US AI Regulation: How the Rules Are Taking Shape

People often say the United States does not regulate AI. That is not quite right. There is no single, comprehensive federal AI law like the European Union’s AI Act, but AI systems are already covered by existing laws, shaped by federal policy, and increasingly regulated by individual states.

Key takeaways

There is no single comprehensive federal AI law, but existing rules on consumer protection, discrimination, copyright and privacy already apply to AI.
Much federal AI policy comes from executive orders rather than Congress, so it can change with each administration.
States such as Colorado, California, Texas, New York and Utah are passing their own AI laws, creating a patchwork of requirements.
Businesses should inventory AI use, test for bias and accuracy, market honestly and follow the state laws where customers and employees are.

This overview explains how the pieces fit together. Rules in this area change quickly, so treat it as a map rather than legal advice, and check the current status of any law that affects you.

Existing laws already apply

Using AI doesn’t exempt anyone from the law, and federal agencies have repeatedly said their existing powers cover it. The Federal Trade Commission can act against deceptive claims about AI products and unfair practices; in September 2024 it announced a set of enforcement actions, called Operation AI Comply, against companies making false AI-related claims.

Civil rights laws on employment, lending and housing apply when algorithms make or assist decisions, and employers remain responsible if a hiring tool screens out protected groups. Medical devices that use AI go through the Food and Drug Administration, and financial regulators apply existing rules on credit decisions and model risk. Meanwhile, courts are working out how copyright applies to AI training and outputs, and state privacy laws cover the personal data AI systems use.

The three layers of AI regulation in the United States: existing laws, federal policy and state laws, with examples of each — No single federal AI law, but plenty of rules that already apply.

Federal policy: executive orders and the AI Action Plan

Much of the federal approach has been set by the White House rather than Congress, which means it can change with each administration.

White columns of the United States Capitol with its dome against a clear blue sky — Broader federal AI legislation has been debated in Congress but not enacted, so much of the federal approach comes from executive orders. Photo: Rawpixel (CC0)

In October 2023, President Biden signed an executive order on safe and trustworthy AI that required developers of the most powerful models to share safety test results with the government, among many other measures.
In January 2025, President Trump revoked that order and signed a new one focused on removing barriers to AI development.
In July 2025, the administration published America’s AI Action Plan, emphasizing innovation, infrastructure such as data centers and energy, and international competition.
In December 2025, the White House issued an executive order aimed at establishing a national framework and challenging state AI laws it considers burdensome.

Congress has passed narrower laws, such as the TAKE IT DOWN Act in 2025, which targets the publication of non-consensual intimate images, including AI-generated deepfakes. Broader federal AI legislation, including proposals to override state laws, has been debated but not enacted at the time of writing.

The states are moving faster

In the absence of a federal law, states have introduced hundreds of AI bills. A few stand out:

Colorado passed the first broad state law on “high-risk” AI systems in 2024. It requires developers and deployers of systems that make consequential decisions, such as in hiring, lending, housing or healthcare, to take reasonable care against algorithmic discrimination. Its start date was pushed back to mid-2026, and further changes have been proposed.
California has passed several AI laws, including SB 53 in September 2025, which requires developers of the largest “frontier” models to publish safety frameworks and report serious incidents.
Texas enacted the Texas Responsible AI Governance Act in 2025, focused mainly on government use of AI and on prohibiting certain harmful uses.
New York City has required bias audits for automated hiring tools since 2023, and Illinois amended its human rights law to cover discriminatory AI in employment.
Utah requires businesses to disclose when consumers are interacting with generative AI in certain situations.

The result is a patchwork. A company selling an AI hiring tool nationally may face different requirements in different states, which is one reason the debate over federal preemption is so heated.

What this means for businesses

There’s no single federal law, but organizations using AI still have work to do. Start by finding where AI is used, especially in decisions about people such as hiring, lending, pricing and eligibility. Test those uses for bias and accuracy, and keep records of the results.

Be accurate in marketing. Don’t claim a product uses AI, or that AI makes it better, unless you can back it up. Tell people when they’re dealing with AI where the law requires it, and consider doing it anyway. Follow the state laws where your customers and employees are, not just where you’re based. A recognized framework, such as NIST’s AI Risk Management Framework, helps organize all of this.

Checklist for US businesses using AI: inventory AI decisions about people, test for bias, keep marketing accurate, disclose AI use, follow state laws, use a framework such as NIST — Steps that make sense under almost any version of the rules.

Most people will never read an AI law. Still, these rules decide whether you’re told when a machine is judging your job application, whether you can challenge an automated decision, and who is responsible when AI causes harm.

What to watch

Whether Congress passes a federal framework, and whether it overrides state laws
How courts rule on challenges to state AI laws
Outcomes of copyright lawsuits over AI training data
How the EU AI Act affects US companies selling in Europe

Frequently asked questions

Is there a federal AI law in the United States?

Not a comprehensive one like the EU AI Act. AI is governed by existing laws, executive orders and a growing number of state laws, and broader federal legislation has been debated but not enacted at the time of writing.

Do existing laws apply to AI?

Yes. Federal agencies say consumer protection, civil rights, sector rules, copyright and privacy laws all apply when AI is used, and employers remain responsible if a hiring tool discriminates.

Which states have AI laws?

Notable examples include Colorado's law on high-risk AI systems, California's SB 53 for frontier model developers, the Texas Responsible AI Governance Act, New York City's hiring audit rule, Illinois's employment rules and Utah's disclosure requirements.

Why do state AI laws matter to businesses elsewhere?

Companies must follow the laws where their customers and employees are, not just where they are based, so a national product can face different requirements in different states.

Sources

FTC Announces Crackdown on Deceptive AI Claims and Schemes, Federal Trade Commission, September 2024
SB24-205 Consumer Protections for Artificial Intelligence, Colorado General Assembly
SB 53 Artificial intelligence models: large developers, California Legislative Information
Automated Employment Decision Tools, NYC Department of Consumer and Worker Protection
AI Risk Management Framework, NIST