What AI regulations apply to a US-based SaaS company?

At the federal level, there is no comprehensive US AI regulation equivalent to the EU AI Act. Instead, existing laws apply to AI through agency guidance and enforcement. The FTC has issued guidance on AI in advertising, consumer products, and fraud, and has brought enforcement actions against AI-related deceptive practices. The EEOC has published guidance on AI in employment decisions under Title VII and the ADA. The CFPB applies FCRA and ECOA requirements to AI used in credit decisions.

For SaaS companies, the most immediately relevant federal rules are the FCRA (if your AI influences credit, employment, housing, or insurance decisions), Title VII and ADA guidance (if your AI is used in hiring or HR contexts), and FTC consumer protection requirements (if your AI makes consumer-facing claims). The SEC has signaled that AI-related disclosures in public filings are subject to existing materiality requirements.

Colorado's AI Act (SB 205) is the most comprehensive US state AI law currently in effect. It applies to developers and deployers of high-risk AI systems that affect Colorado consumers, requiring impact assessments, transparency notices, and discrimination protections. If your product makes consequential decisions about Colorado residents in employment, education, credit, housing, healthcare, or legal services, Colorado SB 205 likely applies.

Illinois' Biometric Information Privacy Act (BIPA) applies to AI that processes biometric data, including facial recognition. Violations have resulted in significant class action settlements. NYC Local Law 144 requires bias audits by independent auditors for automated employment decision tools used in hiring decisions affecting New York City residents. California has multiple AI-related bills progressing through the legislature. Building to the most stringent applicable standard (typically Colorado plus NYC for US-focused SaaS) positions you well against most incoming state requirements.

If you have European customers, the EU AI Act applies to you regardless of where your company is based. The key question is whether your AI features would be classified as high-risk under Annex III. Features used in employment decisions (resume screening, performance evaluation), credit or insurance decisions, or education are likely high-risk. Features used in customer service, marketing, or productivity tools are typically limited or minimal risk, with only transparency obligations.

GDPR Article 22 restricts solely automated decision-making that produces legal or similarly significant effects on EU data subjects. If your SaaS product makes or significantly influences decisions about EU users, you need a compliant legal basis, a process for human review on request, and the ability to explain the decision. Many SaaS companies have this obligation but have not implemented the required processes.

The California AI Transparency Act (SB 942, as amended by AB 853) takes effect August 2, 2026, and applies to providers and distributors of covered generative AI systems serving California consumers. If your SaaS product includes generative AI features, you are likely a covered provider. The law requires you to offer a free, publicly accessible detection tool that can identify content your system generated, and to embed latent disclosures in all covered AI-generated content so that provenance information survives distribution.

License agreements for your generative AI system must include terms that prohibit licensees from removing or disabling those disclosure capabilities. If you discover a licensee has stripped or circumvented the required disclosures, you must revoke their access within 96 hours. These contractual and enforcement obligations require changes to standard SaaS terms of service and an internal process for monitoring and acting on disclosure violations.