that because it drives away business of people calling me, my God, GDPR. There are all kinds of data privacy laws in America that will impact your company. At the same time.
The EU AI Act. Again, we're not even into enforcement yet. We've got more than a year, but even when it shows up, will they go after the big players? Probably. Will they go after small US companies? it's not something that needs to be the top of your risk.
rankings, what needs to be at the top of your risk rankings, or all these other things that we are now going to talk about. And again, the list, but but I don't want to embarrass Sam too much by shilling that too much. Was that a minute? That was more than a minute. well, close. Close. We'll call it a
7:37 Sam Rogers
That that that was a little more than a minute, but it was very appropriate and and very thorough.
7:43 Michael Simon
lawyer's minute. I I I'll just bill you for one. How's that sound?
7:47 Sam Rogers
Why thank you. So gracious of you. I do have another slide that I'm labeling federal framework-ish, because as we're getting into the American side of things, there are some things that have happened that are kind of pinging back and forth pretty hard.
you could just set that context.
8:02 Michael Simon
I took it.
8:03 Sam Rogers
We don't need to stay at this level either, but from the EU to the federal level of the US.
8:09 Michael Simon
Okay. I will start with the overarching statement. There is no federal regulation of AI. Period.
None of what's on that slide changes that. We have a lot of stuff going back and forth. We have claims for this, then for that, and it changes. And even if you're gonna stick on one of them, okay, there's an executive order claiming preemption. Do you know how much impact an executive order has upon actual preemption of laws?
You cannot preempt state laws
without a federal law that preempts them. Period. You can do all kinds of things to potentially
Cause state legislators or governors to want to play along and preempt themselves and do things that will degrade their own laws. We've seen that in Texas and we've seen that in Colorado, and we've seen actually full court presses in Utah that worked. But we're also seeing what is an absolute mad world of
laws I'm gonna go through some of them
It's all over the place. One thing that that Sam and I talked about before this is I co-write along with my friend, Canadian AI expert Andrew Perry, the yearly ABA annual survey on AI law and regulation. And we set it to start with a theme song.
I write I write articles with theme songs. The theme song for this year's annual survey is Mad World,
and it is a mad world. We are seeing.
a federal administration that cannot get its act together that is at war with itself we are seeing states that are all over the place and what happens is that it creates a dangerous regulatory environment take a step back privacy
in the privacy world, we had a build-out for about the last five, six years of state privacy laws one by one. We're now up to twenty-one laws and other countings, twenty-two, twenty-three, twenty-four, which by the way should show you there's a problem. We can't even agree on how many laws we have.
But we have, let's say, 24 state general privacy laws that cover from A to Z in privacy. Some have added more things, but there's a basic set of a template there. And that template, there are commonalities, and I have written and I have spoken about how 85% of it is the same stuff and you can comply with it. And then you pick certain priorities like California, which is the biggest economy and regulator by far of privacy. Or you look for certain outliers and how to handle those.
And so it's it's dealable with. It's it may be a patchwork, but it's a patchwork that uses the same colors and the same tones on the same quilt. We're really into a minefield here. It's a minefield without a map. And so we'll go through some of these in what other order you want.
10:57 Sam Rogers
we were just starting with the the signal part and
11:00 Michael Simon
Okay.
11:01 Sam Rogers
and let me let me contribute mine as well as someone who's building that every AI law tool, what's upstream of that is the ontology of law and making that work at agenc speeds, which is there's a whole legal graph layer that I've been working on. And just in the last week, I've been
Surprised just how not knowable so many things are until you really break them down mechanically. Like
11:26 Michael Simon
Yeah.
11:27 Sam Rogers
for for working with that ontology clear example this week
basically there were like 63 different legal instruments that had never been made to work together from all these different j jurisdictions. They're inconsistent, but they're inconsistent in a way that like makes it your problem. they're not going to clean it up and make the the pieces fit together. So someone breaking down all of
the ontology of it to make it machine readable. I was just stunned at that signal because I've been working on this product for six months now, and I just didn't expect the layer of crazy that I encountered just in the last week as I started tightening some things up.
12:13 Michael Simon
Alright, do me a favor and we're done with this. Send me the recording. I want to edit your part, what you just said down. And the next time somebody goes, Why do we need all you damn lawyers anyway? That was an awesome argument for why you need us all. Guess what? It's gonna get worse. Way, way worse.
12:31 Sam Rogers
So I know you've got a couple things that you're waiting to surprise me with, Mike.
12:37 Michael Simon
You know, I was thinking about what have I subtracted? And here's an odd thing for somebody who
advises company on AI who works with AI companies and works with AI all the time. I have been a big Claude fanboy since it was just simply Claude. No numbers, no fantasy
12:54 Sam Rogers
Yeah. Yeah.
12:55 Michael Simon
names, just Claude. here's what I've come about doing in the last just few months.
I have used it to help me write a lot of things, and I have realized I need to have it help me write a lot less. it can help me when I'm stuck. It can help me sometimes with an outline or work on ideas, someone to throw things at, you know, someone. funny how we always anthromorphize it.
13:17 Sam Rogers
Yeah.
13:17 Michael Simon
But
I have now realized it's actually the the number one tell of all the LinkedIn posts on LinkedIn that are written with AI, in addition to the fact, you know, it's a LinkedIn post on LinkedIn at these days, is not the m-dashes. Most people have gotten wise to that.
13:34 Sam Rogers
Okay.
13:35 Michael Simon
it's not the negative parallelisms.
it is actually that it's written like Captain Kirk, William Shatner, talked in in the original Star Trek. It's
13:47 Sam Rogers
Ha ha.
13:48 Michael Simon
it's over and over again. You get this. Yeah.
This new law is important. It's not just a law. It's how you must do business. It's how you do it's like Spock, do something, you know, kind of writing.
13:59 Sam Rogers
Yeah.
14:01 Michael Simon
my god, it file it's just like, look, I I'll write that way and I'll use like maybe one or two short dramatic sentences in something. I I do that when I was writing, you know, briefs and things. You can't write an entire article in in short dramatic sentences. It just doesn't work.
14:19 Sam Rogers
that's a great subtraction. I'd love to be able to add my own and then go to if you have another
14:23 Michael Simon
Go for it. Then we'll get to the laws.
14:25 Sam Rogers
I wanted to make sure that people know that sensitive materials don't go into LLMs and just what the alternatives are.
I wanted to use the example of some legal material that Mike and I were sharing before this episode.
14:44 Sam Rogers
I did not. I did not.
because I I suspected that it might be sensitive. I didn't want to upload it to the cloud version of AI, but I did use a local version of AI. In this case, I used Gemma 4, to be able to run locally on my computer, something that's not connected to the internet, to be able to kind of strip out anything that might be sensitive in this material.
And stay with the concepts. So it was refining what was, I don't know, eight pages of content down to about two and removing anything that might possibly be sensitive while retaining the concepts that I needed to do my prep for this episode. So using a local model, you can redact essentially the identifying parts, or of course, you can always move at human speed.
And you can actually read the entire thing. I did read most of it as well, Mike, but mostly just to check the AI and make sure that I wasn't dropping anything that that was critical. so I scanned it, but the scan that was done with AI, I then could to take my local version and bring that to Claude and help build out the prep for this episode. So nothing was shared that shouldn't be shared, and that subtraction element.
is pretty critical and I don't know that everybody knows just how easy that is to do now. A year ago it wasn't so easy. It is now very easy and a great default for if you're not sure being able to use local LLMs on your device that don't take up a ton of room and that can they're not as fast as typing into ChatGPT. You might give it 10 minutes to run, you might hear the fans come on. But like for a task like this.
I don't need it to be instant. I just need it to be effective and most importantly, not to share anything that I shouldn't share.
16:44 Michael Simon
That's cool. So first you did this great pitch for why people need lawyers, and now you've hit with the reality of why lawyers do too much and overdo things. Awesome. Both are very valid, by the way.
I think your
ordinary non nerdy person is not likely to install a local LL You can do it. I'll be honest, I haven't. it's one of the reasons I I joined up to help invent an AI that would preserve that confidentiality and not let it leak out. but I recognize that that is
One way to solve what is a very clear problem. I will tell you, one of the things I've written about multiple times on LinkedIn is the leaks. OpenAI ChatGPT has had a bad history of publishing things, making available on the internet things that other people did not want to see, and just last week
It was revealed that Claude, Anthropics Claude, did the same thing or a similar thing. We don't know if it's the same technical problem. And when I started digging into it, I discovered that in fact this was not something that happened last week. It started happening back in September last year. And they said they fixed it. And the way they said they fixed it, Wired called them out immediately.
on that saying this is not going to fix it. And it didn't. So you know it is a concern. if you're
doing something and you don't want that shared. I know these things seem like they're trying to convince you they're your friend. They're your they're your they're your therapist. dear God, don't don't believe that, please. It's not your therapist. That was the Eliza effect back in 1967 that caused, by the way, when we mentioned that
Less than 10 years later, the guy who invented Eliza, the first chatbot Joseph Weisenbaum, was writing a book saying, this is bad, I never should have done this, and humanity should never do this again.
Do not let it convince you that you should just share everything and it's just gonna be fine.
18:42 Sam Rogers
Yeah, yeah, that's that's a really important message, I think. as we're moving fast, what are the things we're breaking along the way? some things you can't get back, and privacy's one of them. it's one thing for our own privacy, we're making that choice. may not be an informed choice, but at least it is a choice. But especially when you're dealing with other people's information, now there's a liability element.
19:05 Michael Simon
If you contact me, I have to treat your confidential information.
as sancrosanct. I can't reveal it. I have to take in fact anything I do, I have to take reasonable steps to protect it. And a reasonable step is not typing it into a system that says it could train on that data, that it it retains that data for who knows how long? A year, a decade, the heat death of the universe, who knows?
19:33 Sam Rogers
Some somewhere in in there, yeah.
19:34 Michael Simon
Yeah, somewhere in between. Likely.
let's get to the laws.
look, all this has just been a run-up. Let's really start scaring people.
19:42 Sam Rogers
Mike, I'd love to hear what are some of the things that jump out to you from this list.
19:49 Michael Simon
it's easy to go, but that doesn't affect me. Well, it does. Look, if if you
Have a website. If you are offering products or services to anybody in the US, congrats. you're impacted by all of these. there may be additional jurisdictional hooks like minimum revenues or minimum impact upon the state, but that tends to be more of a privacy law thing. In these laws that are getting passed for AI, it's as long as you impact consumers, and that's real, real, real hard not to do in a state.
Because the internet goes everywhere. yeah, you're impacting consumers everywhere.
So let's go to the chatbots. Let's start with some of the big states, states that you cannot ignore. New York. You must take reasonable measures to prevent content that promotes self-harm.
If you do not do that, the New York Attorney General is authorized to fine you up to fifteen thousand dollars per incident. And since an incident means perhaps every time you access the thing, that could be bad. That could be a lot of money. And the New York Attorney General's office is big. So is California. They then take that New York law and they have added that you have to set that chatbot to prevent.
the revealing to minors of sexually explicit materials, an additional one.
You also then have to do an annual disclosure of those things you do to prevent self-harm to a California agency designed to prevent suicide. So now you've got two additional things. And California, not only are they by far the biggest attorney general, at least in privacy world, they are the ones everyone's afraid of. Hey, it's got a private right of action. So at some point, the plaintiff's class action lawyers, who I have worked with at times as an expert, they are smart, they are creative.
Creative, they'll find a way because that's a lot of money they can make. So now we get to some other states.
So Washington also created a law that kind of looks like the other ones, except they added something. Your chat bot must be designed to prevent it from simulating distress. For you know, I I need to go now.
No, don't go. That breaks the law. you know, you know what? You'll need to purchase this or pay additional tokens to keep going, my friend. That breaks the law. by the way, saying, don't don't tell your parents. That breaks the law. It's also got a private right of action. we're not done yet.
Oregon! I got a list. All here.
22:30 Sam Rogers
But wait, there's more.
22:31 Michael Simon
There's more. Well wait, there's more.
The operators must be standing by and those must be your free gift to keep.
So, Oregon,
22:39 Sam Rogers
Okay, Oregon.
22:40 Michael Simon
your free gift to keep from Oregon. Not only do you have to have much of the above, those suicide prevention and self-harm measures, you get to publicly disclose them, not just to some small obscure agency in California. You gotta have them online for everybody to see. And an additional bonus. wait, there's two actually. The first additional bonus.
If someone types in something that looks like they are contemplating suicide you must immediately interrupt them. The chatbot has to have a setting to stop everything else.
and immediately refer them out and implement those provisions. And if you don't, second bonus. It's the third act with a private right of action. There's a bunch of other ones, but there's only two more we're gonna do because the rest of them They don't add too much. And and by the way, there's more being passed. Hawaii has more requirements. It's not been signed yet, so I haven't even covered it. And I won't I will when it does. Why? Because we've got a whole bunch of
Scary things adding up without it so far. Connecticut.
23:47 Sam Rogers
So for those keeping up
for those keeping up at home, we've got New York, California, Washington, Oregon. But wait, there's
23:52 Michael Simon
California, Washington, Oregon.
23:54 Sam Rogers
more.
23:54 Michael Simon
But wait, there's more. We have Connecticut. you're never allowed to create an inference or an offer that it is a mental health professional. Which, by the way, we'll get to, because there's a whole slew of laws just like that. And then finally, a surprising biggie, Iowa.
You must take reasonable measures.
prevent the creation of sexually explicit materials, not just reference them. Nobody can create them. claims that it is human. Not allowed to claim that this stuff is human. You cannot create a dependency upon the chatbot. What is that? I'm not real sure. But it's a big term.
And then finally you must provide a whole panoply of privacy tools for minors and parents and other users. This is big.
onto healthcare, and then I'll stop, because probably at this point people have all fled the room with their hair on fire. If you're in
24:50 Sam Rogers
Yeah.
24:51 Michael Simon
healthcare, we've got a whole bunch of other laws. We've got Illinois that prevents from replacing professional assistants with bots. And if you want to use it even for administrative, many administrative tasks, you have to get consent. Texas limits what you do to the low scope of your license, and you need to have human review of everything.
Nevada, you cannot design a system to replace human help. California, Tennessee, Colorado, all relate Claims that this stuff works better than people.
by the way, Tennessee again, private right of action. I don't know any class action lawyers in Chattanooga, but I'm sure there are some. And this this will this will be a gift to them. Yeah, that's just a few of these laws. They add up. And the big problem with this minefield, the big problem with something that's way beyond a patchwork, is that if you are doing this kind of work, if you are offering this up, not just building these things, using these things.
If this is on your website, you need to know about these laws.
What are you offering? What are you doing? There are exceptions, there are jurisdictional limits, there's a lot of more stuff in there. what was that, five minutes, ten minutes? I don't even know how long I'm talking. That was just the quick summary. That was the chat GPT summary, except I did it.
26:04 Sam Rogers
I I think Yeah, I I think it's a
I think it's it's enough minutes to get the point across, which is that just because you're contracting with a vendor doesn't mean that all the liability goes with them. If something is appearing on your website for your company, there is
a layer of liability to examine carefully to make sure that it's lining up with all of the many different ever-changing laws that are not designed to work together. Some of them are actually the opposite of each other we're starting to see as well. So
26:44 Michael Simon
And add
there's there's there's almost there's almost a contest to who can add more things. look at this law, let's add one more. We we've seen that. We've seen it in privacy, but with AI it's moving so fast. And I do want to add one more thing to what you said, Sam, which is we are also at very early stages of this stuff. It feels so cool and so well done. It is not. We are so early and so a lot of the governance and controls are very light.
Those are the big scary headlines. I'm gonna talk about something scarier because that should be the theme. I have talked to
some tech companies, one particular tech company had really cool model.
They have internal controls that they will help you build tech technically for chatbots. And when I talked with the CEO, he gave me a new hobby. Probably shouldn't have gotten in this hobby, but it's a really cool new one. You go on to any help bot on any site and treat it just like you would chat GPT. Ask it to code things for you. Ask it to do searches, and it will more times than
not you can just treat it as a free instance of ChatGPT or Claude because they're set to do anything.
as a company who is deploying these things, you need to recognize that there are laws that put you, your company on the hook for what that chatbot does or doesn't do. Not just on the chatbot laws. God forbid somebody goes into your
chatbot and starts talking about things that are ideations of suicide. That seems unlikely. It seems more unlikely that they may try and fool it to give them an answer that is advantageous to them. And then they can go like that guy who create who went went to a dealership's chat bot and convinced it to offer them a Chevy Suburban for 20 bucks or something.
28:30 Sam Rogers
Yeah. Yeah.
28:32 Michael Simon
when the laws of who's on the hook
for that are still being worked out. you know, one of the things I tell clients constantly is, you do not want to be a test case. You do not want me permanently living in your company trying to do this stuff. You do not want to be involved in the litigation that works this out. Because when you see those cases, that's people spending millions of dollars just to try and get back to where they were before. It's a bad thing.
29:03 Sam Rogers
Yeah,
and that brings up a a good point to bring things to a close here, that as the technology moves at exponential speeds, the speed of litigation has not improved. So there's a there's a tension there between what is legal and permissible and what is possible.
And the possibilities are going to be even more next week than they were in the last week. But the framework around how we understand that, how we communicate about it, how we need to tweak those tools to to thread the needle on what makes AI safe, what makes AI
legal. It is constantly changing okay, I get there's a lot, but like what do I do about it? I just want to know the right thing to do, right? There there isn't yet a way to really even say what the right action
would be for all circumstances for anyone listening to this podcast. And just to anchor it back to why we have lawyers and why people like
30:03 Michael Simon
Yeah,
you wouldn't need me. If we had that, if you could do that in this podcast in an hour, wow.
30:07 Sam Rogers
Yeah.
30:08 Michael Simon
you'd be putting all of us out of work. And let me tell you, the public would be so mad about that. We know. They would hate you.
30:15 Sam Rogers
Well, it's really important that you have someone that you can talk to, that you know what that contact is. You can't just trust AI to make these judgment calls for you. It is actually a human endeavor to be able to interpret all of this wide-ranging context that even with the expanding context windows in AI, it can't keep track of like a good lawyer can.
so in closing Mike I was wondering if you could just give your thirty seconds of where people find ya, how people get in
contact
30:46 Michael Simon
Sure. the way to find me is I have a law firm. It's my own law firm. It's called Law Plus Data. You can find me on LinkedIn. there's a billion Michael Simons.
But look for the one with Law Plus Data. That one, that that was only one of me there. the email, is michael.simon at lawplusdata. Again, the plus spelled out dot com. I am a frequent speaker. I am a
frequent author and I will probably bug you to sign up for my newsletter people tell me the stuff I write is at least interesting, at least entertaining. I try not to be boring, ever.
31:20 Sam Rogers
Yes,
I I can vouch for that. Mike's newsletter always has like that theme song thing he talked about earlier. Like it comes together well, usually with some some fun artwork and musical references. So it is not boring.
31:36 Sam Rogers
Thanks so much for joining.
31:38 Michael Simon
Thank you all.