An AI pilot changes a particular piece of work. It might draft an estimate follow-up, organize vendor documents or help someone review an application. The relevant rules depend on that activity, the data, the people affected and the jurisdictions involved. A headline about a new AI law does not answer those questions for your company.
Start with a workflow inventory and an applicability check. Then build operating rules the team can use. This guide summarizes selected primary sources checked September 30, 2026; it is not an exhaustive legal survey or advice for a specific business.
Separate Law, Proposals and Operating Advice
An enacted law can have provisions taking effect later. A legislative recommendation is not an enacted requirement. A voluntary framework offers practices you may adopt without establishing a legal duty.
The White House's March 20 national legislative framework is a set of recommendations for Congress. The announcement itself does not enact a nationwide business training mandate or remove state obligations. Verify any later legislation separately before relying on it.
The NIST AI RMF Playbook offers voluntary suggestions organized around governing, mapping, measuring and managing risk. Use it to structure a pilot; do not describe it as a compliance certificate.
Check the Actual Activity and Jurisdiction
Two selected state examples show why a generic deadline is inadequate.
Colorado. SB26-189, signed May 14, 2026, replaced the earlier framework with requirements for covered automated decision-making technology materially influencing consequential decisions. Covered domains include employment, lending, housing and other specified areas. Its enacted text, section 5, sets January 1, 2027 as the general effective date, with listed provisions effective earlier. Check covered consumers, developer/deployer roles and exceptions. A hiring tool deserves a different review from a routine message draft.
Texas. HB149's enacted text took effect January 1, 2026. Section 551.002 describes applicability involving Texas business, products or services used by Texas residents, or AI developed or deployed there. Its disclosure provision addresses governmental agencies and health-care services; it is not a blanket statement that every private company's chatbot has that same disclosure duty.
These are examples to investigate when there is a relevant connection, not a claim that these states' laws apply to every reader. Identify customer and worker locations, the decision involved, your role and sector-specific rules with qualified counsel where needed.
Write a One-Page Applicability Record
For each proposed workflow, record:
- What it does and whether it drafts, recommends, ranks or acts.
- Who may be affected and where the activity occurs.
- Which data enters the tool, who may access it and how long it is retained.
- Which legal or contractual requirements were checked, including source, effective date, scope and unresolved questions.
- The accountable owner, required human approval and contact for complaints or correction.
Keep unresolved applicability questions visible. Do not convert an operational recommendation into a legal requirement because it sounds prudent.
Build Rules for One Pilot
For an illustrative estimate-follow-up pilot, restrict inputs to approved quote records, have a person check material terms and approve messages, and pause contact on a reply, dispute or opt-out. Review channel-specific contact requirements before sending. Commercial email rules depend on the message's primary purpose; the FTC's CAN-SPAM guide explains that distinction.
Practice ordinary and exceptional cases using authorized or synthetic data. Name who can change instructions and who can pause processing. Keep a manual fallback and a record of material corrections. These are recommended operating controls, not a universal statutory checklist.
Decide Whether the Pilot Is Ready
Record task time, review effort, corrections and a quality measure before launch. Set a review date and criteria for continuing, changing, stopping or expanding. Legal applicability and acceptable output are separate checks; good pilot metrics do not establish compliance.
Use the one-page pilot brief and measurement guide to prepare the operational decision. Book a consultation to discuss the workflow. Obtain legal advice for the obligations specific to your company, and recheck dated sources before publication or deployment.