US Regulatory Fragmentation, first Privacy, now AI

Say what you want about the EU’s data regulation regime but between the GDPR and the AI Act, organizations have one set of rules allowing them to transact across 27 countries.

By contrast, doing business in the US, organizations increasingly need to juggle different regulatory requirements for the data they collect state by state.

So far, nineteen US states have passed, each their own privacy laws covering more than 50% of the population.  Each of these laws are different and they continue to diverge through amendments, making for a growing burden on companies who have historically maintained homogeneous data storage and processing.

I understand why every time a credible federal privacy bill is proposed everyone gets in a tizzy. I hate to be the barer of bad news but its not going to happen.

I’m not saying that because I’m cynical - I am but that’s not it – it’s because this is not my first rodeo. Back in 2003, California passed breach disclosure legislation, 15 years later, in 2018, Alabama became the 50th state to adopt its own breach disclosure rules. Today, in 2024, we still don’t have federal breach disclosure legislation, not after Yahoo!, not after SolarWinds and not after the 124 million health records breached in the US in 2023.

We are now on the precipice of the same repeating cycle for AI regulation with Governor Polis signing Colorado’s landmark AI bill into law. All the while, the federal government is publishing non-binding codes of conduct for fear of stifling technology that has been actively deployed for the better part of two decades.

Food for thought: If global AI regulation goes the same direction as global privacy regulation, then countries (and states) will adopt “lite” variations of the AI Act. If you’re in line with the AI Act, you should be able to transact globally without having to waffle over the local details in any one jurisdiction.

Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management.