No Single AI Rulebook but Plenty of Investigators
By: Abhishek Kambli, Brian D. Nieves, and Jason Torchinsky
The federal government has made American leadership in artificial intelligence a national priority. The White House has called for a minimally burdensome national framework, stronger cybersecurity, greater public-private cooperation, and fewer state law barriers to AI innovation. The Justice Department has also established an Artificial Intelligence Litigation Task Force to challenge certain state laws that it believes interfere with that national policy. But AI developers and startups should not mistake a pro-innovation agenda for an absence of enforcement risk.
Even as policymakers debate the contours of a comprehensive national framework, federal agencies, state attorneys general, and congressional committees are applying existing authorities to AI products, data practices, security measures, and public representations. The result is an unusual environment: fewer settled AI-specific rules but multiple potential investigators evaluating companies under overlapping and sometimes conflicting legal theories.
For AI companies, the immediate question is therefore not simply what AI law applies to them. It is also: How would their decisions, documentation, and internal controls withstand government scrutiny?
Four Sources of AI Investigative Risk
1. DOJ and Federal Enforcement
The Department of Justice can address AI-related conduct through a broad range of criminal and civil authorities, including national security, antitrust, civil rights, and fraud laws. A June 2026 executive order specifically directs the Attorney General to prioritize criminal enforcement against individuals who use AI to gain unauthorized access to computer systems, damage systems, obtain information unlawfully, or further other crimes. The same order directs the federal government to work with AI developers on cybersecurity and the secure deployment of advanced models.
Depending on a company’s technology and business model, DOJ scrutiny could involve AI-enabled fraud, cybersecurity incidents, misuse of sensitive data or technology, foreign exposure, anticompetitive conduct, or representations to government customers.
Companies may also find themselves interacting with DOJ in a different capacity. The Department’s AI Litigation Task Force is responsible for challenging state AI laws that the Administration views as unconstitutional, federally preempted, or otherwise unlawful. DOJ has already moved to intervene in litigation challenging Colorado’s regulation of algorithmic decision making.
This dual role makes the current environment especially complicated: DOJ may be an enforcement authority or an ally challenging state restrictions, depending on the issue.
2. FTC and Consumer Protection Scrutiny
The Federal Trade Commission has made clear that AI companies remain subject to the FTC Act’s prohibition on unfair or deceptive conduct.
On July 1, 2026, the FTC proposed a policy statement addressing whether AI companies may deceive consumers by manipulating system behavior contrary to reasonable expectations concerning objectivity and accuracy. The proposal focuses on the representations – express and implied – that companies make about what their models are designed to do and how accurately they perform.
The broader lesson extends beyond the precise subject of the proposal. Statements in product materials, investor communications, terms of service, and public testimony can all become relevant in an investigation. Claims that a model is accurate, secure, unbiased, or suitable for a particular use should be supported by testing and internal documentation.
AI companies should expect regulators to compare what a company said publicly with what its engineers, executives, and internal testing showed privately.
3. State Attorneys General and a Fragmented State Landscape
State attorneys general are emerging as especially important AI regulators. They can rely on state consumer protection, privacy, civil rights, data security, child safety, and sector specific laws even when no state AI statute directly governs the conduct.
In August 2025, a bipartisan coalition of 44 state attorneys general wrote to major AI companies regarding child safety and chatbot interactions with minors, warning that the states were prepared to use available legal and regulatory tools. A separate bipartisan coalition of 36 attorneys general later urged Congress not to prevent states from enacting or enforcing their own AI laws. Those initiatives span consumer protection, privacy, automated decision making, and deepfakes.
This creates risk for companies of every size. A startup may comply with the requirements it knows about in its home state while unknowingly triggering obligations elsewhere based on where and how its products are offered and used. One complaint, adverse event, news report, or whistleblower allegation can also lead multiple attorneys general to coordinate their inquiries.
4. Congressional Investigations and Policy Scrutiny
Congress is simultaneously developing AI policy and examining the conduct of industry participants. House committees have held hearings addressing AI regulation, intellectual property, infrastructure, and national competitiveness.
Congressional scrutiny can move faster and range more broadly than conventional litigation. A committee may seek internal communications, testing and safety materials, customer complaints, foreign relationships, and executive testimony. The inquiry may also unfold publicly, creating reputational and investor risk before the company has had a meaningful opportunity to respond.
AI companies should therefore treat congressional readiness as part of their broader legal and crisis management planning, not as a problem reserved for the largest technology platforms.
The Case for a Privileged AI Risk Assessment
AI companies, particularly startups, often build their compliance systems incrementally. Product development, fundraising, customer growth, and speed to market naturally take priority. But the decisions made during those early stages can later become the central evidence in an investigation.
A privileged AI risk assessment can help a company identify vulnerabilities before an agency letter, subpoena, congressional request, data incident, or public controversy. Depending on the company, that assessment may include:
- Mapping products, use cases, data flows, and applicable jurisdictions.
- Determining whether public claims about accuracy, safety, privacy, and security are supported by internal evidence.
- Evaluating testing, governance, human oversight, and complaint-handling procedures.
- Establishing protocols for document preservation, government inquiries, congressional requests, and crisis communications.
The objective is not to impose a cumbersome compliance structure that slows innovation. It is to identify the handful of issues most likely to create material legal or reputational exposure and establish a defensible record showing that the company recognized and responsibly addressed those risks.
How Holtzman Vogel Can Assist
Holtzman Vogel helps technology companies assess risk before an inquiry and respond when one begins. Our work includes privileged investigations readiness reviews, representation before DOJ, the FTC, state attorneys general, and Congress, internal investigations, executive preparation, and coordinated legal and communications strategies.
The firm can also help companies navigate conflicts between federal and state requirements, challenge unlawful government action where appropriate, and engage policymakers as the national AI framework continues to develop.
AI policy will continue to change. The underlying investigative risk is already here. Companies that evaluate that risk before the government does will be better positioned to innovate, respond quickly, and protect their technology, leadership, and reputation.
