Pending AI Regulations: Bills and Proposals in Progress
Draft bills, proposed rules, and legislation still moving through the process, so compliance teams can prepare before obligations land.
Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →California Senate Bill 420: Automated Decision Systems (State AI Transparency Act)
California SB 420 would require impact assessments before high-risk automated decision systems enter public use. Introduced under the State AI Transparency Act, it covers organizations operating those systems in California. The proposal adds transparency and reporting duties. The Attorney General or Civil Rights Department could enforce it through civil actions.
California SB 53 Foundation Model Safety and Security Protocol
California SB 53 would require safety and security protocols for foundation models presenting critical risk. Covered developers would need to create, follow, and publicly disclose those protocols. The bill also requires catastrophic risk testing and ongoing monitoring for critical safety incidents.
China Draft AI Law
China is developing a proposed national AI law. It would establish legal duties for AI development, deployment, and governance across sectors.
Colorado Senate Bill 189: Automated Decision-Making Technology Act
Colorado SB 189 repeals SB 205 and replaces it with the Automated Decision-Making Technology Act, effective January 1, 2027. It covers a broader category of technology used for consequential decisions affecting Colorado consumers. The replacement removes mandatory risk management programs, annual impact assessments, and the reasonable-care standard for algorithmic discrimination.
Commerce Department Evaluation of State AI Laws
The December 11, 2025 executive order gives Commerce 90 days to evaluate state AI laws conflicting with federal policy. The review targets compelled changes to truthful outputs and disclosures that may implicate First Amendment protections. Identified laws may be referred to the AI Litigation Task Force for possible federal preemption action.
Proposed CPPA Regulations on Cybersecurity, Risk Assessments, and Automated Decision-Making Technologies
The California Privacy Protection Agency Board finalized proposed rules in May 2025. They cover cybersecurity audits, privacy risk assessments, and automated decision-making. Covered businesses would include those conducting consequential automated decisions or personal-data processing posing significant consumer risks. If adopted, the rules would add consumer opt-outs and mandatory assessments.
EU Proposal for a Regulation for the Digital Networks Act (DNA)
The European Commission proposed the Digital Networks Act on January 21, 2026. Parliament and Council are reviewing it. It addresses digital infrastructure and aspects of AI governance. Expected duties concern network operators and deployers, including those using AI for network management.
Federal Communications Commission AI Model Reporting and Disclosure Proceeding
The FCC is opening a proceeding on possible federal AI model reporting and disclosure standards. It follows Commerce’s evaluation of state AI laws. An adopted standard could preempt conflicting state disclosure and reporting requirements.
Guaranteeing and Upholding Americans' Right to Decide Responsible AI Laws and Standards Act (GUARDRAILS Act)
The bipartisan GUARDRAILS Act was introduced on March 20, 2026. It would repeal Executive Order 14365 and prevent federal agencies from preempting state AI laws. If enacted, it would preserve states’ authority to establish and enforce their own requirements.
H.R.8094 - AI Foundation Model Transparency Act of 2026
Bipartisan lawmakers introduced H.R.8094 on March 26, 2026. It would require large foundation model developers to disclose training data, model design, limitations, risks, and evaluation methods. The bill seeks public scrutiny through transparency without directly restricting model use or deployment.
Illinois High-Impact AI Governance Principles and Disclosure Act
Illinois HB 3529 would establish the High-Impact AI Governance Principles and Disclosure Act. It targets private businesses using consequential AI in areas such as employment, credit, and housing. Proposed duties include impact assessments, governance records, and public disclosures, backed by civil penalties.
Indonesia Presidential Regulation on the National AI Roadmap and AI Ethics
In August 2026, Indonesia outlined a planned Presidential Regulation establishing a National AI Roadmap and binding ethics framework. If finalized, it would cover enterprises operating AI in Indonesia. Expected requirements include ethics reviews, internal controls, and documented risk assessments.
New York's Responsible AI Safety and Education Act (RAISE Act) for Large Developers
The pending New York RAISE Act would regulate large frontier model developers above specified computing thresholds. It covers developers operating in or directing services to New York. Proposed requirements include written safety protocols, independent third-party audits, and safeguards against critical harms.
Protecting Consumers From Deceptive AI Act
The Protecting Consumers From Deceptive AI Act was introduced federally on April 23, 2026. It would direct NIST to develop watermarking, fingerprinting, and provenance standards for AI-generated audio and visual content. NIST would also support AI-modified content labels and frameworks for identifying generated text. The bill targets platforms, developers, and synthetic-media distributors.
Sectoral AI Governance Act of 2026
The Sectoral AI Governance Act of 2026 is a proposed US federal law that would authorize federal regulatory agencies to issue rules governing algorithmic decision-making systems within their existing enforcement domains. It applies to any organization deploying AI systems that could materially contribute to violations of federal law in regulated sectors. If enacted, it would require regulated deployers to align AI governance controls with sector-specific agency rulemaking.
UK AI Regulation Framework
The UK AI Regulation Framework assigns primary oversight to existing sector regulators using shared principles. Following January 2025’s AI Opportunities Action Plan, the approach is moving toward a more structured legislative basis.
UK DSIT Call for Evidence on Data Regulation in the Age of AI and Other Data-Intensive Technologies
DSIT opened a call for evidence on adapting UK data law to AI and other data-intensive technologies. It addresses organizations collecting, processing, or sharing AI-related data, including agent deployments. Respondents are asked about transparency, provenance, and data-access control gaps.
Regulations Requiring the ICO to Produce a Statutory AI and Automated Decision-Making Code of Practice
UK statutory regulations direct the ICO to produce a code for AI and automated decisions involving personal data. It will cover organizations under UK data protection law using these systems to make or inform decisions about individuals. Once finalized, departures from the code may provide evidence of non-compliance in regulatory proceedings.
U.S. Autonomous and Intelligent Government Entities for National Trust Act (AI AGENT Act, Discussion Draft)
The Senate’s AI AGENT Act discussion draft would require FTC registration of custodial agents before access to large online platforms. It targets organizations operating agents for consumers or other principals. Proposed duties cover registration, disclosure, access controls, revocation conditions, and platform management of agent interactions.
Bipartisan Bill to Stop Rogue AI Agents and Keep People in Control
This bipartisan federal bill directs the National Institute of Standards and Technology to develop national standards, guidelines, and best practices for governing autonomous AI agents. It applies to organizations that deploy or develop AI agent systems capable of acting with limited human intervention. Core requirements center on agent discovery, verification testing, and maintaining meaningful human control over autonomous system behavior.