There is no single federal AI law yet. The White House released a National Policy Framework in March 2026 with legislative recommendations, but Congress hasn’t passed anything binding, and it likely won’t soon. States have moved fastest, enacting dozens of laws on chatbots, deepfakes, and data centers. Your immediate job: inventory where your AI systems operate and comply with the state rules that already apply to you.

TL;DR:

  • Most states have enacted laws requiring AI transparency, bias testing, or disclosure, with California, New York, and Washington leading in regulation.
  • Federal AI legislation remains uncertain, with the White House framework offering guidance but no enforceable law, and narrow bills in Congress tackling specific issues.
  • Enforcement currently relies on existing agencies like the FTC and state attorneys general applying consumer-protection laws, not dedicated AI statutes.
  • Businesses should prioritize inventorying AI systems, documenting data sources, and updating vendor contracts to manage current and upcoming compliance obligations.
  • Definitions of AI vary widely across laws, so companies must carefully review each applicable regulation’s scope and ensure tailored compliance strategies.
tekRESCUE
Plan Safer AI Adoption
tekRESCUE helps businesses map practical AI strategies while understanding cybersecurity risks and vulnerabilities across their organization.
Explore AI guidance

Table of Contents

What Is the Current Status of US AI Regulations?

No comprehensive federal AI statute exists in the United States as of mid-2026. What you have instead is a patchwork: a White House framework offering guidance and legislative suggestions, a handful of congressional bills still working through committee, and a rapidly expanding body of state law that already governs how you can build, deploy, and sell AI products.

The White House National Policy Framework for Artificial Intelligence, published March 20, 2026, is the closest thing to a federal blueprint right now. It is not law. It’s a policy document that recommends how Congress should legislate, and it leans hard toward federal preemption of state AI rules in specific areas, while leaving room for states to keep protecting children and consumers through general laws. Analysis from Georgetown’s Center for Security and Emerging Technology notes this preemption push is likely to trigger constitutional challenges and political resistance from states that have already built out their own regulatory infrastructure.

Congress has several bills in play, but none has reached a floor vote with real momentum. The Frontier Act and the Protecting Consumers From Deceptive AI Act both circulate as serious proposals, alongside various drafts addressing “kill switch” requirements for advanced models and federal preemption standards. Bill text on congress.gov shows lawmakers debating auditing requirements, reporting thresholds, and how much authority states should retain.

Pro Tip: Don’t wait for a bill to become law before you plan for it. Draft language on reporting and audit obligations tends to preview what regulators will eventually expect, even if the specific bill dies in committee.

Here’s what separates the moving parts of federal AI policy right now:

  • Executive actions come from the president directly and can be reversed by the next administration; they carry weight inside federal agencies but don’t bind private businesses the way a statute does.
  • Agency guidance (from the FTC, Commerce Department, or NIST) interprets existing law as it applies to AI; it signals enforcement priorities without creating new legal obligations.
  • Statutes require congressional passage and presidential signature; they’re durable, they create private rights of action in some cases, and they’re what’s currently missing at the federal level.
  • The White House framework is a hybrid: part policy statement, part legislative wish list, with zero direct enforceability of its own.

Political reality matters here. Reporting from WIRED points to a deregulatory posture from the current administration combined with deep congressional division over how much federal preemption should limit state authority. Add the 2026 midterm calendar, which shrinks the legislative working window to a handful of productive months, and the odds of comprehensive federal AI legislation passing this session look thin. That doesn’t mean nothing happens. Narrower bills targeting specific harms (deepfakes in elections, child safety, critical infrastructure) have a better shot than an omnibus AI statute. But if you’re planning compliance strategy around a big federal law arriving in 2026 or 2027, you’re planning around the wrong calendar.

How Are States Regulating AI Right Now?

How Are States Regulating AI Right Now? — overview diagram

States have become the primary source of enforceable AI law in the United States, and the volume is no longer a rounding error. By July 1, 2026, trackers counted 109 AI laws and 28 data-center laws enacted across state legislatures, according to TechPolicy.Press. Separately, multistate.ai recorded 1,561 AI-related bills introduced across the states as of March 2026. That’s not a niche regulatory corner. That’s the main event.

Four categories dominate what’s actually passing:

  1. Companion chatbot disclosure laws. States including California, New York, and Washington now require AI chatbots simulating human companionship to disclose that users are talking to a machine, particularly where minors or vulnerable users are involved.
  2. Deepfake and nonconsensual imagery statutes. Expanded protections cover AI-generated intimate images and election-related deepfakes, often with both civil and criminal exposure attached.
  3. Algorithmic use limits. Several states restrict how AI can be used in hiring decisions, insurance underwriting, and pricing, sometimes requiring bias testing or disclosure when automated systems influence a decision about a person.
  4. Data center and energy oversight. New state rules tie AI infrastructure to permitting, ratepayer protections, and, in some cases, moratoria on new construction, per the same TechPolicy.Press tracking.

A useful way to think about state exposure: it’s not really about where your headquarters sits. It’s about where your product operates, where your users live, and where your servers or your vendors’ servers physically sit. A construction firm in San Antonio using an AI scheduling tool might trigger obligations under a hiring-algorithm law if that tool touches subcontractor selection. A nonprofit in Austin running a donor chatbot might trigger a companion-chatbot disclosure law if the bot’s tone reads as more personal than informational.

Monitoring this volume manually isn’t realistic, which is why two resources matter more than any single bill you could read on your own:

  • NCSL’s Summary Artificial Intelligence 2025 Legislation page tracks enacted state bills by session and gives you a reliable baseline for what’s already law versus what’s still pending.
  • multistate.ai’s State AI Legislation Tracker breaks activity down by state and bill category, useful when you need to know whether Texas, specifically, has moved on a topic that matters to your business.

Analysis from the International Association of Privacy Professionals notes a shift away from sweeping, omnibus AI bills toward narrower, use-case-specific rules: one law for hiring algorithms, another for chatbots, another for insurance. That trend actually makes your compliance job more manageable, once you know where to look, because it means you can inventory by use case rather than trying to comply with a single, vague AI mega-statute.

Prioritize your review in this order:

  • Where you operate. States where you have employees, customers, or physical offices come first, because that’s where enforcement is most likely.
  • Where you host. If your AI workloads run through data centers in states with new energy or permitting rules, that’s a second layer of exposure independent of where your customers are.
  • What triggers apply. A chatbot serving California residents, a hiring tool screening New York applicants, or a data center drawing power in a state with new ratepayer protections each activates a different statute, and you may be subject to more than one simultaneously.

What Federal Bills and Frameworks Should You Actually Watch?

Four documents matter more than the dozens of others floating around Washington, and each one tells you something different about where federal policy is heading.

The White House National Policy Framework, released in March 2026, is the anchor document. It’s not binding, but it signals the administration’s preferred direction: strong federal preemption in specific technical areas (model safety testing, certain reporting standards) paired with explicit carve-outs preserving state authority over child protection, general consumer fraud, and other traditional police powers. If you’re trying to guess which way federal policy tilts over the next two years, this framework is the best available signal, even though it has no enforcement teeth today.

The Frontier Act focuses on advanced AI model developers, proposing safety testing and reporting requirements for the most capable systems. Its language on documentation and pre-deployment review previews what audit expectations might eventually look like even for companies that merely use frontier models rather than build them.

The Protecting Consumers From Deceptive AI Act targets a narrower, more immediately relevant problem for most businesses: AI-generated content or interactions that mislead consumers about what they’re seeing or who they’re talking to. If your business uses AI-generated marketing content, synthetic voices, or automated customer service, this bill’s language on disclosure obligations is worth reading closely, because a state-level equivalent may already apply to you even while the federal version sits in committee.

Other congressional drafts circulating address “kill switch” requirements for high-risk AI systems and federal preemption standards that would limit how far state legislatures can go. None of these has cleared both chambers.

Here’s how these four compare on the issues that actually affect your compliance planning:

  • Preemption: The White House framework and several preemption-focused bills would limit state authority in specific technical domains; state child-safety and general consumer-protection laws would likely survive regardless.
  • Reporting and audits: The Frontier Act carries the most detailed audit language; the Deceptive AI Act focuses more on disclosure than formal reporting.
  • Liability: Draft language varies widely on whether liability sits with model developers, deployers, or both, meaning your vendor contracts matter more than the eventual statute in the short term.

Practically, none of this changes your obligations today. What it does is tell you where documentation habits will pay off. If you already keep records of model versions, training data sources, and disclosure practices, you’re building toward whatever reporting regime eventually lands, federal or state. If you’re not keeping those records, the S.3062 draft language on congress.gov is a reasonable preview of what “good documentation” will be expected to look like.

Which Agencies Enforce AI Rules Today?

Enforcement right now runs through existing agency authority applied to AI, not through any AI-specific statute, and that distinction matters for how you assess risk.

The Federal Trade Commission is the most active federal player. It uses its existing consumer-protection authority to pursue deceptive AI claims, unsubstantiated performance promises, and algorithmic practices that harm consumers, without needing a new AI law to act. If your marketing overstates what your AI product can do, or your algorithm produces discriminatory outcomes in pricing or lending, the FTC doesn’t need Congress to pass anything new to come after you.

The Department of Justice, Commerce Department, and the National Institute of Standards and Technology / Office of Science and Technology Policy play supporting roles. DOJ handles criminal exposure tied to AI-enabled fraud. Commerce and NIST shape voluntary technical standards, and while those standards aren’t mandatory, they increasingly function as the baseline regulators point to when judging whether a company acted reasonably.

State attorneys general are arguably a bigger near-term threat than any federal agency. They bring consumer-protection lawsuits under state law, often targeting the same deceptive-AI-claims territory the FTC covers, but with 50 different jurisdictions’ worth of statutes to work from. A state AG doesn’t need a federal AI law either. They need an existing consumer-protection statute and evidence that your AI product misled or harmed someone in their state.

Red flags that tend to attract scrutiny from either level:

  • Marketing claims about AI accuracy or capability that don’t hold up under testing.
  • Automated decisions affecting hiring, credit, insurance, or housing without documented bias testing.
  • Chatbots or synthetic content that could mislead a reasonable user about whether they’re interacting with a human.
  • AI-enabled fraud or impersonation schemes, a growing concern flagged in industry analysis on AI-driven cybercrime.
  • Data center or infrastructure decisions that skip required state permitting or energy-use disclosures.

What Should Your Business Do Right Now?

You don’t need to wait for federal clarity to reduce your legal exposure. The compliance work that matters most right now happens at the state level, and it follows a logical order.

  1. Inventory every AI system you use or deploy, including tools built by vendors, and map exactly which states your operations, customers, and hosting touch.
  2. Document your models and data sources. Model cards, training data provenance, and version histories aren’t legally required everywhere yet, but they’re the foundation for every disclosure and audit regime being proposed federally and at the state level.
  3. Build disclosure practices where triggers exist. If you run a customer-facing chatbot, a hiring algorithm, or anything touching insurance or credit decisions, check whether your operating states already require notice to affected users.
  4. Tighten vendor and procurement contracts. Push for audit rights, representations about training data and bias testing, and clear liability allocation if a vendor’s AI model creates legal exposure for your business.
  5. Set operational controls. Incident response plans, human-in-the-loop review for high-stakes decisions, and monitoring for model drift all reduce the chance that a small AI failure becomes a public enforcement problem.
  6. Account for infrastructure exposure. If your AI workloads run through data centers in states with new energy or permitting rules, coordinate legal and facilities planning now rather than after a moratorium hits.
  7. Put AI governance on the board’s agenda. Regular legal review and a standing schedule to reassess your compliance posture as state laws change keep you from discovering a new obligation the hard way.

Pro Tip: Treat your AI vendor contracts the way you’d treat a data breach clause. If the vendor’s model produces a biased hiring outcome or a misleading chatbot interaction, you want contractual language today that says who’s on the hook, not a scramble to figure it out after a state AG calls.

Financial services firms face an additional layer here. If your AI touches transaction data, credit decisions, or account security, the expectations laid out in guides comparing US financial data security standards are a useful cross-check against your existing controls, since AI-specific rules tend to layer on top of, not replace, sector-specific security obligations you already carry.

None of this needs to happen all at once. But inventory first, documentation second, and vendor contracts third is the order that actually reduces risk fastest, because each step depends on the one before it.

What Counts as “AI” Under These Laws?

Definitions vary more than you’d expect, and that variation creates real compliance risk if you assume every law means the same thing by “artificial intelligence.”

Some state statutes define AI narrowly, targeting specific technical functions like automated decision-making systems that determine eligibility for a benefit, a job, or a rate. Others use sweeping language covering any system that “simulates human cognitive functions,” which can technically capture basic rule-based automation that most people wouldn’t call AI at all.

Federal proposals tend toward broader definitions when addressing frontier model safety (focusing on computational scale and capability thresholds) and narrower ones when addressing consumer protection (focusing on the specific interaction, like a chatbot or synthetic voice). The Protecting Consumers From Deceptive AI Act, for instance, cares less about how sophisticated your model is and more about whether it deceived someone.

The practical takeaway: don’t assume your tool is “too simple” to count. A basic algorithmic hiring filter or a rules-based chatbot can fall inside a state’s definition even if it wouldn’t impress anyone at a machine learning conference. Read each applicable statute’s definition section directly rather than assuming a single industry understanding of “AI” governs everywhere.

How Did US AI Regulation Get Here?

Federal AI policy spent years as a series of voluntary frameworks and agency guidance documents rather than binding law, largely because Congress struggled to agree on scope even as AI capabilities accelerated. Early efforts centered on risk-management frameworks from NIST and executive-branch initiatives focused on federal agency use of AI, not private-sector obligations.

States didn’t wait. Beginning around 2023 and accelerating sharply through 2025 and 2026, state legislatures started filling the vacuum with targeted bills, first addressing narrow harms like deepfake pornography and election disinformation, then expanding into chatbot disclosure, hiring algorithms, and data center oversight as AI adoption widened. The shift from omnibus attempts to narrow, use-case-specific state bills, as IAPP’s trend analysis describes, reflects lessons learned from early comprehensive privacy laws, where broad statutes proved difficult to pass and even harder to enforce cleanly.

The March 2026 White House framework marks the first serious federal attempt to reassert a national approach, primarily through preemption rather than new substantive rules. Whether that effort gains traction depends heavily on the midterm political calendar and on how state legislatures respond to federal pressure to cede ground they’ve already claimed.

How Does the US Approach Compare to the EU and Other Countries?

The contrast with the European Union’s AI Act is stark, and it shapes how multinational businesses have to think about compliance. The EU built a single, comprehensive, risk-tiered statute that classifies AI systems by risk level and imposes graduated obligations, from minimal requirements for low-risk tools to strict rules for high-risk applications like biometric identification.

The United States has taken the opposite structural path: no comprehensive federal statute, a patchwork of state laws targeting specific harms, and federal agencies applying existing authority rather than AI-specific rules. Where the EU asks “what risk tier does this system fall into,” the current American approach asks “did this specific use case, in this specific state, cross a line that existing consumer-protection or civil-rights law already prohibits.”

That difference has real consequences for compliance strategy. A business operating in both markets effectively runs two entirely different playbooks: a single, predictable regulatory ceiling in the EU, versus a shifting floor across dozens of American jurisdictions that changes with each legislative session. Some other countries, including Canada and the UK, have leaned toward principles-based frameworks that sit somewhere between the EU’s prescriptive model and the American patchwork. For now, U.S. businesses operating internationally need separate compliance tracks rather than a single unified approach, because the underlying legal architecture simply isn’t comparable.

Comparison of US EU and other AI regulation models

How Do Privacy Laws Like HIPAA and CCPA Apply to AI?

AI doesn’t get its own privacy carve-out. It has to comply with the privacy laws that already exist, and those laws weren’t written with machine learning training data in mind, which creates real ambiguity.

HIPAA governs AI tools used in healthcare settings that touch protected health information, meaning an AI diagnostic tool, scheduling system, or patient chatbot handling medical data has to meet the same privacy and security requirements as any other system processing that information. The complication: HIPAA’s framework predates modern machine learning, so questions about whether training a model on de-identified patient data creates new obligations remain genuinely unsettled in places.

CCPA and similar state privacy statutes (Virginia, Colorado, and others have their own versions) give California consumers rights over how their personal data is collected, used, and, increasingly, how it feeds into automated decision-making. Several of these laws now explicitly address algorithmic profiling, requiring disclosure when automated systems make significant decisions about a person, like credit or employment.

For your business, the practical overlap is this: if your AI system uses personal data (health records, financial information, biometric data, or general consumer data), you’re not just checking AI-specific statutes. You’re checking every applicable privacy law layered on top, and the strictest applicable standard usually wins.

What Ethical Principles Are Regulators Pushing?

Fairness, transparency, and accountability show up in nearly every AI policy document coming out of Washington and state capitols, even when the enforcement mechanism behind those words is inconsistent.

Fairness shows up most concretely in algorithmic hiring and credit laws, which increasingly require bias testing before an automated system can influence a decision about a person. Transparency drives the disclosure requirements behind companion chatbot laws and deepfake statutes, the basic principle that people deserve to know when they’re interacting with, or being shown content generated by, a machine. Accountability shows up in the audit and reporting language found in bills like the Frontier Act, which pushes responsibility for model safety back onto the organizations building and deploying advanced systems.

None of these principles carries uniform legal weight across jurisdictions. A fairness requirement might be a hard mandate in one state’s hiring law and a voluntary best practice recommended by NIST elsewhere. That inconsistency is arguably the defining feature of the current regulatory moment: broad agreement on principles, minimal agreement on enforcement mechanics.

Does Regulation Slow Down AI Innovation in the US?

The honest answer is that it depends heavily on which layer of regulation you’re looking at, and conflating them leads to bad strategic decisions.

Federal inaction, by most measures, has kept the American AI industry moving faster than more heavily regulated markets. Model developers face fewer upfront compliance hurdles than counterparts operating under the EU’s risk-tiered statute, and that speed advantage is a big part of why federal preemption proposals frame state fragmentation as an innovation threat rather than a consumer protection win.

But the state patchwork itself creates a different kind of drag: compliance costs multiply when a business has to track and satisfy 50 different jurisdictions’ worth of overlapping rules rather than one clear federal standard. That’s the argument underlying the White House framework’s preemption push, and it’s not baseless. A small business rolling out an AI hiring tool nationally faces a genuinely harder compliance lift than one operating in a single, clearly regulated market.

The net effect, at least for now, favors large, well-resourced companies that can absorb the compliance overhead of tracking dozens of state laws, while smaller businesses face proportionally higher costs relative to their size. Whether that dynamic changes depends on whether Congress eventually delivers the preemption and clarity the framework recommends, or whether states keep filling the gap faster than Washington can act.

Operationalizing Compliance in a Fragmented System

Most articles on this topic stop at “know the law.” That’s not enough. The gap that actually hurts businesses isn’t ignorance of the White House framework or the Frontier Act. It’s the translation problem: turning a legal obligation like “disclose when a chatbot isn’t human” into an actual logging system, a documented review process, and a person accountable for checking it stays current.

tekRESCUE AI approaches this the way you’d want a partner grounded in real cybersecurity practice to approach it: security and compliance aren’t a separate conversation from AI strategy, they’re built into the same roadmap from day one. An AI Profit and Growth Assessment doesn’t just identify where AI could save your business money. It maps where your specific AI use cases intersect with regulatory exposure, whether that’s a chatbot triggering disclosure obligations, a hiring tool touching algorithmic-use limits, or a data hosting decision running into state energy rules, and turns that exposure into a prioritized list of technical and contractual changes.

In practice, that means concrete controls, not abstract policy language. Model documentation that actually gets maintained instead of written once and forgotten. Incident response playbooks specific to AI failures, not a generic IT breach plan retrofitted for machine learning. Vendor audit language that gives you real recourse if a third-party model produces a biased or misleading outcome that lands on your business, not theirs.

If you’re staring at a state law tracker wondering how any of this applies to your operation specifically, that’s a conversation worth having before you build anything else on top of an ungoverned AI deployment.

— Randy Bryan

Get Regulatory Clarity Before You Scale Your AI Deployment

Reading trackers and bill summaries tells you what’s changing. It doesn’t tell you what your specific business needs to fix. That’s the gap tekRESCUE AI closes: instead of a generic legal memo, you get an assessment grounded in real IT and cybersecurity practice, built to show exactly where your AI use touches state disclosure rules, hiring-algorithm limits, or data hosting exposure, and what to do about each one.

tekRESCUE

The AI Profit and Growth Assessment starts by mapping every AI system you’re running or considering against the states you actually operate in, then produces a prioritized roadmap covering documentation gaps, vendor contract weak points, and disclosure obligations you might be missing. Businesses in various industries use this to move from “we think we’re fine” to a documented, defensible compliance posture. If you’d rather build ongoing security into your AI deployment from the start, Managed AI Security extends that same risk-aware approach into continuous monitoring. Book the assessment to find out exactly where your exposure sits and what to fix first.

Sources

Keep these close if you’re monitoring US AI regulations beyond this article:

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Which US States Have AI Regulations?

Most states have enacted at least one AI-related law, with California, New York, Washington, Colorado, and Texas among the most active on chatbot disclosure, deepfakes, and algorithmic hiring rules. Trackers from NCSL and multistate.ai show 109 AI laws and 28 data center laws enacted nationwide by July 1, 2026.

Is AI Going to Be Regulated at the Federal Level in the US?

Comprehensive federal AI legislation is unlikely in the near term due to congressional division and the 2026 midterm calendar, according to reporting from WIRED. Narrower bills targeting specific harms, like deceptive AI content or frontier model safety, have a better chance of passing than an omnibus federal AI statute.

How Is AI Currently Being Regulated in the US?

AI is regulated through a patchwork of state laws covering chatbot disclosures, deepfakes, hiring algorithms, and data centers, combined with federal agencies like the FTC applying existing consumer-protection authority to AI-related harms. There is no single AI-specific federal statute; the White House National Policy Framework offers guidance and legislative recommendations rather than binding rules.

Does the US Have an Official National AI Policy?

The US has a policy framework, not a binding national AI law. The White House released its National Policy Framework for Artificial Intelligence in March 2026, recommending legislative priorities like federal preemption, but Congress has not enacted it into law.

How Can My Business Figure Out Which AI Rules Apply to Us?

Start by inventorying every AI system you use and mapping which states your operations, customers, and hosting touch, then cross-check that list against trackers like NCSL and multistate.ai. tekRESCUE AI’s AI Profit and Growth Assessment does this mapping directly, connecting your specific AI use cases to the state and federal obligations that actually apply to your business.