AI Regulation in the United States

America's AI Action Plan

America's AI Action Plan is the White House's AI policy agenda, released on 23 July 2025. It sets out more than 90 federal actions under three pillars: accelerating AI innovation, building American AI infrastructure, and leading in international AI diplomacy and security. It favors removing regulatory barriers over adding new rules.

California AI Auditor Registration Act (AB 1405)

AB 1405 creates California’s first registry for independent AI auditors. Auditors must register with the Government Operations Agency and disclose their credentials and methods. They must also follow recognized independence standards. From January 1, 2029, only registered auditors may perform covered audits in California.

California Generative AI Transparency Requirements - AB 2013

California Assembly Bill (AB) 2013 requires public training-data disclosures from developers of generative AI systems accessible to the California public. Developers must publish the documentation on their websites. The disclosures explain training datasets’ origins and composition. The requirement applies regardless of where the developer is headquartered.

California AI Transparency Act (SB 942 as amended by AB 853)

The California AI Transparency Act applies to makers of generative AI systems with over 1 million monthly users that are publicly accessible in California. They must offer a free detection tool, offer users a visible disclosure option, and embed latent disclosures in AI-generated images, video, and audio. Licenses must let them revoke access within 96 hours if a licensee disables disclosures.

California Executive Order N-9-26 on Independent AI Oversight and an AI Kill Switch

Governor Newsom signed Executive Order N-9-26 on 18 September 2026. It convenes experts to recommend, within two months, changes to California's frontier AI safety laws, including independent verification and an emergency shutoff for frontier models. It imposes no new duties on companies itself.

California AB 3030: Generative AI Disclosure in Health Care Communications

California AB 3030 has applied since 1 January 2025. Health facilities, clinics, and physician offices must tell patients when generative AI writes communications about their clinical information, and explain how to reach a human. Messages reviewed by a licensed provider are exempt.

California Independent Verification Organizations Act (SB 813)

California SB 813, signed on 9 September 2026, lets the Government Operations Agency designate independent verification organizations (IVOs), meaning approved AI auditors. Using an IVO is voluntary. The agency must set designation requirements by 1 January 2028.

California Transparency in Frontier Artificial Intelligence Act (SB 53)

California's Transparency in Frontier Artificial Intelligence Act (SB 53) applies to developers of the largest AI models. Signed in September 2025 and in force since 1 January 2026, it requires published safety frameworks and transparency reports, and prompt reporting of critical safety incidents. The law also protects employees who report risks.

Colorado AI Act (SB 24-205), repealed

Colorado's SB 24-205, signed in May 2024, would have regulated developers and deployers of high-risk AI. It never took effect: its start date slipped from February 2026 to June 2026. In May 2026 Colorado repealed it and replaced it with SB 26-189, a narrower automated decision-making law effective 1 January 2027.

Colorado SB 26-189: Automated Decision-Making Technology Act

Colorado's SB 26-189, signed on 14 May 2026, repeals and replaces the state's 2024 AI Act. From 1 January 2027 it regulates automated decision-making technology used in consequential decisions about consumers. Deployers must give notice before use, explain adverse outcomes, and offer human review. Developers must give deployers the information they need.

Commerce Department Evaluation of State AI Laws

The December 11, 2025 executive order gives Commerce 90 days to evaluate state AI laws conflicting with federal policy. The review targets compelled changes to truthful AI outputs and disclosures that may implicate First Amendment protections. Identified laws may be referred to the AI Litigation Task Force for possible federal preemption action.

CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments, and Cybersecurity Audits

California's privacy agency finalized rules on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits under the CCPA. They took effect on 1 January 2026, with phased deadlines. Businesses that use ADMT for significant decisions must give notice, offer opt-outs in most cases, and answer access requests.

Executive Order 14318: Accelerating Federal Permitting of Data Center Infrastructure

Executive Order 14318, signed on 23 July 2025, directs federal agencies to speed permitting for large AI data centers. It covers projects needing over 100 MW of new load, and offers financial support and faster environmental reviews for qualifying projects.

Executive Order 14319: Preventing Woke AI in the Federal Government

Executive Order 14319, signed on 23 July 2025, directs federal agencies to buy only large language models that follow two Unbiased AI Principles: truth-seeking and ideological neutrality. OMB implemented it in Memorandum M-26-04 on 11 December 2025.

Executive Order 14110 on Safe, Secure, and Trustworthy Artificial Intelligence

Executive Order 14110, signed on 30 October 2023, set federal requirements for safe AI development, including safety reporting on the most powerful models and NIST standards work. EO 14148 revoked it on 20 January 2025. Some agency rules and guidance it started may still apply.

Federal Communications Commission AI Model Reporting and Disclosure Proceeding

The Federal Communications Commission (FCC) is opening a proceeding on possible federal AI model reporting and disclosure standards. It follows the Commerce Department’s evaluation of state AI laws. An adopted standard could preempt conflicting state disclosure and reporting requirements.

FDA AI/ML Software as Medical Device Guidance

FDA’s action plan and guidance address AI and machine learning (AI/ML) Software as a Medical Device. They introduce a total product lifecycle approach and predetermined change control plans. Self-updating clinical algorithms also face transparency and monitoring requirements.

FTC Enforcement on AI (Section 5 of the FTC Act)

The Federal Trade Commission (FTC) enforces US consumer protection law against companies that make deceptive claims about AI or use AI in unfair ways. It relies on Section 5 of the FTC Act, which bans unfair or deceptive practices, plus trade rules on fake reviews and impersonation. There is no exemption for AI. Any company selling AI products or using AI with US consumers is in scope.

U.S. General Services Administration AI Strategies and Compliance Plan

The GSA AI Strategies and Compliance Plan from the US General Services Administration (GSA) establishes governance for internal agency AI use. An AI Governance Board and oversight committee review and approve use requests. Requirements cover privacy controls, security reviews, use-case intake, and compliance evidence.

Guaranteeing and Upholding Americans' Right to Decide Responsible AI Laws and Standards Act (GUARDRAILS Act)

Democratic lawmakers introduced the GUARDRAILS Act in the House on 20 March 2026 (H.R.8031) and in the Senate on 26 March 2026 (S.4216). It would void Executive Order 14365, which directs federal action against state AI laws, and bar federal funds for carrying it out.

H.R.8094 - AI Foundation Model Transparency Act of 2026

Bipartisan lawmakers introduced H.R.8094 on March 26, 2026. It would require large foundation model developers to disclose training data, model design, limitations, risks, and evaluation methods. The bill seeks public scrutiny through transparency without directly restricting model use or deployment.

Illinois AI Safety Measures Act (SB 315)

The Illinois AI Safety Measures Act was signed on 6 July 2026 and takes effect on 1 January 2027. Frontier AI developers with over $500 million in annual revenue must publish a frontier AI framework and undergo annual independent compliance audits from 2028. The Attorney General enforces it.

Illinois Biometric Information Privacy Act, AI Provisions

Illinois BIPA, 740 ILCS 14, restricts collection, storage, use, and disclosure of biometric identifiers and information. It affects AI processing facial geometry, voiceprints, iris scans, and similar data. BIPA has generated extensive biometric privacy litigation.

Illinois High-Impact AI Governance Principles and Disclosure Act

Illinois HB 3529 would require businesses with 10 or more employees using AI in Illinois to publish a yearly report. The report would explain how they meet five AI governance principles. Violations would carry a $1,000 civil penalty. The bill has stalled in committee since March 2025.

New York's Responsible AI Safety and Education Act (RAISE Act) for Large Developers

New York's RAISE Act was signed on 19 December 2025 and amended on 27 March 2026. From 1 January 2027, frontier model developers with over $500 million in annual revenue must publish a frontier AI framework, issue transparency reports, and report critical safety incidents. A new office in the Department of Financial Services oversees them.

NIST AI 600-1 Generative AI Profile

This companion to NIST AI RMF 1.0 addresses generative AI risks. It covers large language models and multimodal foundation models (general-purpose models that handle text, images, and audio).

NIST AI 300-1 (Initial Public Draft): Guidance and Templates for Public-Facing AI Documentation

NIST's initial public draft of AI 300-1 gives guidance and templates for public documentation of AI datasets and models. It is a 'Zero Draft' meant to feed voluntary consensus standards through ISO. NIST considered input received by 16 September 2026.

NIST AI Risk Management Framework (AI RMF 1.0) and Playbook

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework for managing the risks of AI systems. It organizes the work into four functions: Govern, Map, Measure, and Manage. Its companion Playbook suggests concrete actions for each part. Any organization that builds or uses AI can adopt it, and some laws and contracts point to it.

NIST Artificial Intelligence Technology Evaluation Program

NIST's AI Technology Evaluation (AITE) program, launched in July 2026, is a voluntary testing program. Data providers submit non-public datasets and tasks, model providers submit models, and NIST scores them in a sequestered testbed. It sets no requirements for organizations.

NIST IR 8587: Protecting Tokens and Assertions from Forgery, Theft, and Misuse

NIST IR 8587, finalized on 15 September 2026, gives federal agencies and cloud service providers recommendations to protect identity tokens, access tokens, and assertions from forgery, theft, and misuse. It builds on NIST SP 800-53 Release 5.1.1 and covers single sign-on, federation, and API access.

New York City Local Law 144 of 2021, Automated Employment Decision Tools

NYC employers and employment agencies using covered automated tools for hiring or promotion must arrange annual bias audits. They must publish results and notify candidates before use.

Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2)

US bank regulators' April 2026 model risk guidance replaces SR 11-7 with a tailored, principles-based approach. It is most relevant to banks with over $30 billion in assets. Generative and agentic AI models are outside its scope.

OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles

OMB Memorandum M-26-04, issued on 11 December 2025, implements Executive Order 14319. It requires federal agencies buying large language models to contract for two Unbiased AI Principles: truth-seeking and ideological neutrality. Vendors that fail to meet them can have contracts terminated.

Protecting Consumers From Deceptive AI Act

The Protecting Consumers From Deceptive AI Act (H.R.8479) was introduced on 23 April 2026. Generative AI apps would have to add tamper-resistant disclosures to AI-made audio and visual content, and large platforms would have to show them. NIST task forces would inform technical standards, and the FTC would enforce.

SEC AI Governance Guidance

SEC rules, guidance, and proposals address investment advisers, broker-dealers, and public companies using AI. Topics include predictive-analytics conflicts, securities disclosures, and examination priorities for algorithmic systems.

Sectoral AI Governance Act of 2026

The Sectoral AI Governance Act of 2026 is a proposed US federal law that would authorize federal regulatory agencies to issue rules governing algorithmic decision-making systems within their existing enforcement domains. It applies to any organization deploying AI systems that could materially contribute to violations of federal law in regulated sectors. It places no direct duties on deployers; any would come from later agency rules.

Texas Responsible AI Governance Act

The Texas Responsible AI Governance Act (HB 149), signed on 22 June 2025, took effect on 1 January 2026. It applies to anyone doing business in Texas or developing or deploying AI there. It bans certain intentional AI uses, requires AI disclosure by government agencies and health care providers, and is enforced by the Attorney General.

AI AGENT Act of 2026 (S.5051, Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act)

The AI AGENT Act (S.5051), introduced on 21 July 2026, would let users of large online platforms delegate AI agents to act for them. Platforms would have to provide access interfaces, and agent providers would register with the FTC.

Stop Rogue AI Act (H.R.10362)

Representatives Gottheimer and Lawler introduced the Stop Rogue AI Act (H.R.10362) on 14 September 2026. It directs NIST to set standards for discovering, verifying, and controlling AI agents within a year. Federal contracts would then have to require compliance with them.

Executive Order 14179: Removing Barriers to American Leadership in Artificial Intelligence

Executive Order 14179, signed on 23 January 2025, set a policy of sustaining US AI leadership through reduced regulation. It ordered a review of actions taken under the revoked EO 14110 and called for an AI Action Plan, which the White House released on 23 July 2025.

Executive Order 14365: Ensuring a National Policy Framework for Artificial Intelligence

Executive Order 14365, signed on 11 December 2025, directs federal agencies to challenge state AI laws that conflict with national policy. It set up an AI Litigation Task Force and ordered a Commerce review of state laws. It also tied some broadband funding to state AI policy and asked the FCC and FTC to act on preemption.

United States v. Heppner (S.D.N.Y. 2026): AI Chatbot Documents Not Privileged

In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York ruled in February 2026 that 31 documents a criminal defendant created with Anthropic's Claude were not privileged. Heppner, former CEO of Beneficient and chairman of GWG Holdings, had used consumer Claude on his own, not at his lawyers' direction.

Financial Services AI Risk Management Framework (FS AI RMF)

The US Treasury released the Financial Services AI Risk Management Framework on 19 February 2026, with the Cyber Risk Institute. It adapts the NIST AI RMF into 230 control objectives for financial institutions, organized by AI adoption stage. It is voluntary guidance, released alongside a shared AI lexicon.

Executive Order 14409: Promoting Advanced Artificial Intelligence Innovation and Security

This executive order, signed on 2 June 2026, sets up a classified process for assessing frontier AI models' cyber capabilities. Developers of models designated as covered frontier models can give the government early access for up to 30 days before wider release, and taking part is voluntary.

Utah Artificial Intelligence Policy Act (SB 149, as amended in 2025)

Utah's AI Policy Act took effect on 1 May 2024 and was amended in 2025. Businesses must disclose generative AI use to consumers when asked, and regulated professions must disclose it upfront in high-risk interactions. The Act created the Office of Artificial Intelligence Policy and runs until 1 July 2027.

Washington State SB 5395 and SB 5886 (AI in Health Care and Right of Publicity)

Washington enacted two relevant statutes in 2026. SB 5395 bars health insurance carriers and state employee health plans from using AI as the sole basis to deny prior authorization. SB 5886 extends publicity rights to AI-generated likenesses, affecting organizations producing or deploying representations of individuals.

White House Artificial Intelligence Oversight Framework

The White House finalized a voluntary framework for testing the most advanced AI models' cyber capabilities before release, under the June 2026 executive order. It presented the framework to AI companies on 4 August 2026 and has not published the text.