Monday morning, a client suddenly asks: “Could there be legal trouble with a contract I wrote using AI?”
Last Wednesday morning, I was helping a freelance photographer in Hangzhou organize a quote template. The client suddenly asked, “Have you ever used AI to process my portrait release? Could that create legal risk?” In that moment, I realized that when we sell AI services, what clients really worry about is not whether the tool is smart, but who is responsible when something goes wrong. I got stuck here too: at first, I focused on showing efficiency without explaining where the tool should or should not be used.
This news is not about a new model. It is about a regulatory division of labor
According to the report, the US Department of Justice has established a “Superintelligence Task Force” with two seemingly different jobs: coordinating AI-related judicial cases and reviewing or challenging some state AI laws. Its main clients are AI companies and platforms, not people like us looking for a step-by-step guide. Put simply, the first job focuses on “how cases are investigated and who is held accountable,” while the second focuses on “where rules might conflict.”
Here is a more concrete example. Suppose Maya, an AI compliance consultant in San Francisco, receives an email from a state attorney on Thursday afternoon. She needs to determine whether a client’s automated decision-making system falls under a new local rule. She would not only study model parameters. She would first check the types of cases covered by the task force, differences among state laws, and the company’s existing records. For us, this means that signing contracts, writing product descriptions, and keeping records of human reviews may matter more than adding one more flashy feature.
How to replicate this today: spend 0 yuan and 30 minutes on a risk checklist
Money: 0 yuan. Time: 30 minutes. Technical barrier: no coding knowledge required—only the ability to open a website and organize documents. First step: open the state or city government website where your target clients are located and search for “AI regulation,” “automated decision-making,” or “consumer protection.” Paste three relevant requirements into a spreadsheet, then mark whether you currently provide a human appeal process, data explanations, and a route for human review.
I have made this mistake before. I once interpreted “someone is handling it at the federal level” as meaning “the rules are the same everywhere,” only to discover later that state laws, industry rules, and client contracts can all point in different directions. You can also start with a one-page document listing your data sources, whether the system makes decisions on people’s behalf, and who gives final approval. There is no pressure to try this now; not everyone needs this tool or every regulatory development. If your business does not currently involve personal data or consequential decisions, just write down the question for later.
Here is how I would organize this based on the stage I am at
If I had just started, I would spend 30 minutes creating a risk checklist and specify in client agreements how the tool will be used, how human review works, and where responsibility ends. While I was not yet taking on complex work, there would be no reason to turn compliance into a major project.
If I already had one or two clients, I would list their locations and industries, check local rules specifically, and ask a qualified professional to review clauses involving health, hiring, credit, or children’s data. I would also find an industry lawyer before answering based on instinct.
If I were scaling up, I would turn regional differences, data records, model-vendor responsibilities, and incident handling into a fixed process, then review it every quarter. You can also invite me to break down the checklist with you, but the final judgment still needs to come from a local lawyer.