Over 1,000 State AI Bills in 2025, and No Rulebook to Reconcile Them

U.S. state legislators introduced more than 1,000 AI-related measures in 2025, according to an analysis published by Unite.AI, while Executive Order 14365 simultaneously seeks to limit conflicting state requirements — and the EU has begun actively enforcing parts of its AI Act. The numbers describe a regulatory environment pulling in different directions at once, and the work of reconciling those directions now falls on the companies building and deploying AI systems.

The result, the analysis argues, is a widening gap between what AI policy says and what AI systems actually do. Historically, AI applications were governed through existing consumer protection, privacy, and industry-specific regulations, alongside companies' own internal policies. Governments are now introducing AI-specific requirements, but these remain fragmented and often provide limited guidance on how systems should actually operate. Companies must reconcile external requirements with their own risk tolerance, product objectives, and operational realities.

Why the enforcement gap matters now

The stakes are practical, not theoretical. Regulators already expect companies to explain how automated systems decide. The FTC, DOJ, CFPB, and EEOC said jointly that they will enforce their existing authorities on automated systems — which means, as the analysis puts it, someone will eventually ask a company to explain how its system decides.

Each regulatory authority, the analysis notes, describes a different destination. The EU is enforcing parts of the AI Act. U.S. federal policy explicitly favors a less burdensome national framework, with Executive Order 14365 seeking to limit conflicting state requirements, even as the more than 1,000 state-level measures introduced in 2025 accumulate. No single rulebook exists, and none is on the near horizon.

But establishing regulatory requirements is only part of the challenge. As AI deploys across more applications and contexts, companies must translate broad requirements and internal policies into operating controls and individual decisions. No regulatory framework can anticipate every application, context, or tradeoff. Organizations need to trace a path from governing requirements and internal policies to system behavior, measurable outcomes, and audit or review.

The NIST AI Risk Management Framework takes a similar view, the analysis notes, by emphasizing ongoing measurement and management rather than treating governance as a standalone compliance exercise. Requirements flow down, and evidence flows back up: regulators and executives may define desired outcomes, but organizations must demonstrate whether their systems are actually producing them. That places much of the practical responsibility for AI governance on the organizations deploying the systems.

Where does governance actually get hard?

At the implementation layer, according to the analysis. Regulations and governance frameworks generally define principles, obligations, and desired outcomes. Production systems have to translate those into individual decisions, and that translation is where governance gets hard.

A policy can say prevent discrimination, protect users, provide transparency, or allow meaningful human review. An operational system has to answer far more specific questions: at what threshold does it act, based on what evidence and with what confidence, when is human review required, what gets logged, and what happens when the system is uncertain?

The analysis offers a concrete case. Consider a platform with a clear policy against harassment. A message containing profanity may be harmless banter between friends, while a seemingly innocuous message may be part of a sustained campaign targeting another user. The system must determine what context it can reliably use, how much evidence is enough to intervene, and what intervention is appropriate: block the message, warn the sender, escalate for human review, or take no action.

Every choice carries a cost. Lowering detection thresholds may catch more harmful behavior, but also suppress legitimate conversation. Requiring human review may improve judgment, but delay intervention. None of these decisions is specified by a general policy prohibiting harassment, yet together they determine how that policy is actually enforced.

"No policy document settles those tradeoffs in advance, so someone inside the company has to decide them, document them, and revisit them," the analysis states. "That person is effectively writing policy whether or not the org chart says so."

What does responsible AI actually require?

If the people who implement a system are effectively the ones writing policy, the analysis argues, then responsible AI cannot be treated as a statement of intent — it has to show up in how the system behaves every day. That means managing how AI is used, measured, and corrected over time, not just approving a policy or passing an initial evaluation.

The analysis identifies three ideas that matter most in practice:

• Governance should be proportional to consequence. An AI system that recommends copy, approves a loan, flags a security threat, or supports a medical decision creates very different risks. Organizations need to determine where stronger controls, review, and oversight are warranted based on potential consequences.
• Accuracy alone is insufficient. Different errors carry different costs. A false positive in moderation may suppress legitimate speech, while a mistake in lending, healthcare, or security can have far heavier consequences. Governance has to reflect the real-world impact of a decision, not just model performance.
• Continuous evaluation and feedback are essential. Overrides, appeals, incidents, edge cases, and downstream outcomes should all feed ongoing evaluation.

The asymmetry between error types is the sharpest point in the framework. A moderation system that wrongly removes a post causes a different kind of harm than a lending model that wrongly denies a loan, and governance that measures only aggregate accuracy captures neither distinction.

Can companies build governance that holds up?

Yes, the analysis argues, if they build it into how AI systems are designed, deployed, and managed rather than bolting it on afterward. It names four practices as particularly important:

• Treat governance requirements as product and system requirements from the start. Compliance controls added after deployment tend to be costly and brittle. Privacy, transparency, auditability, and review mechanisms are easier to design into a system than to retrofit later.
• Build an auditable chain from policy to decision. Organizations should be able to connect the governing requirement or internal policy to the control applied and the resulting decision, and produce the evidence required to evaluate it.
• Assign clear ownership and accountability. Define who owns the policy, who determines acceptable risk, and who monitors performance. Someone should also have the authority to intervene when the system behaves outside those bounds.
• Build shared, adaptable governance infrastructure. Data controls, audit trails, configurable policies, review workflows, and measurement should support multiple regulatory requirements and use cases. Controls and thresholds should adapt by jurisdiction, application, and risk, so organizations can respond to changing requirements without rebuilding their systems.

That last point addresses the fragmentation problem directly. A company operating under the EU AI Act, a U.S. federal framework shaped by Executive Order 14365, and any number of the 1,000-plus state measures cannot afford to rebuild its systems for each regime. Shared infrastructure with configurable thresholds is the practical answer the analysis proposes.

What happens next

Regulation can define obligations and principles, but companies still have to translate them into systems that make real decisions at scale. That makes internal governance an operating responsibility, not just a compliance exercise, the analysis concludes.

"Every company that deploys AI at scale is already writing policy through its thresholds, its review rules, and its escalation paths, and the only open question is whether it does so on purpose," the analysis states.

Regulators will keep defining the outcomes they want, and they will not always agree. Companies must decide how those expectations become controls and then show, with evidence, that the controls work. The author writes from direct experience: "I've seen this problem from several sides: in cybersecurity environments, building risk models, and now operating AI systems at scale. Across each, the lesson is similar: a framework only works if it can be translated into clear decisions, measured in practice, and improved when reality exposes the gaps."

Companies that build clear ownership, measurable controls, auditability, and adaptable infrastructure now will be better positioned as regulation continues to evolve.