S3 E26: How Existing AI Laws Impact Businesses

Audio version

How Existing AI Laws Impact Businesses

Transcript

Jordan Eisner 
All right. Welcome everybody, viewers and listeners to another episode of Compliance Pointers. I’m your host, Jordan Eisner, VP of Growth at CompliancePoint and Compliance Pointers. We bring to we bring forth several topics ranging from information security and cybersecurity to.
Regulatory compliance and risk associated with US privacy law. Today we got a special guest. I’m very excited. Michael Young, who’s a partner at Morris, Manning and Martin. Michael’s an acquaintance of mine. We’ve had some past workings together and I know Michael to be somebody that focuses on data privacy and cybersecurity and AI in particular.
So brought him on today. He was gracious enough to join and we’re going to talk about AI laws, many of which are already in effect and then the risk that these laws create for businesses. So Michael, good to have you on before we jump in.
Tell us a little bit more about your background other than just what I said. Obviously, a partner focusing in the areas, data privacy and cybersecurity. But what else about your background do you think is important for our listeners and our viewers and to really inform I think some of the topics and details we’re getting into today?

Michael R. Young  
Yeah. Thank you for having me, Jordan. Really appreciate it. Good to see you. Good to see you again. So that’s right. I chair the privacy and cyber practice at the firm over my career. I’ve practiced almost my entire career at the intersection of tech, data, privacy and cyber.
And so it wasn’t a surprise when clients started asking for advice around AI. Fortunately, we had been tracking those issues for some time, and to the surprise of many, there’s far more AI.
Statutes currently in effect then then then people may really appreciate. So, so super excited to talk to you about that a little bit today.

Jordan Eisner  
Yeah, and tell us about Morris, Manning, and Martin.

Michael R. Young  
Sure. Yeah. So the firm has had a technology practice for 30-plus years. I think we go back as far as anyone in Atlanta practically in terms of having a technology practice as a core part of the firm.
Over the years that practice has expanded to include privacy, cyber data obviously and now most recently AI. So we’ve been doing tech for a long time, a very technology-focused firm.
Our clients are include many tech companies in the Southeast, also across the nation and we support them in many other ways. In addition to my practice, we have an M and a practice, you know an employment practice.
Commercial contracting, basically a full, full range law practice that you would expect in order to support our clients. So that’s who we are and yeah.

Jordan Eisner  
I appreciate you sharing so.
This is going to be a surprise to anybody listening or watching. There’s a lot of buzz around AI, AI tech. And as you mentioned, there’s a lot of laws already in place and we want to get into, you know, what’s notable about these laws, especially for businesses, but.
If possible to start off, can you summarize some of these a laws where they are, you know, maybe common theme and and what’s important and notable as mentioned for businesses in these laws?

Michael R. Young  
Yeah, yeah, good, good question. And not only are there laws, but there’s kind of like news in this area as of like 30-45 minutes ago. The news is the news is the Senate passed their HR1, which was that the.

Jordan Eisner  
Oh yeah.

Michael R. Young  
Big House budget bill and there was a lot of back and forth about whether that bill was going to include a provision that essentially preempted or attempted to preempt many of the state statutes that are in place and.
In fact, the official sources are not quite up to date yet, but it looks like from some headlines and some news that I can put together that in fact that preemption bit of the bill was not included. And so even if that preemption had been included.
Was effective and didn’t pose any risks to businesses, which are all big ifs. It would it still makes sense definitely to pay attention to these many state laws that are out there. So what is out there? OK, so.

Jordan Eisner  
Yeah.

Michael R. Young  
About a month ago or so now, we premiered at a meeting of the Atlanta Privacy Co-op. As you know, our big long list of AI laws which we assembled to focus on state statutes.
That regulate in an express way AI. Now there’s many laws that regulate AI implicitly, right? Your technology law, your IP law, general contracts law, general unfair and deceptive trade practices law are all going to have something to say about how companies.
Implement AI. The laws that we focused on in our big long list of AI laws were laws that were expressly about artificial intelligence or machine learning as a technology. So from that list we took out.
Some kinds of laws that don’t really have a commercial impact about like political advertising or the like. And on our list of laws, statutes that mention AI and that seem to have a commercial focus we ended up with.
A couple dozen across a broad range of states. And so the laws, it defies neat summary, right, as you might imagine. But maybe I give you some examples and that’ll help the listeners understand what’s out there particularly.

Jordan Eisner  
Yeah, huh.
I think so.

Michael R. Young  
So yeah, so some laws undoubtedly aimed at large language models available to large numbers of users. So the the California AI Transparency Act I think needs to be read this way. That law applies to covered providers.
Who produce generative AI with over 1,000,000 monthly visitors. That’s a pretty narrow focus. It’s pretty clear to me that what they had in mind there was something like ChatGPT or Gemini or the gigantic large language models.
That’s probably not going to directly impact most of my clients immediately, but it is interesting that AI is being regulated at that level. What you see in that law is a requirement for providers of those models to.
Provide a way for people to identify that something was output from the model. So there seems to be a real concern to identify whether content is generated by AI or not, and if you read those laws, they want you to do things like embed identifiers or maybe have support.

Jordan Eisner  
Yeah.

Michael R. Young  
Support for a query functionality that would let someone query whether this particular piece of content came from that AI. So that’s that law at that level. Then there are laws that do impact many of my clients.
So there’s a few laws specifically focused on the HR and the hiring context. So Illinois and Maryland each have a law governing the use of AI to analyze video. When if you use a video for interviews or for hiring purposes, there might be some reporting requirements.

Jordan Eisner 
Mm.

Michael R. Young  
New York City has in the hiring context, an anti-bias assessment requirement. So there’s actually a municipal law that regulates the use of AI in hiring. Utah has a law widely credited as having one of the first laws mentioning AI.
There you might be required to provide a notice if users, if you put a technology out in the world and the users interact with that AI and it generates some content and then you have a couple states.
That like California, New Jersey that have laws prohibiting the use of marketing bots unless an artificial identity is made clear. So you’re probably familiar with these AI chat bots. AI marketing technology has been getting more sophisticated and more interesting. I’ve seen people using AI, for example, to manage their e-mail contacts to their network of business associates, so.

Jordan Eisner  
Right.

Michael R. Young  
Maybe, maybe you’re a sales guy, right? It’s your business to talk to a lot of people, to have a lot of follow-up emails and contacts. Wouldn’t it be great if you could push a button and have an AI send out those customized emails to your to your entire network? So, so there’s laws that are.

Jordan Eisner  
Depends on what it says.

Michael R. Young  
Starting to regulate this use of bot technology in marketing. There’s also a law in California around your call center that’s staffed by AI voices. There’s a law required in California where you have to.

Jordan Eisner  
Yeah.

Michael R. Young  
Make disclosures about training data. And then last and but definitely not least, Colorado has a pretty comprehensive AI law that’s modeled off of EU approaches and tends to be a comprehensive regulation and we can talk more about.
The Colorado law at some point, if you like.

Jordan Eisner  
Yeah, no, that was a good overview. You mentioned a lot of different states, a lot of different cases. Well, maybe I shouldn’t use the word cases that way, but examples. Yeah, yeah, examples where, you know, maybe this is for the big language learning models. Maybe this is specific to training, maybe this is specific to hiring.

Michael R. Young  
Yeah, examples. Yeah, exactly. Exactly.

Jordan Eisner  
Maybe this is specific to, you know, marketing. So a whole mix of different laws. Let’s talk for the listeners and the viewers. What about the risks, right? So, OK, here’s a law. You should be doing this.

Michael R. Young  
Yeah.

Jordan Eisner  
What’s the risk organizations are facing if they don’t, you know, and I and I look at this from a consumer standpoint, you know, what sort of teeth of these laws have where I can feel that they are effectively managing my privacy or my rights compared to that and then for a business, OK.
Here’s what it says I have to do. What happens if I don’t? Or what happens if I can’t demonstrate compliance with these?

Michael R. Young  
Right. So, some of the laws specifically enable AG enforcement and might include the potential for fines or other kinds of enforcement from the Attorney General. There’s unsurprisingly right, there’s there’s not yet substantial enforcement history or regulatory interpretation.

Michael R. Young  
But my long-term prediction is that we will see at least some of these laws become the focus of plaintiffs class action claims. It’s a little legally technical, but glad to discuss how we might see some of that come about, if you like.

Jordan Eisner  
Really?
No, no, let’s do that. I I think that’s relevant. You know, I I know you’re familiar compliance point. We consult and advise with clients on TCPA, Telephone Consumer Protection Act quite a bit. I I think it’s something, oh Gee, oh, big time, right. I I, you know, I think the top. So I our listeners and viewers that regularly would.

Michael R. Young  
Yep.
Yeah, there you go. Oh, OG privacy class action kind of law. There you go. Yeah.

Jordan Eisner  
Be part of this podcast. I I do think that would be of interest. So yeah, talk about some of the Uh class action possibilities or private lawsuits that could be brought out or that you see maybe could be brought out because of some of these AI laws.

Michael R. Young  
Yeah.
Yep, good, good. So, so there’s a couple things that might happen generally as as further legal development. So first, the these new laws might come to be seen as establishing a general standard of care that businesses have to follow when they’re dealing with AI technology, particularly when it’s consumer facing.
Or particularly when it’s dealing with consumer data. If that’s the case, if these laws become viewed as a general standard of care, then that can become an enforceable legal theory for private plaintiffs who claim that the business failed to meet that standard. So that’d be in law, just a form of.
An ordinary tort claim, negligence or something like that. Second, the second legal development you might see is that at least some of these laws expressly state that their violation is an unfair and deceptive trade practice.
And in the trade, there’s there are laws across the states that are modeled off of the federal FTC Act, which are called little FTC or baby FTC acts. Essentially, those are just laws that govern on fair and deceptive trade practices. So states have.
These laws, they’ve had these laws for a long time and in many, many cases these laws are cited and used by plaintiffs attorneys to bring private actions under state law. So if these AI laws are deemed to be.

Jordan Eisner  
Right.

Michael R. Young  
You know, to sit under those FTC laws or their violation is seemed to be a violation of those FTC laws, then it’s not such a leap to imagine plaintiff’s lawyers treating violations of those laws as problematic under those baby FTC or those little FTC acts. Yeah, so.

Jordan Eisner  
I could see that, yeah.

Michael R. Young  
So that opens the door implicitly to private claims. And there’s one little technical wrinkle. So if if you or your listeners have read these laws, you will have read in some of them words to the effect this law doesn’t create a private right of action. And the thing to know about that.
It’s really easy for a non lawyer to get false assurances from that kind of language. Notwithstanding that the laws may not create their own unique private right of action, there’s still the potential in general for the kinds of theories I’ve mentioned where the laws are seen to read on other.
Unfair Practices Act. So that in fact, private action is a risk. And if you want to know laws that have stated that have those kinds of statements in them still get cited by plaintiff’s lawyers because I see those demand letters.
So that does not stop. That does not stop plaintiffs lawyers from citing these laws under the kinds of theories I’ve outlined. It may be that there’s not a special right of action under that law the way there is under the TCPA with statutory damages, but it doesn’t mean that that law can’t form the basis for a private right of action.

Jordan Eisner  
You know.
It’s not a bridge too far, sort of like we’ve seen in privacy with, you know, older wiretapping or or even like the video, I think rental law. I’d never say the name exactly right. But yeah, yeah, exactly. How those are being leveraged now in some of these, you know, cases against organizations, OK.

Michael R. Young  
That’s right.
VPPA. Yeah, yeah. Video Privacy Protection Act.

Jordan Eisner  
That I think that makes a lot of sense. Uh, that’s helpful though. Thanks for thanks for getting into that. Switching gears a little bit.

Michael R. Young  
Yep.

Jordan Eisner  
So what about you? You mentioned some of your clients who you work with, you gave a little sense of the look and feel of those. What have you seen maybe with them or just in the marketplace even with non clients or or or who you’ve spoken with about companies?
Approaching AI compliance under these laws with their product offerings, not necessarily talking about the big models, right? But that might be using those to develop the tool or for particular functionality in their in their products.

Michael R. Young  
That’s that’s right. So, so depending on the area where the business operates, there may be more or less regulation and it may be more direct or more indirect. But there’s always at least the question if you’re a company and you’ve built AI into your product or service, there’s always.
At least the question should we be doing something in response to this AI regulation, not to mention the potential for privacy regulation depending on the kinds of data you’re using or the issue of commercial risk. So all of that should generally be on the table for businesses that.
In scope of the Colorado law in particular, you could find that there’s a quite comprehensive compliance project that has to actually be done. The truth is, based on my experience, is that most companies who offer AI based functionality at this point are still.
Prepared for the challenges, I understand that it’s a new area of law in some respects, but still I get on a phone call with companies who build AI tech into their platforms.
On behalf of my my clients who may be acquiring that technology and will ask a question like what are you doing to address AI compliance, which is about the most softball question I know how to ask right in that in that context and it happens more frequently than it should that.
That you’re getting a kind of kind of a blank in response. And if you ask a slightly more technical question, like what are you doing to comply with the Colorado AI Act or have you assessed whether your system requires A bias audit? You know, oftentimes there’s no hope that there’s a good answer on the.
On the other side. So when I’m working with my clients, I I try to help put them in the position that they have some answers to those questions or or at least that they’ve thought about the issues and and so help them think about these issues in in a better way.

Jordan Eisner  
I was going to ask that. You know, that was part of my next question. You know what? You just laid out the scenario. You being the great advisor that you are, are staying ahead of some of this with a lot of your clients and other organizations. You’re asking them softballs about it. Sometimes maybe you’re getting a little bit more tactical. What are you doing? About this specific law, when you don’t find an answer that you’re satisfied with or that you think your client should be satisfied with, you know, what’s your role as a lawyer in all this? And and you were getting to that a little bit, but I wanted to make sure I framed the question for our listeners and watchers, your role, how you come in, how you serve, how you provide value in those. various scenarios.

Michael R. Young  
Right. Yeah. So, our my clients are on both sides. Some some of them are the vendors with the AI integrated into their systems and there we work with them to help them have some thought out strategy and approach both for the sake of compliance.
But it also frankly supports sales efforts because their customers are going to be asking these kinds of questions and it’s imperative from a sales perspective that you have an answer if you’re a technology company that has built AI into your platform.
Where my clients are the customers consuming AI, we help them understand and respond to the the special legal risks that their vendor might be creating or their potential vendor. In some cases we are definitely pushing that vendor to take their own compliance obligations.
More seriously. So so this is something to know, you know, note to vendors trying to sell to my clients. You you you need to have answers for your customers, which means that you yourself need to invest some resources into assessing, thinking about and responding to AI requirements.

Jordan Eisner  
Yep, well put, well put. Everybody needs to be thinking about it, not just the excitement on what it can do for their business and margin and growth, but also how are you going to protect your customers and your your business upstream, downstream and and laterally is all part of it.

Michael R. Young  
Yeah.
That’s right.

Jordan Eisner  
Yeah.

Michael R. Young  
Yeah, and I have had, I’ve seen clients make decisions to restrict their use of AI in some jurisdictions or in some areas based on a lack of.
Good answers to compliance questions where they deem there to be at risk, Yeah.

Jordan Eisner  
Yeah. OK. Many companies are the companies, you know, demonstrating this next example. So that’s why I think this is, this is a good question and and probably part of our closing questions.
I mean my our company included, you know every company is looking how can we leverage AI not only just what exists, but what you know is there, is there opportunity for us internally you know to not necessarily compliance move but other companies develop a model, leverage that and use that.
Either you or um, your colleague Beau, uh, Braswell or also Noel told me the other day that.
20,000 new models are are made like every day or something like some some vast number. Was it was it you that told me that when we were getting lunch?

Michael R. Young  
It must have been Bo, but I would, I would credit it. It’s everybody building AI into their product and services. That’s right.

Jordan Eisner  
It was a lot. It was a lot.
So what’s the process? And I, you know, understand for our listeners and our viewers, this is not um.
This might be Michael’s opinion. It’s not legal advice. It’s not, you know, not nothing to run with. You know you need to seek, you know, counsel for this. But what? What would you suggest for getting compliant or thinking about it from the beginning when you’re building AI into your product or service?

Michael R. Young  
Yeah, yeah, yeah. Good, good question. And and good disclaimer too. I should say I’m speaking on my own behalf. Nothing I say represents the firm or my clients. So just just to be very clear, so essentially. The process of getting compliant is the process of conducting an informed legal assessment in context. So the context going to have to include business and technical detail. Maybe I didn’t mention it, but Rhode Island has an AI law about the use of optometry.
Right. Maybe you’re not building AI into an optometry device and you can ignore the Rhode Island law for those purposes. You don’t have to think about it. But are you generating human like responses from an AI? If so, maybe you need a notice in Utah. Is your AI operating anywhere in the vicinity of employment?
Finance or education. If so, maybe you need a special assessment either under privacy law or under Colorado’s law or under like the New York, the New York Municipal Code. So that’s the kind of detail that you want to surface in a conversation to help conduct a legal assessment.
So these are conversations we have with our clients. Sometimes we have a short initial conversation and I’ll sometimes actually do that for no charge with my clients, just to provide or provide them with an assessment questionnaire just to get them to start thinking and recognizing these.
These kinds of issues in their in their context, like we recognize this stuff, yeah, yeah.

Jordan Eisner  
Awareness, right? It’s, you know, it’s you don’t know what you don’t know. So having some awareness around the law, especially where it crossed paths with your operations or your business and what you do, it’s going to be very important. So popular or or required disclosures.
And other sort of button up activities are accounted for.

Michael R. Young  
That’s right. That’s right. Yeah. Yeah. And and this, look, this stuff is new. We we don’t expect everybody to be expert, but.
But that’s why we’re here, right? I mean, we can have these conversations about your business and your context and help start to to triage the the set of issues now depending on on context, right? Additional work might might emerge like maybe you’ll need to prepare a notice, you’ll maybe you’ll want to review or prepare a contract.
Actual addendum. Maybe in the case of Colorado, you’ll need to get into a fairly comprehensive compliance project. We also refer clients to consultants like yourself where appropriate. We we pretty much find a way to work with the with the clients wherever, wherever they’re at.
So that’s that’s at a high level how we approach it.

Jordan Eisner  
Response and in a good segue to some closing points here, one of which is for our viewers and listeners, how do they get in touch with you, Michael? Should they want to have a conversation with you outside of this about these laws or other things that you specialize in or that the firm provides?

Michael R. Young  
Fantastic. Yes, thanks. Yeah, our website is mmmlaw.com. My name’s Michael Young, opposite of old, and you can find me on the website and my contact information and I don’t know how this is posted, but if you want to post contact information as part of the distribution, happy to happy to support that where appropriate to.

Jordan Eisner  
Yeah, we should.
We’ll do that and you know our listeners and viewers know that this is, this is to watch on YouTube. We post snippets of it on LinkedIn and other channels, but anywhere where podcasts are listened to, they can find this. So we’ll leave Michael’s details in that and I’d say for our our viewers and listeners as well, you, you know.
Where you can where you should be able to contact Compliance Point or I hope you would know so by now if you’ve been listening and watching, but compliancepoint.com feel free to engage with us and we also can make introductions to Michael as well if need be so.
Well, this was good. I you packed the punch in this 30 minutes. I think it was very meaningful. There’s a lot and I think it perfectly set up to follow on conversations if anybody wants to have with you about the specifics of their business and they want to. So this was a this was a good overview, Michael. I appreciate you coming on.

Michael R. Young  
Fantastic. Yeah, happy to be here. I’ll do it anytime.

Jordan Eisner  
And we’ll, uh, we’ll get together for lunch soon.

Michael R. Young  
Sounds good. Thanks.