What are the key takeaways from this Software Engineering Daily episode?

Key insights include: **Concentric Circles Framework:** Rather than auditing all 150+ U.S. state AI laws, start by mapping which regulatory circles apply to your specific product. Identify your geography, data type, and federal agency jurisdiction first. Most state privacy laws only trigger above specific revenue or data-volume thresholds, so many early-stage companies won't qualify for the majority of statutes.; **Risk Spectrum Prioritization:** Calibrate governance effort to potential human harm. A manufacturing optimization tool sits at the low-risk end; a loan-decisioning or healthcare AI sits at the high-risk end and triggers laws like Gramm-Leach-Bliley or HIPAA immediately. Map your use case, data sensitivity, and affected population before selecting a compliance tier to avoid over- or under-investing.; **Shadow AI Inventory First:** Before building any governance program, audit every AI tool currently in use across the organization, including tools that silently added AI features via a toggle. Unsanctioned tools bypass enterprise controls, create undocumented data flows, and expose the company to liability. Block egregious cases immediately, then formalize procurement review as a standing process.

What did Shannon Uvorsky and Kevin Ball discuss on Software Engineering Daily?

Data lawyer Shannon Uvorsky from ORIC joins Software Engineering Daily to map the AI regulatory landscape for tech companies. With over 150 active U.S. state AI laws, no federal equivalent, and the EU AI Act phasing in, she outlines a risk-based compliance framework built on transparency, fairness, safety, and accountability. Key topics include: **Concentric Circles Framework:** Rather than auditing all 150+ U.S. state AI laws, start by mapping which regulatory circles apply to your specific product. Identify your geography, data type, and federal agency jurisdiction first. Most state privacy laws only trigger above specific revenue or data-volume thresholds, so many early-stage companies won't qualify for the majority of statutes.; **Risk Spectrum Prioritization:** Calibrate governance effort to potential human harm. A manufacturing optimization tool sits at the low-risk end; a loan-decisioning or healthcare AI sits at the high-risk end and triggers laws like Gramm-Leach-Bliley or HIPAA immediately. Map your use case, data sensitivity, and affected population before selecting a compliance tier to avoid over- or under-investing..

How long is this episode of Software Engineering Daily?

This episode is 53 minutes long. SignalCast provides an AI-generated summary so you can get the key insights in about 3 minutes.

Software Engineering Daily

AI Regulation and What Every Tech Company Should Know

October 29, 2026

53 min episode · 2 min read

Shannon Uvorsky,Kevin Ball

Episode

53 min

Read time

2 min

Topics

Career Growth, Health & Wellness, Investing

AI-Generated Summary

Published Oct 29, 2026

Key Takeaways

✓Concentric Circles Framework: Rather than auditing all 150+ U.S. state AI laws, start by mapping which regulatory circles apply to your specific product. Identify your geography, data type, and federal agency jurisdiction first. Most state privacy laws only trigger above specific revenue or data-volume thresholds, so many early-stage companies won't qualify for the majority of statutes.
✓Risk Spectrum Prioritization: Calibrate governance effort to potential human harm. A manufacturing optimization tool sits at the low-risk end; a loan-decisioning or healthcare AI sits at the high-risk end and triggers laws like Gramm-Leach-Bliley or HIPAA immediately. Map your use case, data sensitivity, and affected population before selecting a compliance tier to avoid over- or under-investing.
✓Shadow AI Inventory First: Before building any governance program, audit every AI tool currently in use across the organization, including tools that silently added AI features via a toggle. Unsanctioned tools bypass enterprise controls, create undocumented data flows, and expose the company to liability. Block egregious cases immediately, then formalize procurement review as a standing process.
✓Recorded Meetings as Litigation Risk: Any recorded meeting not protected by legal privilege becomes discoverable in litigation or regulatory investigations. AI notetakers operating under one-party consent may still violate state wiretap laws. Enterprise-licensed versions allow organizations to configure consent notices and storage controls, significantly reducing legal exposure compared to individually downloaded tools.
✓EU AI Act Tiered Obligations: The EU AI Act applies extraterritorially to any company deploying AI within the EU and uses four risk tiers: prohibited practices (social scoring, workplace emotion recognition), high-risk systems (hiring, lending, healthcare), transparency-required systems, and minimal-risk systems. Transparency guidelines were finalized in mid-2025, making compliance obligations now actionable for companies with EU users.

What It Covers

Data lawyer Shannon Uvorsky from ORIC joins Software Engineering Daily to map the AI regulatory landscape for tech companies. With over 150 active U.S. state AI laws, no federal equivalent, and the EU AI Act phasing in, she outlines a risk-based compliance framework built on transparency, fairness, safety, and accountability.

Key Questions Answered

•Concentric Circles Framework: Rather than auditing all 150+ U.S. state AI laws, start by mapping which regulatory circles apply to your specific product. Identify your geography, data type, and federal agency jurisdiction first. Most state privacy laws only trigger above specific revenue or data-volume thresholds, so many early-stage companies won't qualify for the majority of statutes.
•Risk Spectrum Prioritization: Calibrate governance effort to potential human harm. A manufacturing optimization tool sits at the low-risk end; a loan-decisioning or healthcare AI sits at the high-risk end and triggers laws like Gramm-Leach-Bliley or HIPAA immediately. Map your use case, data sensitivity, and affected population before selecting a compliance tier to avoid over- or under-investing.
•Shadow AI Inventory First: Before building any governance program, audit every AI tool currently in use across the organization, including tools that silently added AI features via a toggle. Unsanctioned tools bypass enterprise controls, create undocumented data flows, and expose the company to liability. Block egregious cases immediately, then formalize procurement review as a standing process.
•Recorded Meetings as Litigation Risk: Any recorded meeting not protected by legal privilege becomes discoverable in litigation or regulatory investigations. AI notetakers operating under one-party consent may still violate state wiretap laws. Enterprise-licensed versions allow organizations to configure consent notices and storage controls, significantly reducing legal exposure compared to individually downloaded tools.
•EU AI Act Tiered Obligations: The EU AI Act applies extraterritorially to any company deploying AI within the EU and uses four risk tiers: prohibited practices (social scoring, workplace emotion recognition), high-risk systems (hiring, lending, healthcare), transparency-required systems, and minimal-risk systems. Transparency guidelines were finalized in mid-2025, making compliance obligations now actionable for companies with EU users.

Notable Moment

Uvorsky reveals that ORIC's AI law tracker, which cuts through roughly 1,500 proposed state bills down to only enacted laws, was initially built by a single attorney manually reviewing state government websites because AI tools consistently failed to navigate them reliably.

Know someone who'd find this useful?

Episode Transcript

The rapid rise of AI has set off a flurry of legal and regulatory activity. There is no single AI law to follow. Instead, there are overlapping circles of regulation, where privacy, cybersecurity, consumer protection, employment, and IP laws all continue to apply alongside newer AI specific rules. Europe has its EU AI Act, but The US has no federal equivalent yet. In its place is an emerging patchwork of more than 150 state AI laws, and the picture shifts every few months as new legislation and guidelines arrive. For engineers and tech companies, it can feel impossible to know what applies and where the real risks lie. Shannon Uvorsky is a data lawyer who co leads the Cyber, Privacy, and Data Innovation Group and the AI practice at the international law firm ORIC. She advises companies across sectors from health technology to financial services on how to develop and deploy AI responsibly amid this evolving regulatory environment. In this episode, Shannon joins Kevin Ball to make sense of that landscape. They discuss how to map concentric circles of regulation that actually apply to you, the risk spectrum separating a low stakes manufacturing tool from a high stakes system making loan or health care decisions, the problem of shadow AI and why recorded meetings can become a litigation liability, how to build an AI governance program, and more. Kevin Ball, or Kate Ball, is the vice president of engineering at Mento and an independent coach for engineers and engineering leaders. He co founded and served as CTO for two companies, founded the San Diego JavaScript Meetup, and organizes the AI in Action discussion group through Latent Space. Check out the show notes to follow k ball on Twitter or LinkedIn or visit his website, kball.llc. Shannon, welcome to the show. Thank you so much for having me. Yeah. I must admit, I'm personally very interested in this topic because it's an area of uncertainty for me. Getting to dig in with an expert about state of regulation will be good. But let's start with you a little bit. So can you give us a a brief bit about your background and what brought us to be speaking together today? Yeah. Sure thing. So I describe myself as a data lawyer. I spend most of my time at the intersection of technology regulation and business. I co head ORIC's cyber privacy and data innovation practice, and I also co head our AI practice, which is a lot of people think about, oh, are you helping people implement legal tools like Harvey? And I definitely use those tools, but that is not my job. I advise companies on their development and deployment of AI technology. And just like a deep background, because I think this is helpful, I went to law school in England, and I started off life as an IP lawyer, as an intellectual intellectual property lawyer, and sort of moved from IP to tech transactions to privacy. So the …

Get the full transcript (8,272 words) + summary by email — free

One-time email with the complete transcript and AI summary of this episode. No account needed.

One email, no spam. We’ll also show you what SignalCast does.

Browse all Software Engineering Daily transcripts →