What Laws Apply to My AI Product, and When Is My Startup Liable for It?

By Kyle Westaway · Last updated October 15, 2026

Mostly the same laws that apply to any software product, plus a fast-growing set of AI-specific laws that turn on what your product does and who uses it. Copyright, contract, consumer protection, privacy and tort law already govern how you train, market and run an AI product, and your startup is generally responsible for what its AI says and does. On top of that, states including California, Colorado, Texas, Utah, New York and Illinois have AI-specific laws, and the EU AI Act reaches US startups with EU users. Most seed-stage startups are covered by only a few of them, so the first job is working out which ones.

Key takeaways

• Existing law comes first. Regulators use consumer protection law against overstated AI claims, and companies have been held responsible for what their chatbots tell customers.
• Train only on data you have a clear right to use. Fair use for training is still being litigated, and pirated sources, scraping against a site’s terms and unauthorized customer data each add risk.
• Most state AI laws turn on what you build: generative AI offered to Californians, companion chatbots, tools that help decide who gets a job, loan, home, insurance or care, or frontier models.
• Federal efforts to preempt state AI laws haven’t displaced them yet. Comply with the state laws that apply to you.
• The EU AI Act’s transparency rules already apply to US companies with EU users. Its high-risk rules were pushed to December 2027.
• AI law is new and likely to shift. Revisit your analysis at least every six months.

How do I figure out which AI laws apply to my startup?

Answer three questions. What does the product do: generate content, talk with people, or help make decisions about them? Who uses it: businesses, consumers, children, job applicants or borrowers? And where are those users? Many AI laws target only the largest model developers or specific uses, so a B2B tool that summarizes contracts faces far fewer rules than a consumer companion app or a résumé screener.

General law applies either way, including privacy law for any personal data (see US Data Privacy Laws). This page is about building an AI product. For your team’s own use of AI tools, see Does My Startup Need an AI Use Policy?, and for patents, see Can I Patent My AI Model?

Can I train my model on data I didn’t create?

Sometimes, but the law is unsettled, and how you got the data matters as much as how you use it.

Copyright. In June 2025, two federal judges in California held that training large language models on books was fair use on the records before them. One (Kadrey v. Meta) warned that models flooding the market with competing works could tip the result the other way. The other (Bartz v. Anthropic) held that keeping a library of pirated copies was not fair use, and that case ended in a $1.5 billion class settlement, about $3,000 per book, approved in July 2026. In September 2026 the Third Circuit held in Thomson Reuters v. Ross that copying Westlaw headnotes to build a competing, non-generative research tool was not fair use, leaving the generative AI question open. Dozens of other cases are pending. Use licensed, public domain or lawfully acquired data, record where every dataset came from, and never use pirated copies.

Scraping. Public data can still come with strings. Website terms often prohibit scraping, and platforms now sue AI companies and data vendors for breach of contract and for getting around technical blocks in violation of the Digital Millennium Copyright Act. In July 2026 a federal court in New York let most of Reddit’s anti-circumvention claims against a scraper and an AI search company proceed, though some courts have held contract claims over public data preempted by copyright law. Honor robots.txt, rate limits and access controls.

Customer data. Your customer contracts, terms of service and privacy policy decide whether you can train on what customers give you, and business customers usually say no unless the contract allows it. The FTC has warned that quietly changing your terms to permit training can be unfair or deceptive, so get affirmative consent before training on data you already collected. The FTC has ordered companies to delete models built with improperly used data. See How to Draft Terms of Service and Does My Startup Need a Privacy Policy?

California adds a disclosure duty. Under AB 2013, anyone who builds or substantially modifies a generative AI system offered publicly to Californians, and the law counts fine-tuning that materially changes its performance, must post a summary of its training data. Write it as if a plaintiff will read it.

What can I say about my AI?

Only what you can prove. Section 5 of the FTC Act prohibits deceptive and unfair practices, and the FTC has brought more than a dozen “AI washing” cases since 2024 against companies that overstated their AI. They include a “robot lawyer” that didn’t perform as advertised (DoNotPay), an AI content detector marketed as 98% accurate that the FTC said did little better than a coin toss on general text (Workado), and, in May 2026, an AI “Active Listening” ad tool that the FTC says was really purchased email lists (CMG Media). Most recent cases involve claims to business customers, so B2B sales decks count. The current FTC vacated its 2024 Rytr order in December 2025, saying it unduly burdened AI innovation, but deceptive claims remain a priority. In July 2026 it also proposed a policy statement saying that secretly steering outputs toward undisclosed goals can be deceptive.

Every state also has an unfair and deceptive practices law, enforced by the attorney general and often by private plaintiffs. Before you publish an accuracy rate, a “fully autonomous” claim or a comparison with human performance, keep the test results that support it.

Is my startup liable for what its AI says or does?

Generally, yes. In Moffatt v. Air Canada (2024), a Canadian tribunal held the airline liable for its website chatbot’s wrong answer about bereavement fares, rejecting the argument that the chatbot was responsible for its own statements. It doesn’t bind US courts, but they apply the same principles of misrepresentation and agency. California made the point explicit: since January 1, 2026, a company that developed, modified or used an AI system can’t defend a civil claim by arguing the AI acted autonomously.

Product liability is the bigger frontier. In May 2025 a federal court in Florida let wrongful death and product liability claims against Character.AI proceed and declined, at that stage, to treat chatbot output as protected speech. Character.AI and Google agreed in January 2026 to settle that case and four others, so no appeals court has ruled, and similar suits against OpenAI are pending. These claims attack product design and missing warnings, not just what the model said.

Don’t count on Section 230. It shields platforms from liability for content others provide, and no appeals court has decided whether it covers text a company’s own model generates. Defamation claims are possible too, though a Georgia court ruled for OpenAI in 2025 over a hallucinated embezzlement claim, relying heavily on ChatGPT’s warnings. Disclaimers help most alongside guardrails, human review of high-stakes outputs and a liability cap in your customer contracts. See How Do I Negotiate Customer Contracts?

Which state AI laws apply, and when?

Status as of October 15, 2026:

For most seed-stage startups, only a few rows matter. A generative AI product used by Californians needs an AB 2013 summary and, if it creates images, audio or video, embedded provenance data. A chatbot people could mistake for a human needs a clear AI disclosure, which several states and the EU require in some settings, so disclose everywhere. A companion or emotional support bot triggers SB 243 and New York’s AI companion law. A tool that helps decide who gets hired, housed, insured or a loan brings in Colorado, Illinois, New York City and California’s privacy rules on automated decisions from January 1, 2027, and customers will push those duties onto you by contract. California enacted more chatbot and workplace AI laws in September 2026, several taking effect in 2027.

Will federal law override the state AI laws?

Not yet. A December 11, 2025 executive order directed the Justice Department to challenge state AI laws the administration considers onerous, and the department formed an AI Litigation Task Force in January 2026, but the order itself preempts nothing. In April 2026 the department moved to join xAI’s lawsuit against Colorado’s original AI Act, Colorado agreed not to enforce that law while the case proceeds, and the legislature then replaced it. In July 2026 the FTC proposed a policy statement suggesting that state laws pressuring companies to alter truthful outputs may be preempted, a theory no court has tested. Congress hasn’t passed a preemption law, and a federal court refused to block California’s AB 2013, with the Ninth Circuit hearing the appeal in November 2026. Comply with the state laws that apply to you and watch for changes.

Does the EU AI Act apply to my US startup?

Yes, if you offer an AI system in the EU or its output is used there, wherever you’re based. Banned practices, such as manipulative techniques and social scoring, have been prohibited since February 2, 2025. Providers of general-purpose AI models have had documentation and copyright policy duties since August 2, 2025. Since August 2, 2026, chatbots must tell people they’re talking to AI, generative AI output must carry machine-readable marking, and deepfakes must be labeled. Fines for the most serious violations reach €35 million or 7% of worldwide turnover.

The EU’s AI omnibus amendments, Regulation (EU) 2026/1744, in force since July 27, 2026, moved the high-risk rules, which cover AI used in hiring, credit, education and similar areas, from August 2, 2026 to December 2, 2027, and to August 2, 2028 for AI built into regulated products such as medical devices. Generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to add output marking, and a ban on systems that generate non-consensual intimate imagery or child sexual abuse material starts that day. GDPR applies too. See GDPR Basics.

What extra rules apply to hiring, lending, insurance, health and kids’ products?

Hiring. Anti-discrimination laws apply to AI screening, California’s civil rights rules have covered automated hiring tools since October 2025, and a federal court in California has let applicants pursue an AI screening vendor as its customers’ agent (Mobley v. Workday). Expect customers to ask for bias testing and audit support.

Lending. The Equal Credit Opportunity Act and Regulation B require specific reasons when credit is denied, and “the model decided” isn’t one. The Fair Credit Reporting Act can apply if you supply data used in credit, employment or insurance decisions.

Insurance. As of October 2026, 29 jurisdictions had adopted the state insurance regulators’ model bulletin on AI, and California, Colorado, New York and Texas have their own rules. Insurers pass these duties to their vendors.

Health. Software that helps diagnose or treat can be an FDA-regulated medical device, and the FDA revised its clinical decision support guidance in January 2026. HIPAA applies if you handle patient data for providers or health plans. Illinois bars AI from providing therapy, Utah regulates mental health chatbots, and California prohibits AI from implying it’s a licensed health professional.

Kids. COPPA applies if your product is directed to children under 13 or you know you collect their data, and the FTC’s amended COPPA rule has required compliance since April 22, 2026. The FTC opened an inquiry into AI companion chatbots and minors in September 2025. If users can share images on your service, the TAKE IT DOWN Act has required removal of reported non-consensual intimate images within 48 hours since May 19, 2026.

Checklist: an AI risk program for a seed-stage startup

• List your AI features, the models and vendors behind them, and where your users are.
• Record the source and license of every training dataset, and drop anything pirated or scraped against a site’s terms.
• Decide whether you train on customer data, and make your terms, privacy policy and customer contracts say so.
• Keep evidence for every performance claim in marketing, sales decks and investor materials.
• Disclose AI interactions up front, and add crisis protocols if users may be minors or in distress.
• Post an AB 2013 training data summary and embed provenance data where required.
• Keep a human in the loop for decisions about jobs, credit, housing, insurance, health or education.
• Test for harmful, defamatory and infringing outputs, and log incidents.
• Check your model provider’s terms for use restrictions and output indemnities, and cap your liability in customer contracts.
• Reassess every six months.

For more, see Copyright Infringement: What Startup Founders Should Know, What Are the Startup Best Practices for Data Privacy? and Startup Due Diligence.

If you’re building an AI product and want to know which of these laws apply to you, contact us.