What Happened
AI policy debate is extending beyond model behavior to the cost and control of AI infrastructure. AI Now urged Congress to oppose the Bipartisan American Affordability and Jobs Act, arguing that it would weaken local, state and Tribal oversight of large technology companies while accelerating data-center development with inadequate ratepayer protections. Those are AI Now’s characterizations, not an independent assessment of the bill’s effects [2].
Separately, AI Now’s Aya Ibrahim discussed priorities for a new Congress, including AI regulation and the tension between U.S.–China national-security goals and domestic economic needs [1]. These reports describe policy positions and debate; they do not announce a new technical standard or safety-research result.
Why It Matters to Businesses
AI governance now has two linked dimensions: whether an application is safe and accountable, and whether the infrastructure supporting it is economically and politically sustainable. A project can pass a model-risk review yet face delays or higher costs from power constraints, permitting, procurement rules or changes in local oversight. Businesses should avoid treating proposed federal policy as settled law, or assuming it will replace state and local obligations [2].
Kimbodo Engineering Perspective
Standards are useful operating tools, not substitutes for legal analysis. The NIST AI Risk Management Framework can structure risk ownership, evaluation and monitoring; OECD AI principles can help frame accountability. EU requirements and other jurisdiction-specific rules need separate applicability reviews. Safety research and frontier-model evaluations can inform tests, but their results do not establish that a particular business workflow is safe.
The practical trade-off is between review depth and deployment speed. Apply stronger controls to systems that make consequential decisions, access sensitive data or act autonomously; keep lower-risk uses proportionate. Record the reasoning so controls can change as evidence or policy changes.
How We Would Implement It
- Inventory AI use cases, models, data flows, vendors, hosting locations and accountable owners.
- Classify each use case by potential harm, autonomy, data sensitivity and applicable jurisdiction; maintain a separate register of proposed versus effective rules.
- Set release gates for data protection, task-specific accuracy, misuse testing, human escalation and rollback. Retest after model, prompt, tool or data changes.
- Assess infrastructure dependencies—including capacity, energy exposure and provider concentration—alongside application safety.
- Keep audit records of evaluations, incidents, approvals and vendor changes so governance remains verifiable.
Risks, Costs and Security
Evaluation, monitoring and audit trails add engineering and operating costs. Skipping them can leave businesses unable to explain failures or respond to regulatory change. Security reviews should cover access controls, prompt-injection paths, data retention and third-party dependencies. Infrastructure plans should include capacity and cost contingencies rather than relying on a single policy outcome. AI Now’s objections illustrate why those assumptions deserve scrutiny, but do not by themselves establish what Congress will enact [2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Cost & Governance practice, or Analyze My AI Costs.
