United States AI Regulation
// Patchwork - Federal Posture Meets State Statutes
The United States regulates AI through overlapping layers: executive orders setting federal tone, agency enforcement under decades-old statutes, and a fast-moving wave of state statutes. There is no single US version of the AI Act - there is a patchwork, and it changes weekly.
Key Highlights
Who is regulating what, and which dates already bite.
- 01
There is no comprehensive federal AI statute. Federal posture is set by executive orders and enforcement of existing consumer-protection authority (FTC Act Section 5), not by a single act.
- 02
Executive Order 14179 (January 2025) revoked the prior safety-focused order and directed agencies to remove barriers to AI adoption. A December 2025 order went further, directing a DOJ task force to challenge state AI laws - a preemption push whose constitutionality is contested and heading for the courts.
- 03
A June 2026 order added a voluntary 30-day pre-release review for frontier models - signaling that even a deregulatory administration wants visibility into advanced systems.
- 04
Colorado SB 189 (signed May 2026, effective January 1, 2027) replaced the original SB 24-205 with a transparency framework covering automated consequential decisions in employment, housing, healthcare, and finance.
- 05
Texas TRAIGA took effect January 1, 2026 with risk-based duties and a regulatory sandbox. California followed with SB 53 frontier-model transparency and AB 2013 training-data disclosure (both January 2026), plus CCPA automated decision-making rules landing January 2027.
- 06
The NIST AI Risk Management Framework 1.0 and its Generative AI Profile are the de facto national playbook - referenced in procurement, litigation defense, and state-law compliance mappings.
- 07
Common threads across state laws: documented impact assessments for consequential decisions, advance notice to consumers, bias audits, and human appeal or review rights.
- 08
By March 2026, lawmakers in all 45+ states had introduced over 1,500 AI bills. The only stable assumption is continued divergence.
Action Items for Governance and Compliance
How to build one program that survives fifty legislatures.
Adopt an NIST AI RMF-aligned program
A01Charter a cross-functional AI governance council and get leadership sign-off on a written risk-appetite statement.
Maintain Govern, Map, Measure, Manage artifacts as reusable audit evidence that maps onto Colorado SB 189, TRAIGA, and FTC inquiries alike.
Map consequential-decision surfaces by jurisdiction
A02Make product owners accountable for declaring decision impact at feature intake, not after launch.
Flag every feature against Colorado, Texas, California, Illinois, and Utah triggers so obligations attach to the right release trains.
Run recurring impact assessments and bias testing
A03Define assessment cadence, reviewer sign-off authority, and tracked remediation of findings.
Archive results as evidence of reasonable care against algorithmic-discrimination claims and AG inquiries.
Ship notices, opt-outs, and appeal channels
A04Assign disclosure and escalation ownership across product, UX, and support teams.
Deliver pre-decision notices, human-review channels, and adverse-decision explanations as first-class product features, not support macros.
Capture training-data provenance
A05Publish an internal data-sourcing policy covering licensed, public, and synthetic sources with named approvers.
Produce exportable dataset summaries on demand to satisfy AB 2013-style disclosure requests without fire drills.
Maintain a regulatory watch process
A06Pair counsel with engineering in a quarterly federal-versus-state conflict review.
Use configuration-driven jurisdictional toggles so obligations can be tuned per market without re-architecture.
Engineering Translation
High-level capabilities that keep multi-state obligations maintainable.
>_Decision-system registry tagging which jurisdictions every feature touches.
>_Impact-assessment scaffolding auto-generated per release with reviewer sign-offs captured automatically.
>_Bias evaluation suites executed inside delivery pipelines with immutable result archives.
>_Disclosure banners, consent capture, and human-review escalation built as product endpoints.
>_Data-lineage capture from ingestion onward so provenance summaries are exportable on demand.
>_Configuration-driven jurisdiction switches instead of code forks.
Delivered as capabilities, not paperwork
Each obligation above is translated into product-level engineering capabilities. The underlying stack and internal tooling are intentionally abstracted here; they are covered in technical briefings.
Educational summary only. This is not legal advice. Confirm obligations with qualified counsel for your jurisdiction.
Build Once, Comply Everywhere
Book a technical briefing to align your AI delivery pipeline with NIST AI RMF and the state laws that actually reach your users.