AI Governance and Regulatory Compliance

AI is generating legal obligations faster than most companies can read them. States enacted more than 80 AI laws across 27 states in the first half of 2026 alone. The EU AI Act’s transparency rules took effect in August 2026, with high-risk obligations following in 2027 and 2028. Federal contractors carry a second layer of procurement-specific AI requirements on top of that. The White House executive order directing agencies to challenge state AI laws has, so far, preempted nothing. In fact, despite this federal pushback via Executive Order 14365, state legislatures have capitalized on the order's specific carve-outs. Because the executive branch left room for child safety protections, data center infrastructure, and state procurement, states have aggressively codified narrower, hyper-focused laws. Waiting is not a strategy.

The problem arises when you get an unanswerable question. For example, a customer sends an AI questionnaire, or a solicitation shows up with AI documentation requirements your vendor stack cannot meet. Maybe an investor asks to see the AI governance program, and there isn’t one. An employee pastes source code into a public chatbot. In each case the compliance program that should have managed it does not exist or was not enforced.

Dunlap Bennett & Ludwig builds practical, understandable AI governance programs for companies that develop AI and for companies that use AI.

Our experience in AI governance and AI compliance matters

We have sat on the client’s side of this table. As government contractors ourselves, we has answered the same procurement, data rights, and compliance questions our clients now face with AI.

We also run our own program. The firm builds and deploys AI tools for document review and drafting under confidentiality controls we designed ourselves, and maintains a governed internal prompt library. Every third-party AI platform we consider goes through the same confidentiality, professional responsibility, and governance review we recommend to clients. Some do not make it through.

Our government contracts and intellectual property practices work these matters as one group, because that is how the issues arrive. A single solicitation can raise data rights, procurement compliance, and governance questions at once. For clients operating abroad, we work through the Alliott Global Alliance and its AI Advisory Board, chaired by Tom Dunlap, who wrote the current AI policy template and governance policy for more than 100 independent law firms across 80 countries.

What we do

A policy is not a governance program. A program has a process for evaluating new tools, an inventory of the AI already in use, a named person responsible for each system, and a record of who decided what. Most companies have the policy and none of the rest.

None of this will stop an employee from pasting a contract into a chatbot. It decides what happens in the hour after.

Federal contractor AI compliance
• Draft enterprise AI governance frameworks, acceptable use policies, and tool intake and approval processes
• Inventory AI systems, and identify the ones that touch consequential decisions, personal data, controlled unclassified information, or client deliverables
• Review new AI tools and proposed use cases before deployment
• Build model documentation practices, human oversight and escalation protocols, and board reporting
• Set vendor diligence and approval standards for AI tools
• Conduct impact assessments and readiness reviews for high-risk deployments and automated decision-making
• Advise on transparency, explainability, and human oversight requirements under federal and state law
• Fold AI into incident response planning, including model drift, harmful outputs, and confidential information sent to unmanaged tools
• Set records retention, disclosure, and labeling practices for AI systems
• Train employees, executives, and boards

Federal contractor AI compliance
• Counsel contractors on AI obligations in proposal development, contract performance, and ongoing compliance
• Advise on federal AI acquisition requirements, disclosure and documentation standards, government use rights, and data portability
• Assess False Claims Act exposure where AI compliance representations are material to eligibility or payment
• Counsel on cybersecurity and supply chain obligations where AI systems touch controlled unclassified information
• Advise on organizational conflicts of interest, data rights, and flow-downs for AI subcontractors and vendors

Regulatory gap assessment and compliance counseling
• Measure current AI practices against the NIST AI Risk Management Framework and the EU AI Act
• Advise on state automated decision-making, transparency, and governance laws, including the ones that treat NIST alignment as a safe harbor
• Review AI-related contract requirements so the program actually satisfies customer, regulatory, and procurement obligations
• Deliver prioritized remediation plans with named owners and dates
• Monitor new rules and update the framework as they take effect

Sector-specific AI compliance
• Advise employers on AI in hiring, performance management, and employment decisions under EEOC guidance, state and local automated employment decision tool laws, and the Fair Credit Reporting Act
• Advise healthcare and life sciences companies under HIPAA, FDA guidance on AI-enabled medical devices, and state health data statutes
• Advise financial services and insurance companies under Gramm-Leach-Bliley, the Equal Credit Opportunity Act, the Fair Housing Act, and state law

Board and executive advisory
• Serve as standing outside counsel for AI governance and new AI initiatives
• Advise on agentic AI, including logging, human oversight, and contract terms drafted for software rather than for an actor
• Counsel on “AI washing” exposure and enforcement by the SEC, FTC, and DOJ
• Advise boards on AI risk oversight, documentation, reporting, and management accountability