AI laws in 2026: what US companies need to know before sharing data

Which AI laws actually apply to a company supplying data?#

The AI laws that apply to a data supplier are mostly general laws about personal information, communications, confidentiality and fair dealing, not the new statutes with AI in their names. Those newer laws are written for model developers and for businesses that use AI to make decisions about people.

A general counsel preparing to license support tickets, CRM histories or engineering records should therefore sort the rules into two groups: laws that bind the company directly because of what is in the records, and laws that bind the buyer and reach the company only through contract and documentation requests. The table below is a starting map, not a complete list, and every row may apply differently depending on your records and your buyer.

Why AI-specific laws rarely bind the supplier directly#

AI-specific laws rarely bind the supplier because their duties attach to building, offering or deploying an AI system, and a company licensing historical records does none of those things. The obligations to publish training data documentation, assess risk or explain automated decisions sit with the developer or the deployer.

The supplier still feels these laws. A developer that must describe its training sources will ask you for provenance, date ranges, whether personal information was present and how it was removed. Expect those requests in diligence questionnaires and in the license itself, often as representations you are asked to sign.

• 1Where the records came from and which systems produced them.
• 2The date range covered and how recently the records were collected.
• 3Whether the records contained personal information and what preparation removed it.
• 4What rights you hold to license the records and any restrictions on use.
• 5Whether any records came from third parties, such as customers or vendors.

What state privacy laws expect before records leave the company#

State privacy laws expect a company to know whether its licensed records contain personal information and, if they do, to have a lawful basis and accurate notice for disclosing it. Under several state laws, making personal information available to another business for value may count as a sale, which can bring opt-out and contract requirements.

Properly de-identified information is usually treated differently, but the definitions tend to require more than deleting names. Many expect technical measures against re-identification plus public and contractual commitments, so the preparation method and the license terms both matter.

The list of states keeps growing: comprehensive privacy laws in Indiana, Kentucky and Rhode Island took effect on January 1, 2026. Coverage also differs by state. California's law can reach employee and business contact records, which matters for HR files, email archives and CRM contact histories, while the Colorado Attorney General states that the Colorado Privacy Act does not cover people acting in a commercial or employment context. Map which states' residents appear in each record family before deciding what preparation is needed.

Some companies that license data also ask whether state data broker registration laws reach them. The answer turns on how each law defines a broker and on whether you have a direct relationship with the people in the records, so treat it as a separate question for counsel.

Older laws that matter most for operational records#

Operational records raise legal questions that predate AI, and those questions usually decide the licensable scope. Recorded sales and support calls can trigger consent questions under federal and state wiretap laws, especially in states that require every party's consent. Chat widgets and session replay tools on websites have drawn similar claims.

Trade secret law cuts both ways. Licensing your own playbooks or pricing logic may weaken secrecy protection unless the license keeps confidentiality obligations in place, and records that hold a customer's confidential information may be covered by an NDA or a confidentiality clause. The FTC Act matters wherever your privacy policy, terms of service or sales materials promised something the license would contradict.

A pre-sharing checklist for general counsel#

A pre-sharing checklist turns a broad legal question into a set of documents to pull and decisions to record. Work through it before any sample leaves the company, and keep the answers in one file that the rights review and the buyer's diligence can both use.

• 1Map the record families: personal information, employee data, communication content, customer confidential information and third-party code.
• 2Identify where the people in the records live, including any EU or UK residents.
• 3Collect the privacy notices in effect when the records were created and the current version.
• 4Pull customer contracts, NDAs and vendor terms for confidentiality, data use and no-AI-training language.
• 5Choose the preparation method, such as removal, de-identification or aggregation, and document it.
• 6Ask the buyer which AI-law obligations it carries and what it needs from you to meet them.
• 7Allocate risk in the license: limited representations, permitted use, deletion and audit terms.

Illustrative example: a software company maps its exposure#

Illustrative: a fictional accounts payable software company in Ohio wants to license Zendesk tickets linked to Jira issues and GitHub pull requests. Its customers are mostly US businesses, with a few in Europe. Counsel finds that the privacy notice mentions service providers but not licensing, that ticket text includes names and email addresses of customer staff and occasional invoice numbers, and that several enterprise contracts prohibit using customer data to train AI.

The company excludes tickets from the restricted customers and from European accounts, removes personal details and invoice numbers, and updates its privacy notice for future records. It gives the buyer a written description of sources, date range and preparation method to support the buyer's own disclosures. The licensed scope is narrower than the first idea, but every remaining record has a documented basis.

How SourceX handles the legal review#

SourceX handles legal review in the Rights step of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Contracts, notices and the record types in scope are reviewed before any preparation starts, and each party's counsel assesses the applicable laws for that specific deal. SourceX does not give legal advice.

The results go into a SourceX Evidence Packet covering provenance, licensing rights, permitted use, the privacy record and release authorization. That single record answers most of the documentation questions a developer brings from its own AI-law obligations, without the supplier rebuilding the answers for each request.