The shift. AI oversight has crossed from policy argument into the operating budget. The stronger evidence is not a market-size estimate from an unfamiliar trade source; it is the work the rules now require. Colorado's SB24-205 requires high-risk AI developers and deployers to manage algorithmic-discrimination risk, supply documentation, complete impact assessments, notify consumers, and maintain risk-management programs. NIST's AI Risk Management Framework gives that work a voluntary operating grammar. Governance is becoming a recurring function rather than a one-time legal review.
The cost arrives unevenly. In the United States the rules are arriving as a state-by-state patchwork rather than a single federal standard. A company selling into several states inherits several rulebooks: Colorado's high-risk AI obligations, state automated-decision rules, privacy laws that touch profiling, and sector rules in lending, hiring, housing, insurance, and health care. IAPP's tracker is useful because it records the patchwork itself, not because any one state rule now settles the national standard.
Why size decides. Compliance work is largely fixed cost. Regulatory monitoring, outside counsel, documentation, risk systems, and audit preparation cost roughly the same whether a company has eleven employees or eleven thousand. A large organization absorbs that as overhead. A company of a dozen people absorbs it as a tax on the productivity gain that drew it to AI in the first place.
Economic historians have a name for the dynamic underneath this. A fixed regulatory cost spread over a larger revenue base is a smaller burden per unit of output, which is one of the oldest reasons industries concentrate. Meatpacking after the 1906 federal inspection law, pharmaceuticals after the 1962 Kefauver-Harris amendments, banking after each cycle of capital rules: in each case a rising compliance floor favored the companies large enough to step over it.
The timing sharpens the effect. The same operational AI adoption that lets a small company run lean now carries a governance bill that partly offsets the lean. A company faces three options, none clean: pay for compliance and watch it eat the efficiency gain, limit AI use to stay below the regulatory line, or accept legal exposure by doing the minimum.
The pattern to watch. A bifurcated market is forming. Larger organizations book compliance as a cost of doing business; smaller ones weigh it against the productivity case each time. If the floor keeps rising, AI capability that was supposed to widen access to leverage may instead concentrate it among the companies already carrying governance infrastructure, the inverse of the democratization the technology was sold on.