Purchase orders, not statutes, now set the binding AI compliance floor.
With omnibus AI legislation stalled, GSA contract clauses, state procurement certifications, and COSO/NIST-aligned RFP requirements are imposing the operative safeguards — training bans, attestations, audit trails, and supply-chain flow-downs — that actually bind AI vendors.
The same conclusion keeps arriving from across the workspace's research — 1 topics independently instantiate this theme. Filter the evidence by where it came from:
Binding AI safeguards are arriving through federal contract clauses with mandatory flow-downs rather than through any enacted statute.
State purchasing power, not pending legislation, is setting the de facto certification standard vendors nationwide must meet.
Compliance is now delivered through negotiated clause families — training data, retention, deprecation, exit — rather than by any statutory framework.