The United States does not currently have a comprehensive federal privacy law, though multiple states have begun to fill the void in the absence of federal policy. Similarly, multiple countries outside the United States have passed privacy laws, and most of this legal activity — domestic and international — is not sector- or industry-specific. Against this backdrop, artificial intelligence systems, trained on vast amounts of data, continue to advance without a clear consensus on principles or a process to assess and mitigate AI risk. However, state and federal governments around the world are developing approaches to measuring and mitigating risks, with many of the governance requirements reflecting a parallel to privacy governance requirements.