Post-Election AI Policy: What to Expect in 2025

The 2024 US election is behind us, and if you're running a professional services firm, you're probably wondering what a new administration means for AI regulation. After three years of watching Europe move fast with the AI Act and the US deliberate with executive orders, we're entering a period of significant uncertainty—and opportunity.

Here's what I'm tracking, and what you should be preparing for.

The Policy Space We're Inheriting

Before we look forward, let's be clear about where we stand. The Biden administration issued an executive order on safe, secure, and trustworthy AI in October 2023. It pushed agencies to develop standards around high-risk applications, created frameworks for foundation model testing, and set up coordination between NIST, OMB, and federal agencies. It was thorough but also cautious—heavy on guidance, light on binding rules.

Europe's AI Act, meanwhile, went into effect just this year with real teeth: tiered risk categories, mandatory impact assessments for high-risk systems, and substantial penalties for violations. China has been quietly building its own regulatory regime around generative AI and data governance. And Canada? They're moving toward sectoral regulation, starting with digital safety.

The incoming US administration signals a different philosophy. Less prescriptive regulation, more industry self-governance, faster innovation timelines. That's a significant reset from the cautious approach we've seen.

Three Scenarios to Model

Scenario 1: Light-Touch Deregulation

The most likely outcome: The new administration deprioritizes AI regulation, focuses on removing obstacles to deployment, and lets industry take the lead. This doesn't mean no regulation—it means regulation comes later, after deployment, and is narrower in scope. For you: Compliance risk drops. The window to deploy and scale AI without major compliance overhead widens. But it also means no safety guardrails, which creates reputational risk if something goes wrong. Expect to see firms self-regulate harder, not less.

Scenario 2: Targeted Risk-Based Rules

A middle path: The administration focuses on high-risk applications—AI in hiring, lending, law enforcement, medical diagnosis—and leaves business automation and knowledge work largely untouched. Liability frameworks might expand (who's responsible when an AI-generated contract has an error?), but broad restrictions are avoided. For professional services firms: This is actually manageable. Your use cases—document automation, research assistance, workflow optimization—probably land in the lower-risk bucket. The hard part is definition: what counts as "high-risk"? That's where the lobbying war begins.

Scenario 3: Sector-Specific Rules

The administration pushes responsibility to individual agencies: HHS for healthcare AI, DOJ for legal applications, SEC for financial advice AI. This creates a patchwork where regulations vary by practice area. For you: This is the most complex scenario but also the most realistic given how US regulation actually works. If your firm touches legal advice, financial guidance, or healthcare, you need sector-specific compliance strategies now.

What Professional Services Firms Should Do Right Now

1. Document Your AI Inventory Before any regulatory framework crystallizes, know exactly what AI systems you have, what they do, what data they use, and where the risk is highest. I'm talking about a proper inventory with use cases, not a gut check. This is your foundation for whatever regulatory regime emerges.

2. Build Internal Governance (Not Because the Law Requires It Yet, But Because You'll Need It) The firms that thrive in uncertain regulatory environments have clear internal policies first. Who approves new AI deployments? What's the bar for client data protection? When do you get outside counsel involved? Document this before you're forced to.

3. Track Sectoral Developments If you have practices in healthcare, financial advice, or legal services, don't wait for federal rules. Talk to your regulatory advisors about what's coming in your specific domain. The FTC is already skeptical of AI use in certain contexts. The CFPB is watching AI in lending. SEC is watching AI in investment advice. These conversations are happening now.

4. Manage Your Liability Profile This is the thing I worry about most. If your AI systems generate advice—legal, financial, healthcare—and something goes wrong, who's liable? You, the vendor, or both? This isn't settled law, and it won't be for a while. Work with your insurance broker and counsel to understand your exposure, and consider indemnification agreements with your AI vendors.

5. Position for Client Confidence Regardless of regulation, your clients will ask: What's your AI policy? How are you protecting my data? This is a business question, not just a compliance question. Firms with clear, thoughtful AI policies win more business. Firms with vague policies lose it.

The International Wild Card

Don't forget that US deregulation doesn't change the fact that if you serve European clients, the EU AI Act applies to you. If you serve Canadian clients, federal and provincial frameworks will tighten. If you're multinational, you're now managing multiple regulatory regimes simultaneously. This is actually a competitive advantage if you get ahead of it—firms that can comply globally win global clients.

My Thesis for 2025

I believe the incoming administration will signal a more permissive approach to AI, but this doesn't mean a compliance-free environment. Instead, I think we'll see a bifurcated market: firms that self-regulate rigorously and market themselves as trustworthy, and firms that cut corners and eventually face class-action lawsuits or regulatory action. The smart money is on being in the first category.

The next 12 months are the window to get your governance, your inventory, and your policies in place. Not because you're required to, but because the firms that move fast now will be best-positioned when the regulatory pendulum inevitably swings back.