State AI rules are moving fast on synthetic media, while Texas and China show two different models for governing generative systems. For data teams, the common thread is clear: content provenance, privacy risk, and deployment controls are becoming compliance issues, not just model issues.
State AI Laws in the United States
As of mid-2025, 47 U.S. states had enacted laws targeting AI-generated synthetic media, particularly deepfakes. The measures are concentrated around two areas with immediate legal sensitivity: non-consensual intimate imagery and election-related deepfakes. That shift matters because synthetic content is no longer being treated as a narrow online-safety problem; it is now a state-level policy and enforcement issue with uneven rules across jurisdictions.
For operators, the practical challenge is fragmentation. A workflow that is acceptable in one state may trigger disclosure, takedown, or liability concerns in another, especially when synthetic media touches identity, consent, or political communications. Even teams that do not build foundation models may be exposed if they distribute, label, or monetize generated content.
- Teams distributing synthetic media need a state-by-state compliance review because deepfake rules are spreading faster than most product policies are updated.
- Deepfake detection, watermarking, and provenance controls are becoming practical safeguards that can support moderation, incident response, and audit readiness.
- Privacy and election-risk use cases now carry direct legal exposure, which raises the stakes for consent management and content review before release.
TRAIGA: Texas Responsible Artificial Intelligence Governance Act
TRAIGA was enacted in June 2025 and creates a formal framework for AI development and deployment in Texas. The law prohibits harmful uses and establishes the Texas Artificial Intelligence Council, giving the state an institutional mechanism for oversight rather than relying only on broad policy guidance. That makes Texas one of the clearer examples of U.S. state governments moving from principles to enforceable governance structures.
For companies operating in Texas, the immediate implication is operational: governance expectations may need to be documented, not assumed. Use-case reviews, internal controls, and escalation paths for higher-risk deployments become more important when a state creates a standing body focused on AI oversight. Vendors selling into regulated or public-sector contexts should expect more questions about how systems are tested, monitored, and constrained.
- AI governance in the U.S. is shifting from voluntary guidance to enforceable state law, which increases the need for documented controls.
- Companies operating in Texas may need formal use-case reviews and policy guardrails to show that harmful deployments are identified and limited.
- State councils can become recurring points of scrutiny for vendors and deployers, especially where procurement, public services, or sensitive data are involved.
Interim Measures for the Management of Generative AI Services
China’s 2023 interim measures for generative AI services require content to embody Core Socialist Values and place obligations on providers to ensure training data is true and accurate. The framework describes supervision as “inclusive and prudent,” but it clearly combines support for AI development with strict content and governance requirements. In practice, this ties model deployment to both data quality obligations and political content controls.
For cross-border teams, China’s rules illustrate how AI regulation is diverging not just on privacy or safety, but on underlying governance assumptions. Product, legal, and data teams may need separate compliance pathways for China-based services, especially where training data sourcing, output filtering, and provider accountability differ from U.S. or European expectations. The result is more operational complexity for any company trying to standardize one global generative AI stack.
- Global AI compliance is fragmenting along political as well as technical lines, which makes one-size-fits-all governance harder to maintain.
- Training-data governance is now part of regulatory compliance, not just model quality, so data lineage and validation processes matter more.
- Cross-border product teams may need separate policy stacks for China, including localized controls for content, data sourcing, and service deployment.