AI, Law, and Rights

When a new technology emerges, existing law rarely fits perfectly. The legal frameworks societies have built — privacy law, civil rights law, antitrust law, consumer protection law, constitutional rights — were designed for the world that existed when they were written. They encode assumptions about how decisions are made, how harms occur, and who is responsible. AI challenges many of those assumptions, creating gaps where existing law provides inadequate protection and generating questions that courts and legislators are only beginning to answer. This lesson surveys how legal systems are responding to AI: where existing frameworks apply, where they fail, and what new governance approaches are emerging domestically and internationally.

Where Existing Law Applies

Many AI harms fit within existing legal categories, even if the fit is imperfect. Civil rights law prohibits discrimination on the basis of protected characteristics in employment, housing, and credit. If an AI hiring system rejects more qualified Black applicants than equally qualified white applicants, that is employment discrimination — regardless of whether the discriminating entity is a human manager or an algorithm. The Equal Credit Opportunity Act applies to automated credit decisions. The Fair Housing Act applies to algorithmic tenant screening. Title VII of the Civil Rights Act applies to AI-mediated hiring. The practical challenge is proof. Discrimination law generally requires showing disparate treatment (different rules applied to different groups) or disparate impact (neutral rules producing disproportionate harm to protected groups). Proving disparate impact from an AI system requires access to the system's outputs and training data — which are typically proprietary. A plaintiff must demonstrate the disparity with data they may not be able to obtain, creating an asymmetry between the party harmed and the party who possesses the relevant evidence. Consumer protection law applies when AI systems deceive or mislead. If a chatbot presents itself as human when asked directly, that may constitute deceptive practice. If an AI pricing system charges different prices to different demographic groups, consumer protection authorities may investigate. These applications are less contested; the harder problems lie where AI creates harms that existing categories do not capture well.

Constitutional protections also apply, though with complexity. The Fourth Amendment protection against unreasonable search and seizure has been extended by courts to some digital data: in Carpenter v. United States (2018), the Supreme Court held that the government generally needs a warrant to obtain historical cell phone location records. But the doctrine is evolving, and many AI-enabled data collection practices exist in legal grey zones. First Amendment protections for speech interact complexly with AI. Platform content moderation using AI may restrict speech in ways that would be unconstitutional if done by government — but platforms are private entities not bound by the First Amendment. The question of whether large platforms function as de facto public infrastructure — and thus should be held to constitutional standards — is actively contested in courts and legislatures. The key insight is that existing law provides partial protection, not full protection. The gaps are significant, and filling them requires either creative interpretation of existing frameworks by courts or deliberate legislative action.

Emerging AI Governance Frameworks

Recognizing the gaps in existing law, governments and international bodies are developing AI-specific governance frameworks. Several are worth understanding in detail. The European Union's AI Act (2024) is the most comprehensive AI-specific legislation enacted to date. It takes a risk-based approach: AI applications are classified by risk level (unacceptable, high, limited, minimal), with different requirements for each. Unacceptable-risk applications — such as social scoring by governments, real-time biometric surveillance in public spaces, and systems exploiting psychological vulnerabilities — are prohibited outright. High-risk applications (AI in medical devices, education, employment, credit, law enforcement) face mandatory transparency requirements, conformity assessments, and human oversight obligations. Foundation models above a compute threshold face additional requirements including documentation of training data and red-team safety evaluations. The United States has taken a more sectoral, executive-order-driven approach. Executive Order 14110 (2023) directed federal agencies to develop sector-specific AI guidelines and required that developers of powerful AI models share safety test results with the government before public deployment. Sector-specific regulators (FDA for medical AI, CFPB for financial AI, EEOC for employment AI) are developing application-specific rules using existing statutory authority. The United Nations adopted a framework resolution on AI governance in 2024, though international agreements on AI remain nascent. The challenge of international AI governance is significant: AI development and deployment is global, but governance is national, and regulatory arbitrage is possible.