Understanding U.S. AI Regulation in 2026
The United States does not currently have a single comprehensive federal statute governing artificial intelligence across the private sector. U.S. AI regulation instead comes from targeted federal, state, and local laws, and sector-specific requirements.
An organization may need to consider several of those layers at once. The same AI system can intersect with federal consumer protection or employment law, state requirements governing automated decision-making, contractual obligations, and voluntary governance frameworks.
For businesses, compliance depends on the specific AI use, jurisdiction, industry, organizational role, and people affected by the system. Understanding the actual use case is more useful than looking for one universal “AI law.”
U.S. AI Regulation Comes From Federal, State, and Sector-Specific Rules
Organizations cannot treat U.S. AI regulation as one law or one compliance deadline.
| Layer Organizations May Need To Consider | What It Can Include |
|---|---|
| Federal laws and executive policy | Targeted statutes, national AI policy, executive orders, and requirements governing federal AI use and procurement. |
| Federal agency authority | Consumer protection, employment, securities, communications, privacy, and other laws applied to AI-related conduct. |
| State and local laws | Requirements addressing automated decisions, employment, disclosures, frontier models, biometrics, synthetic media, and consumer protection. |
| Voluntary frameworks and standards | Resources such as the NIST AI RMF that can support AI governance and AI risk management but do not independently establish legal compliance. |
An enacted statute carries a different legal status from an executive order, agency policy, proposed AI legislation, or voluntary framework. One AI system may also need to be evaluated against several of these categories at the same time.
Federal AI Regulation Combines Targeted Laws, Executive Policy, and Existing Authority
The absence of a comprehensive federal AI law hasn’t left a complete regulatory vacuum. Congress has enacted laws that cover specific harms involving artificial intelligence, the executive branch has established national AI policy, and federal agencies continue to apply their statutory authority to AI-related activity.
Targeted Federal Laws Can Reach AI-Related Conduct
The TAKE IT DOWN Act is one example of Congress addressing a specific harm without establishing an omnibus artificial intelligence law.
Signed into law in May 2025, the Act addresses the intentional disclosure of specified nonconsensual intimate visual depictions, including qualifying digital forgeries, and requires covered platforms to remove covered content. Its scope is targeted to those harms rather than artificial intelligence generally.
Executive Actions Shape National AI Policy
Federal AI policy has changed considerably since the beginning of 2025:
- January 2025: Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence, directed development of an AI Action Plan and review of prior federal AI policy.
- July 2025: The White House released America’s AI Action Plan, organized around accelerating innovation, building AI infrastructure, and international diplomacy and security.
- December 2025: Executive Order 14365 established a policy favoring a more uniform national AI framework and directed federal action involving certain state AI laws.
- March 2026: The White House released a national AI legislative framework recommending federal legislation, including specified federal preemption of state AI laws.
The March 2026 framework remains a set of legislative recommendations rather than enacted law. Executive Order 14365 likewise does not, by itself, invalidate every state AI law.
The Office of Management and Budget (OMB) policy adds another federal layer. M-25-21 and M-25-22 govern federal-agency AI use and acquisition, addressing areas such as governance, higher-impact AI, and procurement. These policies can affect vendors and contractors working with federal agencies in applicable contexts, but they are not generally applicable private-sector AI regulation.
Federal Agencies Apply Existing Laws to AI
Using artificial intelligence does not remove an activity from laws governing consumer protection, employment, securities, communications, or similar areas.
| Agency | Representative AI-Related Focus |
|---|---|
| Federal Trade Commission | Unfair or deceptive practices, AI-related marketing claims, consumer protection, and related privacy or security conduct under authorities including the FTC Act. |
| Federal Communications Commission | AI-generated or cloned voices used in calls subject to existing requirements governing artificial or prerecorded voices. |
| Securities and Exchange Commission | False or misleading statements about AI capabilities or use, including prior “AI washing” enforcement actions. |
| Equal Employment Opportunity Commission | AI and machine-learning tools used in recruiting or employment decisions where federal anti-discrimination laws can apply. |
Federal agency jurisdiction follows the activity involved — such as employment, securities, communications, or consumer protection — rather than a single AI-specific regulatory regime.
State AI Laws Create Different Requirements Across Jurisdictions
States have taken materially different approaches to AI regulation. Some laws focus on frontier-model safety and transparency. Others address automated decision-making, employment, consumer disclosures, or prohibited uses.
Here’s how a few states are already regulating AI:
| State | Regulatory Focus | Representative Requirements | Status |
|---|---|---|---|
| California | Frontier models, AI safety, and independent assessment. | SB 53 addresses frontier-model transparency and safety. SB 813 and AB 1405 establish frameworks for independent verification and AI-auditor oversight. | SB 813 and AB 1405 were signed in September 2026, with implementation moving forward. |
| New York | Frontier-model transparency and safety. | The RAISE Act requires covered frontier-model developers to establish safety frameworks, provide transparency, and report specified critical-harm incidents. | Signed in December 2025; implementation is underway. |
| Colorado | Automated decision-making in consequential decisions. | The revised automated decision-making framework applies to developers and deployers of covered systems, including specified consumer protections. | Effective Jan. 1, 2027; rulemaking is underway. |
| Texas | AI disclosures and prohibited uses. | The Texas Responsible Artificial Intelligence Governance Act establishes specified disclosure obligations and prohibited uses. | Effective Jan. 1, 2026. |
| Utah | Consumer disclosures and sector-specific oversight. | Requirements emphasize consumer protection, transparency, and the state’s regulatory-learning approach. | In effect, with continued activity through the Office of Artificial Intelligence Policy. |
| Illinois | Employment-related AI. | Employment-related AI requirements address discriminatory AI use and applicable notice obligations. | Effective Jan. 1, 2026. |
Note that this isn’t a complete list. An organization operating across jurisdictions may need to evaluate the same AI system against different definitions, disclosures, documentation requirements, assessments, and prohibited-use provisions.
That variation can change which organizations are covered, when assessments or notices are required, and what documentation must be maintained, even when the underlying AI capability is similar.
Some Uses of AI Face More Regulatory Requirements
The United States doesn’t use one universal definition of “high-risk AI systems.” Depending on the jurisdiction or program, relevant terms can include high-impact AI, automated decision-making technology, and systems involved in consequential decisions.
Regulatory activity frequently focuses on several types of AI use:
- Employment and workforce decisions: Recruiting, screening, hiring, promotion, discipline, and worker evaluation can raise discrimination, notice, documentation, and algorithmic discrimination concerns.
- Consequential consumer decisions: Credit, insurance, housing, education, and essential services can trigger state or sector-specific requirements.
- Healthcare: Clinical, administrative, and consumer-facing AI can intersect with healthcare regulation, privacy requirements, professional obligations, and consumer protection.
- Consumer-facing AI and synthetic media: Chatbots, voice cloning, deepfakes, generative AI, and other AI-generated content can raise disclosure, fraud, deception, or consumer-protection issues.
- Biometrics and personal data: Facial, voice, and other biometric applications can implicate privacy rules alongside newer AI laws.
- Frontier models: California and New York illustrate an emerging category of AI oversight focused specifically on developers of powerful frontier models.
Organizations should examine what the AI system does, which decisions it affects, what data it uses, where it operates, and which role the organization plays.
Businesses Should Map AI Requirements to Their Use Cases
A compliance review starts with an inventory of where AI is in use and what each system does.
- Inventory AI systems and use cases. Include internally developed AI, third-party AI tools, embedded AI functionality, and significant automated decision systems.
- Document intended use, affected people, and jurisdictions. Record what the system does, what decisions it influences, and where it is used.
- Map applicable requirements by role and use case. Separate federal law, agency requirements, state and local laws, contractual obligations, and voluntary frameworks. Distinguish enacted requirements from proposed legislation and guidance.
- Maintain governance documentation and supporting evidence. Depending on applicable requirements, this may include policies, risk or impact assessments, vendor documentation, testing records, disclosures, approvals, and monitoring evidence.
- Revisit the analysis as systems or requirements change. Expanded uses, model changes, new vendors, additional jurisdictions, enforcement activity, and amended AI laws can change the organization’s obligations.
The NIST AI Risk Management Framework (AI RMF) is a voluntary resource for organizing AI risk-management practices. NIST states that AI RMF 1.0 is voluntary and is currently being revised.
Organizations may also use ISO/IEC 42001 as a management-system structure for AI governance. Neither framework determines which federal, state, or local legal requirements apply to a particular AI system.
What To Watch in U.S. AI Regulation
Several active developments could affect compliance planning over the coming months:
- Federal legislation and preemption: The March 2026 national policy framework recommends federal legislation and specified preemption of state AI laws, but those recommendations have not become law.
- FTC activity: The Commission’s July 2026 AI accuracy policy statement remains proposed rather than final.
- Colorado implementation: Rulemaking continues ahead of the Jan. 1, 2027 effective date for the revised automated decision-making framework.
- California implementation: State agencies are implementing SB 813 and AB 1405, including the independent-verification and AI-auditor frameworks.
- NIST AI RMF: NIST is revising AI RMF 1.0, so organizations using the framework should monitor the revised version rather than treating the current framework as static.
Current obligations and known implementation dates already give organizations concrete requirements to incorporate into AI governance and compliance planning.
U.S. AI Regulation FAQs
Does the U.S. Have a Single Federal AI Law?
No. The United States does not have one comprehensive federal private-sector AI law covering all industries. Targeted statutes, executive policy, existing federal laws, agency enforcement, and state and local AI laws can still create requirements for specific activities.
Which Federal Agencies Regulate AI?
Federal agencies including the FTC, FCC, SEC, and EEOC (supplemented by the 2025 EO 14281 ) apply authority tied to AI-related activity. Their jurisdiction generally follows areas such as consumer protection, communications, securities, or employment rather than one universal AI regulation.
Which States Have AI Laws?
Many states have enacted AI-related requirements with different scopes. California, New York, Colorado, Texas, Utah, and Illinois illustrate approaches covering frontier models, automated decision-making, employment, disclosures, and consumer protection.
What Should Businesses Do About Changing AI Regulations?
Organizations should inventory AI use, identify relevant jurisdictions and activities, establish applicable requirements with appropriate legal support, maintain governance documentation and evidence, and revisit that analysis as AI systems and laws change.
Evaluate Your AI Governance Readiness
A consistent governance structure can make a fragmented regulatory environment easier to evaluate.
Organizations should be able to substantiate how AI systems are identified, how risk-management responsibilities are assigned, which controls apply, and what evidence supports those controls.
Insight Assurance can independently evaluate governance structures, documented risk management, policies and responsibilities, control evidence, and alignment with applicable assurance frameworks and standards.
Talk to an expert about AI governance and audit readiness.
