Cutting-edge AI needs rules, but regulators are still struggling.

Industry Background

Cutting-edge AI models are being deployed at an unprecedented pace, with capabilities expanding from chatbots to autonomously identifying and exploiting zero-day vulnerabilities (e.g., the Mythos model). However, the absence of formal federal regulations has prompted state governments to take the lead. Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act (SB315), New York signed the Responsible AI Safety and Education Act (RAISE Act), and California passed the Frontier Artificial Intelligence Act (TFAIA). These laws, set to take effect in January 2027, require frontier AI developers with annual revenues exceeding $500 million to establish comprehensive AI frameworks covering catastrophic risk assessment, mitigation measures, governance, cybersecurity, third-party evaluation, and internal usage risk, as well as submit transparency reports before deploying new models or making significant modifications.

Market Impact

For developers, compliance costs have risen significantly. State requirements vary: Illinois and New York require reporting within 72 hours of discovering a serious security incident, while California allows 15 days; if an incident "poses an imminent risk of death or serious physical injury," Illinois requires reporting within 24 hours. Developers must prepare differentiated compliance reports for different states, increasing operational complexity.

For downstream users (enterprise customers), the laws primarily target developers, but there are gray areas in actual use. For example, the allocation of responsibility for models modified from open-source frontier models or those embedded into workflows remains unclear. Enterprises that indirectly use multiple frontier models through vendors (e.g., payroll systems, HR systems) may face hidden compliance risks.

Competitive Landscape

Beneficiaries: Compliance technology providers (e.g., security vendors like Cyware) will see growth, as enterprises require tools for audit trails, risk registries, and third-party assessments. Startups focused on AI governance and security will also benefit.

Under Pressure: Large frontier AI developers (e.g., OpenAI, Anthropic, Google DeepMind, etc.) will bear higher compliance and legal risks, especially when operating across multiple states. The open-source model community may face uncertainty due to unclear liability for modified models.

Potential Followers: Other states (e.g., Texas, Florida) may follow suit. While no mandatory federal regulations exist yet, executive orders have encouraged voluntary testing. In the long term, if state-level fragmentation intensifies, the industry may push for nationwide uniform standards.

Enterprise Implications

Enterprises should take immediate action:1. Build an AI Risk Inventory: Catalog all AI models in use (including those embedded via vendors), clarifying their sources, permissions, and data access scope. 2. Strengthen Visibility: Reduce shadow AI risks by applying application mapping and identity access management (IAM) to control model usage. 3. Conduct Regular Audits: Prepare differentiated audit reports according to state requirements, with special attention to incident response windows (72 hours vs. 15 days). 4. Address Downstream Liability: Clearly define AI compliance clauses in vendor contracts to mitigate legal risks arising from third-party models.

Future Outlook

12 Months: As state laws take effect, developers will focus on building compliance frameworks, and enterprises will start auditing their AI usage. The first major incident reports may occur, setting legal precedents.

24 Months: Fragmentation at the state level becomes prominent, prompting industry lobbying for unified federal legislation. A framework similar to the "AI Liability Act" may emerge, clarifying downstream user obligations.

3 Years: AI governance becomes a fundamental business practice, akin to ISO 27001 in cybersecurity. The insurance industry may introduce AI liability insurance, further driving standard harmonization.

Conclusion

The "genie is out of the bottle" for frontier AI, but the rulebook is still being written. While states are moving ahead, fragmented compliance and the lack of downstream liability remain major challenges. Enterprises returning to security fundamentals—visibility, auditing, risk registries—is the most pragmatic strategy for now.