One rulebook instead of twenty-nine
A company deploying the same model in every state currently answers to twenty-nine sets of rules with different definitions of a high-risk use, different disclosure duties and different audit requirements. None of that duplication protects anybody. It is paid for in legal hours.
▸ Show reasoning & sources ▾ Hide reasoning & sources
Value
The stream is money spent on complying with the same requirement several times over rather than on complying with it once. It is priced at the middle of the scale like any other money and it is a genuine cost rather than a transfer: the legal hours, the duplicate audits and the parallel documentation are consumed. Whether the company or its customers carry it makes no difference to the weight. What the rules themselves achieve is not counted here — this argument is only about paying for the same thing twice, and the value of what would be lost is counted against this measure below. The value is the middle of the scale, the level this site uses for money spent on running a rule.
Impact
Twenty-nine states have enacted artificial intelligence legislation and the definitions do not line up: what counts as a consequential decision, what must be disclosed, who must be notified and what an audit has to contain all vary [1][3]. Roughly 300,000 American businesses deploy artificial intelligence in ways that any of these laws reach — insurers, lenders, employers, health systems and the vendors selling to them. The duplicated compliance cost is put at 2,000 euro each a year, in a range from 700 to 6,000: legal review of each state's requirements, parallel documentation, and the audits that cannot be reused. That gives 600 million euro a year. Taking the two ranges together, short of their joint extremes, the figure runs from about 200 million to 2 billion euro a year. What is not counted is the cost of complying with a single federal standard, which would replace rather than remove the work; only the duplication is counted here. The Impact is the largest on this side and it is the one figure here that follows from arithmetic rather than from a view about what regulation is for.
▸ Show calculation ▾ Hide calculation
| American businesses deploying artificial intelligence in ways state law reaches Setting, range 150,000 to 600,000: no count exists, because the scope differs by state [3] | insurers, lenders, employers, health systems and their vendors | 300,000 businesses | |
| × | Duplicated compliance cost each a year Setting, range 700 to 6,000 euro: legal review of each state's requirements, parallel documentation, audits that cannot be reused; below the industry estimates because state templates partly converge | 2,000 euro | 600 million euro |
| × | Weight of a euro in company budgets the standard weight this site uses for business money | 1.0 | 600 million euro |
| ÷ | Normalised Impact scale of this evaluation | 200 million euro a point | 3 |
Plausibility
That one rulebook instead of twenty-nine saves the duplicated work follows from the law, not from a prediction: once the state rules on these subjects are displaced, nobody has to comply with them. The comparison is the current patchwork, documented state by state [3]. What is uncertain is the size, and neither of its two parts has a source: nobody counts the businesses within scope, and nobody publishes what duplicated compliance costs each of them. Comparable estimates for state privacy law vary by an order of magnitude depending on who commissions them, which is why the figure here sits below the industry estimates. Most state laws follow one of two templates, so a company that meets the strictest may already satisfy most of the rest, which would cut the duplication substantially. These doubts sit in the range around the figure, from about 200 million to 2 billion euro a year, and they are not counted a second time here. The remaining doubt is execution: which state rules a federal standard displaces will be argued in court, and some may survive for years. The Plausibility is very high: the saving follows from the displacement itself, and its size is carried in the range.
Definitional for occurrence (rule 'occurrence and size kept apart', 02.10.2026): duplicated compliance with displaced state rules falls away once they no longer apply; no behavioural link decides whether it happens. Counterfactual: the current patchwork of twenty-nine state laws, documented state by state [3]. Size: unsourced settings — 150,000 to 600,000 businesses in scope and 700 to 6,000 euro each, plus convergence between state templates — carried in the band 0.2 to 2.0 billion euro, not in P. Enforcement risk (P 9.5 rather than 10): the reach of preemption litigated, with some state rules surviving for years. Direction: not applicable.