AI Governance for Consumer Goods: The Regulatory Record

EU high-risk obligations for AI embedded in regulated products

Deferred from August 2, 2027 by twelve months. Covers AI embedded in products already subject to EU product safety legislation listed in Annex I, such as machinery and medical devices.

EffectiveAug 2, 2028 · 727 days out

What it means for CPGThis is the plant floor. AI embedded in production machinery covered by the Machinery Regulation inherits the conformity assessment obligation, which pulls engineering and site quality into a compliance process they have not run before.

EU high-risk obligations for standalone Annex III systems

Deferred from August 2, 2026 by sixteen months. Covers standalone high-risk systems listed in Annex III, including employment, education, critical infrastructure, and credit scoring. Obligations include conformity assessment, risk management, data governance, technical documentation, logging, human oversight, and registration.

EffectiveDec 2, 2027 · 483 days out

What it means for CPGFor a CPG company, this is the hiring and workforce management stack in Europe. Conformity assessment across multiple systems and facilities is a multi-quarter program, and the deferral exists because the harmonised standards were not ready, not because the bar moved.

Colorado automated decision-making technology duties

Substantive obligations under SB 26-189 commence January 1, 2027. The Attorney General must adopt clarifying rules by that date. Deployers owe pre-use notice, an adverse-action process with rights to correct data and to meaningful human review where commercially reasonable, and three-year record retention. The Attorney General holds exclusive enforcement authority and there is no private right of action.

EffectiveJan 1, 2027 · 148 days out

What it means for CPGThe adverse-action process is the build. A rejected Colorado candidate must be able to see that ADMT was involved, correct inaccurate data, and request human review. That is a workflow, an SLA, and a record, not a policy paragraph.

California ADMT opt-out and access rights complete their phase-in

The CPPA's automated decision-making technology regulations complete their phase-in, with full opt-out provisions due. The rules apply to CCPA-covered businesses using ADMT for significant decisions, including decisions affecting employment, contracting opportunities, or compensation.

EffectiveJan 1, 2027 · 148 days out

What it means for CPGOpt-out is the provision that touches system design. A screening or compensation process that cannot function without ADMT needs an alternative path, and building that alternative takes longer than writing the notice.

EU prohibition on AI-generated intimate imagery and new legacy transparency duties

The Digital Omnibus adds an Article 5 prohibition covering AI systems used to generate non-consensual intimate imagery and child sexual abuse material, carrying the maximum penalty tier. On the same date, Article 50(2) machine-readable marking extends to systems already on the market before August 2, 2026.

EffectiveDec 2, 2026 · 118 days out

What it means for CPGTwo jobs. Any generative image or audio capability in the marketing stack needs technical and contractual safeguards against this use before December. Any AI content tool already in production needs machine-readable marking retrofitted, which is the harder of the two.

Connecticut Artificial Intelligence Responsibility and Transparency Act

SB 5 establishes a framework for automated employment-related decision processes, phasing in from October 1, 2026 through October 1, 2027. The first phase amends the Fair Employment Practices Act so that use of automated employment decision technology is not a defense to a discrimination claim, though anti-bias testing may be considered in mitigation, and adds a WARN Act AI disclosure requirement. Interactive disclosure and pre-decision notice follow in 2027.

EffectiveOct 1, 2026 · 56 days out

What it means for CPGThe mitigation provision is the operative detail. Connecticut is the first state to say plainly that documented anti-bias testing can reduce exposure, which converts testing from a compliance cost into a defense. The WARN disclosure means AI's role in a workforce reduction becomes reportable.

EU AI Act transparency obligations apply

Article 50 transparency duties took effect on schedule. Systems that interact with people must disclose that they are AI, and synthetic image, audio, video, and text output must be marked in a machine-readable format. The Digital Omnibus did not move this date.

What it means for CPGAny consumer-facing chatbot on an EU storefront, and any AI-generated product imagery or ad copy running in the EU, needs disclosure and machine-readable marking now. Agencies and content vendors need this written into their statements of work.

Council of the EU gives final approval to the Digital Omnibus on AI

The Council signed off on the amendment package, following the Parliament vote on June 16. Standalone high-risk obligations under Annex III move to December 2, 2027. AI embedded in regulated products under Annex I moves to August 2, 2028. A new prohibition on AI-generated non-consensual intimate imagery enters Article 5.

What it means for CPGA CPG company that scoped its EU conformity assessment work to an August 2026 deadline now has sixteen more months, but the underlying obligations did not change. Grandfathering applies to systems placed on the market before the new dates until they are substantially modified, so the question of what counts as a substantial modification becomes a governance decision worth documenting.

Mobley v. Workday: court lets core discrimination claims proceed

Judge Rita Lin of the Northern District of California largely denied Workday's motion to dismiss, and rejected the argument that California anti-discrimination law does not reach applicants screened from outside California. FEHA claims continue alongside ADEA and ADA claims.

What it means for CPGThe theory that survived is that a screening vendor acts as the employer's agent. A CPG company running high-volume plant and warehouse hiring through a third-party platform cannot treat vendor selection as a procurement decision. The screening logic is the employer's, legally speaking.

European Parliament adopts the Digital Omnibus on AI

Parliament endorsed the amendment package by 423 votes to 57, with 174 abstentions, after trilogue negotiations reached provisional agreement on May 7.

What it means for CPGThe vote margin signals that the deferral was not contested on substance. Treat the new dates as settled and reallocate the runway to conformity assessment and human-oversight design rather than pausing the program.

Mobley discovery ruling shields vendor bias-testing data

Magistrate Judge Laurel Beeler denied a motion to compel Workday's internal bias-testing data, holding it privileged because counsel curated it to give legal advice. She also denied a motion to compel customer applicant data, finding Workday lacked control of it under Rule 34.

What it means for CPGTwo lessons cut in opposite directions. Structuring bias testing under counsel can protect the work product. But a deployer cannot assume the vendor's testing will ever be available to defend the deployer's own decisions, which is an argument for running disparate impact analysis on your own applicant population rather than relying on the vendor's validation study.

Colorado repeals and replaces its AI Act before it ever took effect

Governor Polis signed SB 26-189, replacing the 2024 Colorado AI Act with a narrower regime built around covered automated decision-making technology. Duties to conduct impact assessments, maintain a risk management program, and affirmatively prevent algorithmic discrimination are gone. What remains is pre-use notice, an adverse-action process with a right to correct data and to meaningful human review, and three-year record retention, all operative from January 1, 2027.

What it means for CPGThe first comprehensive state AI law became the first one walked back, which tells you how unsettled this area is. For CPG employers, screening, ranking, and evaluating Colorado candidates and employees is in scope. Routine scheduling and clerical routing are expressly out.

EU institutions reach provisional agreement on the AI Omnibus

Parliament and Council reached political agreement on targeted AI Act amendments after an April 28 trilogue collapsed. Member State representatives confirmed the deal in Council on May 13.

What it means for CPGSuperseded by formal adoption in June. Kept here because the April breakdown and May recovery are the reason many compliance calendars carried two conflicting deadlines through the spring.

Colorado court suspends enforcement of SB 24-205

The District of Colorado granted a joint motion by xAI and the Colorado Attorney General suspending enforcement of the 2024 AI Act pending the close of the legislative session and a ruling on xAI's preliminary injunction motion.

What it means for CPGThe suspension became academic three weeks later when the legislature replaced the statute outright. The sequence is worth keeping: a company sued, the federal government joined, the state suspended enforcement, and the legislature rewrote the law. That is a repeatable playbook other states will notice.

DOJ intervenes against a state AI law for the first time

The Justice Department moved to intervene in xAI's suit against the Colorado Attorney General, filing its own complaint alleging that SB 24-205 violates the Equal Protection Clause by compelling discrimination based on protected characteristics. The court granted the intervention.

What it means for CPGThis is the first practical use of the AI Litigation Task Force created under Executive Order 14365. A multi-state CPG employer should expect more state AI laws to face federal challenge, and should build compliance programs that survive either outcome rather than betting on preemption.

xAI sues to enjoin the Colorado AI Act

xAI filed in the District of Colorado against Attorney General Philip Weiser, challenging the constitutionality of SB 24-205 ahead of its June 30, 2026 effective date.

What it means for CPGThe first direct constitutional challenge to a comprehensive state AI statute. The theory, that a state law regulating algorithmic discrimination reaches beyond state borders and compels speech, will be recycled against California and Connecticut.

FDA issues its first warning letter over AI agents in manufacturing

The FDA criticized a cosmetics laboratory for inappropriate use of AI agents in pharmaceutical manufacturing. The company subsequently ceased drug production.

What it means for CPGThis is the clearest signal yet that FDA will apply existing manufacturing oversight to agentic systems without waiting for AI-specific guidance. A cosmetics or OTC manufacturer running AI agents in batch release, deviation handling, or quality documentation should assume the same standard applies to those systems as to any other automated process, and should be able to produce validation records on request.

White House releases a National Policy Framework for AI

The administration published legislative recommendations to Congress for a unified federal approach to AI regulation, following the December executive order and an earlier failed attempt to attach a state-law moratorium to a budget bill.

What it means for CPGRecommendations are not law. Congress has not passed comprehensive AI legislation, and preemption of state AI law is not close. Plan for the patchwork, not for its consolidation.

Commerce evaluation of onerous state AI laws comes due, and does not appear

Executive Order 14365 required the Commerce Secretary to identify onerous state AI laws within 90 days and recommend referrals to the DOJ task force. The evaluation was not publicly released on the deadline.

What it means for CPGThe absence of the list is itself planning information. Without a published federal target list, no state law can be treated as safely dormant. Compliance scoping stays state by state.

Supreme Court declines Thaler v. Perlmutter

The Court denied certiorari, leaving intact the ruling that upheld the Copyright Office's refusal to register a work generated without human authorship.

What it means for CPGPurely machine-generated marketing assets, package art, and campaign copy carry no copyright protection. A brand that wants to own its creative needs a documented record of human authorship in the process, which is a workflow requirement, not a legal footnote.

Court authorizes collective notice in Mobley v. Workday

The court formally authorized notice to a nationwide ADEA collective covering anyone who applied for a job through Workday since September 24, 2020 and was 40 or older at the time. Race and disability claims remain in the case but are not certified.

What it means for CPGThe collective is defined by the platform, not by the employer. Every company that ran hiring through the platform in that window sits inside the factual record even without being named, which makes retention of your own applicant data and screening configuration a present concern.

India amends IT Rules for synthetically generated information

India amended its IT Rules to regulate synthetically generated content, mandating labeling, metadata requirements, grievance redressal, and expedited takedowns. This follows the AI Governance Guidelines issued by MeitY in late 2025, which chose a sectoral model over a single AI act.

What it means for CPGA CPG brand running AI-generated creative in India needs labeling and a grievance channel. India's approach, soft law across the ecosystem and hard rules where harm is visible, is the pattern several other markets are copying.

South Korea's AI Framework Act takes effect

The Act on the Development of Artificial Intelligence and Establishment of Trust took effect after a one-year transition, making Korea the second jurisdiction after the EU with an economy-wide AI law. It applies extraterritorially, imposes obligations on high-impact AI including employment uses, and requires generative AI providers to notify users in advance and label output. A grace period defers most fines for at least a year.

What it means for CPGEmployment is a named high-impact category, so a CPG company hiring in Korea is in scope. Foreign operators may need to designate a Korean representative. Korean-language notices and content labeling belong in the market-entry checklist, not the post-launch cleanup.

DOJ establishes the AI Litigation Task Force

Attorney General Pam Bondi issued a memorandum creating a task force whose mandate is to challenge state AI laws, as directed by Executive Order 14365.

What it means for CPGA federal body now exists whose purpose is to unsettle the state law your compliance program is built on. That argues for governance controls tied to your own risk posture rather than to the text of any single state statute.

Texas Responsible Artificial Intelligence Governance Act takes effect

HB 149 took effect, creating one of the broadest enacted state AI frameworks, covering data protection, transparency, and prohibited uses across industries. It bars deploying AI systems with intent to discriminate.

What it means for CPGTexas carries heavy CPG manufacturing and distribution footprint. The intent standard is narrower than a disparate impact standard, but the breadth of covered systems means plant-floor and logistics AI sit inside the frame, not just hiring tools.

Illinois requires notice when AI is used in employment decisions

Amendments to the Illinois Human Rights Act took effect requiring employers to notify applicants and employees when AI is used in hiring, recruitment, and other employment decisions, and prohibiting AI use that produces discriminatory outcomes including through proxies such as ZIP code.

What it means for CPGThe ZIP code provision matters for CPG hiring. A screening model that weights commute distance or location for plant and warehouse roles can encode a protected characteristic without naming it. That correlation is now expressly on the record as a compliance concern.

California frontier AI, training data, and ADMT rules take effect

A cluster of California requirements became operative: SB 53 frontier model duties for developers training above 10^26 FLOPS, AB 2013 training data transparency, and the CPPA's automated decision-making technology regulations layered on top of CCPA and CPRA, with certain opt-out provisions phasing through January 2027.

What it means for CPGMost CPG companies are deployers, not frontier developers, so SB 53 is a vendor diligence question rather than a direct duty. The ADMT rules are the direct exposure: pre-use notice, access rights, and opt-out for significant decisions including employment and compensation.

Executive Order 14365 sets a national AI policy framework

The order established federal policy favoring a uniform national approach to AI regulation, directed the Attorney General to create an AI Litigation Task Force, required Commerce to identify onerous state laws, contemplated conditioning federal funding, and directed the FTC to issue a Section 5 policy statement on AI. Carve-outs cover child safety, AI compute infrastructure, and state government AI procurement.

What it means for CPGExecutive orders do not preempt state law. Preemption flows from acts of Congress. The practical effect for a CPG compliance program is more legal turbulence around state obligations, not fewer obligations.

European Commission proposes the Digital Omnibus on AI

The Commission published a simplification package amending the AI Act, GDPR, ePrivacy, NIS2, and the Data Act. The headline proposal deferred high-risk obligations, prompted by delays in designating national competent authorities and finalizing harmonised standards.

What it means for CPGThe stated reason for the delay is worth reading closely. The standards and conformity assessment infrastructure that high-risk compliance depends on was not ready. That is a supply problem, not a signal that the obligations are softening.

California applies FEHA to automated decision systems in employment

Civil Rights Council regulations took effect applying California's anti-discrimination law to automated decision systems used in employment. Employers are responsible for discriminatory outcomes produced by third-party vendor tools, and must retain ADS-related records including inputs, outputs, criteria, and bias testing results for four years.

What it means for CPGFour-year retention of screening inputs and outputs is an operational build, not a policy statement. If your applicant tracking system does not retain model inputs and scores today, that is a system change with a lead time, and California is the largest state footprint most CPG companies have.

China's AI content labeling measures take effect

The Cyberspace Administration of China's Measures for Labeling AI-Generated Content, issued March 14, 2025 alongside mandatory national standard GB 45438-2025, took effect. Providers must apply explicit visible labels and embed implicit labels in file metadata.

What it means for CPGChina moved first on machine-readable provenance and the EU followed with Article 50. A brand producing AI-assisted creative for multiple markets should build labeling into the asset pipeline once, at the point of generation, rather than retrofitting per jurisdiction.

EU AI Act obligations for general-purpose AI models apply

Transparency and documentation obligations for general-purpose AI model providers, along with governance structures and the penalty regime, became applicable in the second phase of the Act's rollout.

What it means for CPGThis phase lands on model providers, not on CPG deployers. Its practical value to a deployer is contractual: the documentation your vendor is now obliged to produce is documentation you can require in the agreement.

White House publishes the AI Action Plan

The administration released its AI Action Plan, setting the deregulatory posture that later produced the December executive order and the March 2026 legislative framework.

What it means for CPGFederal direction shifted toward removing barriers rather than adding obligations. State legislatures moved the other way. That divergence, not any single statute, is the defining feature of the US environment a CPG governance program has to operate in.

Kadrey v. Meta: fair use, on a failure of proof

Judge Chhabria granted summary judgment for Meta two days after the Bartz ruling, but rested the outcome on the plaintiffs' failure to prove market harm rather than on a broad endorsement of training as fair use. The opinion signaled that stronger economic evidence could change the result.

What it means for CPGRead alongside Bartz, the two decisions disagree about which fair use factor governs. That disagreement is unresolved, which means a CPG company relying on a vendor's fair use assurance is relying on district court reasoning that no appellate court has yet reviewed.

Bartz v. Anthropic: training is fair use, holding pirated copies is not

Judge Alsup found training on lawfully acquired books transformative and protected, while retention of a pirated library was not. The case later settled for 1.5 billion dollars, with a fairness hearing set for April 2026.

What it means for CPGThe distinction is data provenance, not model behavior. For a CPG company licensing an AI tool trained on third-party content, the diligence question is where the training data came from and whether the vendor can document it, because that is the line the court drew.

Japan enacts the AI Promotion Act

Japan adopted a deliberately light-touch framework encouraging cooperation with government safety measures and allowing the government to name companies publicly for human rights violations involving AI, without monetary penalties.

What it means for CPGReputational exposure without financial penalty is still exposure. For a brand operating in Japan, the enforcement mechanism is publicity, which for a consumer-facing company can cost more than a fine.

Thomson Reuters v. Ross Intelligence rejects fair use

A Delaware federal court issued the first merits decision on fair use in AI training, granting partial summary judgment to Thomson Reuters. The court found Westlaw headnotes protectable and Ross's use non-transformative, weighing heavily that the resulting product competed directly with the source. The case is on appeal to the Third Circuit.

What it means for CPGThe Third Circuit ruling will be the first appellate word on AI training and fair use, and it will sit above every district court decision that currently guides vendor risk assessments. Treat any vendor indemnity written before that ruling as provisional.

EU AI Act prohibitions and AI literacy duties apply

The first phase of the Act became applicable, banning a defined set of AI practices outright and requiring providers and deployers to ensure a sufficient level of AI literacy among staff operating AI systems.

What it means for CPGThe AI literacy duty is the one most often missed because it carries no filing. It reaches anyone in a European plant, office, or commercial team who operates an AI system, which makes it a training and records question for HR and site leadership.

South Korea promulgates its AI Framework Act

Korea became the first Asia-Pacific jurisdiction to adopt comprehensive AI legislation, with a one-year transition before the Act took effect in January 2026.

What it means for CPGSuperseded by the effective date entry above. Retained because the one-year transition model, promulgate then phase, is the structure most jurisdictions outside the EU have adopted.

FDA issues draft guidance on AI in regulatory decision-making

The FDA published its first guidance on using AI to produce information supporting regulatory decisions about drug and biological product safety, effectiveness, or quality, built around a risk-based credibility assessment framework tied to context of use. A companion draft addressed AI-enabled device software across the product lifecycle.

What it means for CPGNo equivalent AI-specific guidance exists for food or cosmetics. The credibility framework is nonetheless the clearest statement of how the agency thinks about AI in a regulated safety decision, and it maps directly onto contamination detection, allergen monitoring, and formulation screening.

Canada's AI and Data Act dies on the order paper

AIDA, introduced as Part 3 of Bill C-27 in June 2022, died when Parliament was prorogued. It has not been reintroduced. Canada entered 2026 without an AI statute, relying on privacy law, sectoral regulation, and policy instruments.

What it means for CPGA CPG company operating in Canada governs AI through PIPEDA, Quebec's Law 25, and sector regulators, not through an AI act. A February 2026 consultation summary points toward future rules on safety evaluation, red-teaming, human oversight, and lifecycle traceability.

Brazil's Senate approves AI Bill 2338/2023

The Senate approved a risk-based framework closely aligned with the EU AI Act. The bill then moved into a longer legislative process including a dedicated committee and public hearings, and has not been enacted.

What it means for CPGBrazil is a significant CPG market and the bill tracks the EU model, so a company already building for the AI Act would inherit most of the work. Nothing binds yet.

FTC launches Operation AI Comply

The Commission announced five simultaneous enforcement actions against deceptive AI claims and has brought more than a dozen since, spanning administrations. Matters have included overstated accuracy claims, automation claims, and business opportunity marketing, with an 18 million dollar judgment against Air AI proposed in March 2026.

What it means for CPGThe FTC did not need new authority. Section 5 substantiation applies to an AI claim exactly as it applies to a product efficacy claim. A brand advertising AI-powered personalization, shade matching, or formulation needs a substantiation file with test methodology and accuracy data before the claim runs, and the claim's scope cannot exceed the training scope.

EU AI Act enters into force

The world's first economy-wide AI regulation entered into force, classifying systems by risk with staggered application dates. Penalties reach 3 percent of global annual revenue or 15 million euros for high-risk violations, and 7 percent or 35 million euros for prohibited practices.

What it means for CPGClassification follows consequence of failure, not product category. An AI vision system inspecting food for contamination, a quality system on a cosmetics line, and a tool screening job applicants are all high-risk. Nothing about being a consumer goods company puts a system outside the perimeter.

Colorado enacts the first comprehensive state AI law

SB 24-205 imposed duties on developers and deployers of high-risk AI to use reasonable care to prevent algorithmic discrimination, conduct impact assessments, and maintain a risk management program. It was repealed and replaced in May 2026 before ever taking effect.

What it means for CPGKept in the record because it set the vocabulary every subsequent state bill borrowed, and because its collapse is the clearest available evidence that early comprehensive state AI statutes are not durable planning assumptions.

ISO/IEC 42001 published

The first certifiable AI management system standard was published, giving organizations an auditable structure for AI governance modeled on the management system approach used in ISO 9001 and ISO 27001.

What it means for CPGNot law, but the thing a retail customer or enterprise partner now asks about in a supplier questionnaire. For a CPG supplier, certification is the shortest path to answering AI governance diligence without writing a bespoke response every time.

Bletchley Declaration signed at the UK AI Safety Summit

Twenty-eight countries and the EU signed a declaration on frontier AI risk, establishing the first multilateral statement of shared concern and launching the summit series.

What it means for CPGNo binding obligation followed for deployers. Its lasting effect was institutional: the national AI safety institutes created in its wake now produce the technical evaluations that later regulation references.

China's Interim Measures for Generative AI Services take effect

Providers of publicly accessible generative AI must ensure content is lawful and truthful, label AI-generated output, and register their algorithms with regulators.

What it means for CPGAlgorithm registration is a market access requirement, not a disclosure formality. A brand deploying a consumer-facing generative tool in China needs that filing before launch.

NYC Local Law 144 enforcement begins

Employers and employment agencies may not use automated employment decision tools for hiring or promotion in New York City unless the tool has passed an independent bias audit within the previous year, with results published and candidates notified.

What it means for CPGThe first US law to require a published bias audit. For a CPG company with New York corporate or commercial hiring, the audit is annual, independent, and public, which means a competitor or a journalist can read your tool's impact ratios.

UK publishes its pro-innovation AI White Paper

The UK proposed a non-binding, principles-based approach with existing sector regulators governing AI within their remits, declining a single AI regulator or uniform rules. Successive governments have kept this posture. As of mid-2026 no AI bill sits before Parliament, and ministers have signaled none in the short to medium term.

What it means for CPGFor a CPG company with UK operations, AI is governed at the point of use through UK GDPR, equality law, consumer protection, and product safety. There is no separate AI compliance regime to build against, which makes the existing frameworks the whole of the obligation.

NIST releases the AI Risk Management Framework 1.0

NIST published a voluntary framework organized around four functions, govern, map, measure, and manage, giving US organizations a common structure and vocabulary for AI risk.

What it means for CPGVoluntary, and the most widely adopted governance scaffold in US industry. Adopting it gives a CPG program a defensible structure and, more practically, a shared vocabulary with auditors, insurers, and enterprise customers.

Modernization of Cosmetics Regulation Act enacted

MoCRA gave FDA meaningful authority over cosmetics for the first time in eighty years, requiring facility registration, product listing, safety substantiation, and adverse event reporting.

What it means for CPGAI systems that generate safety documentation, auto-populate registrations, or screen formulations for compliance now operate inside a regulated regime. Substantiation is the operative word: a model's output is not substantiation, and the record has to show what evidence supports the safety determination.

New York City enacts Local Law 144

The Council passed the first US bias audit mandate for automated employment decision tools, with enforcement beginning July 2023 after an extended rulemaking.

What it means for CPGThe eighteen-month gap between enactment and enforcement is the pattern worth noting. Employment AI laws are routinely passed before the audit methodology exists, and the rulemaking is where the actual obligation gets defined.

European Commission proposes the AI Act

The Commission published the first draft of a risk-tiered economy-wide AI regulation, beginning a three-year legislative process that concluded with entry into force in August 2024.

What it means for CPGThree years from proposal to law, then another two to four before the substantive obligations bind. That cadence is the planning horizon for comprehensive AI legislation anywhere, and it is why the pending column on this page matters.

California voters approve the CPRA

The California Privacy Rights Act amended the CCPA, created the California Privacy Protection Agency as an independent enforcement body, added a right to correct inaccurate personal information, expanded restrictions on sensitive personal information, and extended protections to employees and job applicants.

What it means for CPGTwo provisions reach CPG directly. Sensitive personal information covers health-adjacent product data and loyalty program inference. Employee and applicant coverage is what makes HR AI a privacy question in California, not only an employment question.

Illinois Artificial Intelligence Video Interview Act takes effect

Enacted in 2019, the Act requires employers to explain how AI video interview analysis works, obtain candidate consent before using it, restrict who may view the recordings, and delete them within thirty days of a candidate request.

What it means for CPGThe first US law written specifically for an AI hiring use case. For CPG companies running high-volume seasonal and hourly hiring, the consent and deletion mechanics have to be built into the applicant workflow, and a vendor's standard terms of service almost certainly do not cover them.

California Consumer Privacy Act signed

The CCPA established rights to know what personal information is collected, to deletion, and to opt out of sale, creating the first broad US state privacy regime.

What it means for CPGAI systems that synthesize consumer data across e-commerce, loyalty, and service touchpoints can trigger obligations even where no single data point would. The synthesis is the processing.

GDPR becomes applicable

The General Data Protection Regulation, adopted in April 2016, became applicable across the EU. Article 22 gives individuals a right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, with rights to human intervention and to contest the decision.

What it means for CPGArticle 22 governed automated decisions five years before generative AI reached the enterprise, and it still does. Any EU hiring, performance, or scheduling system that decides without a human in the chain sits inside it, independent of anything the AI Act requires.

Food Safety Modernization Act signed

FSMA shifted federal food safety regulation from responding to contamination to preventing it, requiring hazard analysis, preventive controls, validation, monitoring, and documented corrective action.

What it means for CPGThis is the framework that governs AI in food safety today, in the absence of AI-specific FDA guidance. A model performing contamination detection or allergen monitoring is a preventive control, which means it must be validated, monitored, and documented to the same standard as any other. A modeled value is not a tested value, and the distinction is legally significant.

Illinois Biometric Information Privacy Act enacted

BIPA requires informed written consent before collecting biometric identifiers, mandates retention and destruction schedules, and provides a private right of action with statutory damages.

What it means for CPGThe private right of action makes BIPA the most litigated biometric statute in the country. For CPG operations, the exposure sits in plant time-and-attendance systems, facial or voice analysis in hiring, and warehouse safety monitoring, all of which predate any AI-specific rule.

Americans with Disabilities Act signed

The ADA prohibits employment discrimination on the basis of disability and requires reasonable accommodation in the application process.

What it means for CPGBehavioral scoring in AI video interviews raises this directly. A model that scores eye contact, facial expression, or speech cadence can penalize a candidate for a disability. The employer remains accountable, and the accommodation obligation attaches to the screening step, not only to the job.

Uniform Guidelines on Employee Selection Procedures adopted

Federal agencies adopted uniform standards for validating employee selection procedures, including the four-fifths rule: a selection rate for any group below eighty percent of the highest group's rate is generally regarded as evidence of adverse impact.

What it means for CPGEvery AI hiring bias audit conducted today measures against this 1978 benchmark. A CPG company that has never validated a selection procedure now has an automated one, and the validation standard did not change because the tool did.

Age Discrimination in Employment Act enacted

The ADEA prohibits employment discrimination against workers aged 40 and older, and supports both disparate treatment and disparate impact claims.

What it means for CPGThe ADEA is the statute behind the certified collective in Mobley v. Workday. A screening model trained on the profile of a current workforce will reproduce that workforce's age distribution, and the resulting pattern is actionable under a law nearly sixty years old.

Civil Rights Act Title VII enacted

Title VII prohibits employment discrimination based on race, color, religion, sex, and national origin, and reaches facially neutral practices that produce disparate impact without business justification.

What it means for CPGDisparate impact is why an AI hiring tool can violate Title VII with no discriminatory intent anywhere in its design. This is the foundation the EEOC has repeatedly confirmed applies to AI: employers remain responsible for outcomes and cannot transfer that liability to a vendor.

Federal Insecticide, Fungicide, and Rodenticide Act enacted

FIFRA governs the registration, distribution, sale, and use of pesticides, and EPA registration determines what claims a product label may carry.

What it means for CPGFor household cleaning and disinfectant brands, an AI content tool that generates an antiviral claim for a product registered only for antibacterial use commits a registration violation. The tool's fluency is irrelevant. Claim language has to come from a pre-approved, registration-accurate library.

Federal Food, Drug, and Cosmetic Act enacted

The FDCA established FDA authority over the safety and labeling of food, drugs, devices, and cosmetics, including the boundary between a cosmetic claim and a drug claim.

What it means for CPGThat boundary is where AI-generated marketing copy fails most often. A skincare product that repairs DNA damage or a hair treatment that reverses hair loss has crossed into drug claim territory, and FDA and FTC enforce the line with warning letters regardless of who or what wrote the sentence.

Federal Trade Commission Act enacted

Section 5 prohibits unfair or deceptive acts or practices in commerce. It is the authority behind every AI advertising enforcement action the FTC has brought.

What it means for CPGThe oldest entry on this page is also the most active. The Commission has needed no new AI rulemaking, because a claim about what an AI product does is a claim, and it requires the same substantiation as a claim about what a moisturizer does.