AI Regulation in the US: What the Legislative Vacuum Means for Your Contracts Right Now

The Regulatory Gap Is a Contractual Problem

US AI regulation remains conspicuously absent at the federal level. Technology executives have called publicly for Congress to act, yet the legislative calendar shows no urgency on either side of the aisle, and the Trump administration has signalled a preference for industry self-governance over statutory rules. For in-house legal teams, the absence of a federal framework is not a reason to relax. It is, in fact, the opposite: when the law is silent, contracts bear the full weight of risk allocation, and teams that have not updated their AI-related agreements are carrying exposure they may not have priced.

The practical consequence is a patchwork of state laws, sector-specific agency guidance, and contractual custom that varies by counterparty and jurisdiction. That patchwork is already generating disputes. Understanding where the legal obligations are actually coming from, and drafting contracts that reflect them, is now a core commercial-law function rather than a specialist concern.

Where the Obligations Are Coming From Instead

Without a federal AI Act, US AI compliance obligations are assembling themselves from several directions at once. The EU AI Act applies to any company supplying or deploying AI systems that affect EU users, regardless of where the vendor is headquartered. California, Colorado, Texas and Illinois have each advanced AI-related statutes or regulations covering automated decision-making, biometric data and consumer-facing AI tools. Sector regulators, including the SEC, CFPB and FTC, are applying existing authority to AI-driven products through enforcement actions and guidance.

For supply chains, this means an AI vendor incorporated in Delaware and serving customers in Frankfurt is already subject to high-risk AI system obligations under EU law. The contractual terms between that vendor and its customers need to reflect those obligations: audit rights, model documentation requirements, human oversight clauses and data-processing agreements that are fit for purpose under the GDPR as well as any applicable US state privacy law.

AI Liability and Indemnification: The Clauses That Need Rewriting

The single most consequential gap in most enterprise AI contracts today is the liability and indemnification framework. Legacy software agreements, repurposed for AI deployments, typically limit liability to fees paid and exclude consequential loss entirely. That structure was designed for deterministic software that does what it is specified to do. AI systems generate outputs that their developers cannot fully predict, and the downstream harm from a flawed model output, whether a biased hiring recommendation, an incorrect medical summary or a defective contract draft, can easily exceed the contract value many times over.

In-house teams should press vendors on three specific points: first, whether indemnification covers regulatory fines arising from AI outputs, not merely third-party IP claims; second, whether the liability cap is subject to a carve-out for losses caused by model drift or training-data defects; and third, whether the vendor's obligations survive termination long enough to cover latent harms from AI decisions taken during the contract term. None of these provisions are standard yet. That is precisely why they need to be negotiated now.

Supply-Chain Terms and AI Vendor Due Diligence

AI regulation in the US may be slow, but export-control and national-security policy is moving quickly. The Commerce Department's controls on advanced semiconductor exports affect the compute infrastructure underlying frontier AI models, and those controls create supply-chain obligations that flow through procurement contracts. Companies buying AI services that rely on restricted hardware need representations and warranties from vendors confirming compliance with Bureau of Industry and Security requirements.

Beyond export controls, responsible AI procurement now requires a due-diligence layer that mirrors the approach taken in modern data-processing agreements. Organisations should be requesting model cards, training-data provenance statements and third-party audit results as part of vendor onboarding. Contractually, those documents should be incorporated by reference so that material inaccuracies in them trigger a remedy, not merely an awkward conversation.

What In-House Teams Should Renegotiate or Watch in 2025

The regulatory vacuum will not last indefinitely. When federal AI rules do arrive, they will almost certainly impose obligations on both deployers and providers of AI systems, and contracts that pre-date the legislation will need to be amended. Teams that have built amendment-trigger clauses into their AI agreements, provisions that require renegotiation upon the enactment of materially applicable law, will be in a far stronger position than those who must rely on general change-of-law provisions or, worse, renegotiate from scratch under time pressure.

Priority actions for 2025 include: auditing all AI-related vendor agreements for liability cap adequacy; inserting regulatory-change clauses that automatically require the parties to align the contract with new AI legislation within a defined period; reviewing data-processing schedules to ensure they cover AI training as a processing activity; and confirming that acceptable-use policies in AI platform agreements do not inadvertently restrict legitimate business use cases that may be central to the company's operations.

Adira's contract-intelligence layer can identify which agreements in a portfolio reference AI tools, automated decision-making or machine-learning systems, and flag the clauses that carry the highest regulatory exposure. In a market where the rules are still being written, knowing what you have already agreed to is the essential first step.