What AI regulations apply to a US-based SaaS company?

At the federal level, there is no comprehensive US AI regulation equivalent to the EU AI Act. Instead, existing laws apply to AI through agency guidance and enforcement. The FTC has issued guidance on AI in advertising, consumer products, and fraud, and has brought enforcement actions against AI-related deceptive practices. The Equal Employment Opportunity Commission (EEOC) has published guidance on AI in employment decisions under Title VII and the Americans with Disabilities Act (ADA). The Consumer Financial Protection Bureau (CFPB) applies the FCRA and the Equal Credit Opportunity Act (ECOA) to AI used in credit decisions.

For SaaS companies, the most immediately relevant federal rules are the FCRA (if your AI influences credit, employment, housing, or insurance decisions), Title VII and ADA guidance (if your AI is used in hiring or HR contexts), and FTC consumer protection requirements (if your AI makes consumer-facing claims). The SEC has signaled that AI-related disclosures in public filings are subject to existing materiality requirements.

Colorado's 2024 AI Act (SB 24-205) never took effect. In May 2026 the state repealed it and passed SB 26-189, a narrower law that applies from 1 January 2027. It covers automated decision-making technology used in consequential decisions about consumers, such as employment, education, credit, housing, healthcare, or legal services. Deployers must give notice before use, explain adverse outcomes, and offer human review.

Illinois' Biometric Information Privacy Act (BIPA) applies to AI that processes biometric data, including facial recognition. Violations have resulted in significant class action settlements. NYC Local Law 144 requires independent bias audits for automated employment decision tools used in hiring or promotion for jobs located in New York City. California has multiple AI-related bills progressing through the legislature. Building to the most stringent applicable standard (typically NYC Local Law 144 now, plus Colorado SB 26-189 from 2027, for US-focused SaaS) positions you well against most incoming state requirements.

If you have European customers, the EU AI Act applies to you regardless of where your company is based. The key question is whether your AI features would be classified as high-risk under Annex III. Features used in employment decisions (resume screening, performance evaluation), credit or insurance decisions, or education are likely high-risk. Features used in customer service, marketing, or productivity tools are typically limited or minimal risk, with only transparency obligations.

GDPR Article 22 restricts solely automated decision-making that produces legal or similarly significant effects on EU data subjects. If your SaaS product makes or significantly influences decisions about EU users, you need a compliant legal basis, a process for human review on request, and the ability to explain the decision. Many SaaS companies have this obligation but have not implemented the required processes.

The California AI Transparency Act (SB 942, as amended by AB 853) takes effect August 2, 2026, and applies to providers and distributors of covered generative AI systems serving California consumers. If your SaaS product includes generative AI features, you are likely a covered provider. The law requires you to offer a free, publicly accessible detection tool that can identify content your system generated, and to embed hidden labels (latent disclosures) in all covered AI-generated content so its AI origin can still be traced after it is shared.

License agreements for your generative AI system must include terms that prohibit licensees from removing or disabling those disclosure capabilities. If you discover a licensee has stripped or circumvented the required disclosures, you must revoke their access within 96 hours. These contractual and enforcement obligations require changes to standard SaaS terms of service and an internal process for monitoring and acting on disclosure violations.