Imagine three startups using the same AI model. The first uses it to write social media posts and marketing emails. The second uses it to summarize job applications so a human recruiter can review them faster. The third lets it automatically rank candidates and reject the ones it scores lowest, with no person reviewing the decision.
Same technology, very different legal risks. A clumsy marketing post may be embarrassing, but an automated system that rejects job applicants could expose a company to claims of unfair or discriminatory hiring under federal, state, and local anti-discrimination laws. In New York City, for example, employers that use automated tools to screen candidates may need an annual independent bias audit and advance notice to applicants. The difference isn’t the AI itself; it’s how the AI is used and who it affects.
That's the central idea behind AI governance: understanding how your company uses AI, who it affects, and what safeguards are needed. Think of it as the AI version of basic business housekeeping. The NIST AI Risk Management Framework, published by the U.S. National Institute of Standards and Technology, offers a voluntary roadmap built around four functions: Govern (set policies and assign responsibility), Map (understand where and how AI is used), Measure (assess the risks), and Manage (take steps to reduce them).
For startups, AI governance isn't only about new AI-specific rules like the EU AI Act, which can reach U.S. companies that offer AI systems in the EU. Laws that already exist may apply to how you use AI today. Privacy laws can govern the personal data you feed into an AI tool. Anti-discrimination laws can apply to AI-assisted hiring, lending, or housing decisions. Intellectual property law can raise questions about who owns AI-generated content (the U.S. Copyright Office generally will not register material created without meaningful human authorship) and whether training data was used properly. And consumer protection laws, including the FTC's ban on deceptive practices, can apply if you overstate what your AI product can do.
Where should founders start?
A good first step is a short intake review. Our AI Intake Checklist helps startups identify potential legal risks before launching an AI-powered product.
The core questions of the AI intake checklist will include the following:
Use: What decisions does the AI make or influence? The more it affects people’s jobs, money, health, or opportunities, the more care it needs.
Data: What information does it process, and do we have the rights to use it? Customer data, personal information, and third-party content may come with legal or contractual limits.
Vendors: What protections do our AI provider contracts offer? Check how the provider can use your data, who owns the outputs, and who is responsible if something goes wrong.
Oversight: Who is responsible when the AI gets something wrong? Someone on the team should be able to review, correct, and explain the AI’s results.
Good AI governance doesn't require an enterprise-sized compliance department. Startups can begin by identifying their AI uses, assessing potential harms, assigning responsibility, and documenting safeguards.
At the Brooklyn Law Incubator & Policy (BLIP) Clinic, we help startups navigate emerging technology law. This includes helping founders identify AI-related legal risks early and consider practical steps to manage them.
The takeaway: don’t wait for an AI-specific law, or a customer complaint, to start asking these questions.