Frameworks · United States
AI governance frameworks and laws in the United States
The United States has no comprehensive federal AI law. Organizations govern AI under a growing set of state and city laws aimed at specific uses, federal anti-discrimination and consumer protection law, sector guidance for banks and insurers, and the voluntary NIST AI RMF that most of them build on.
Who regulates AI here
- Federal Trade CommissionEnforces the federal ban on unfair and deceptive practices, which reaches claims about AI products and harmful uses of AI with consumers.
- Equal Employment Opportunity CommissionEnforces federal anti-discrimination law in employment, which applies to hiring and workplace decisions made with AI tools.
- National Institute of Standards and TechnologyPublishes the AI Risk Management Framework and its Generative AI Profile, the voluntary federal reference for AI risk.
- California Privacy Protection AgencyEnforces the CCPA and its regulations on automated decisionmaking technology, risk assessments and cybersecurity audits.
- Colorado Attorney GeneralEnforces SB 26-189 on automated decision-making technology and adopts rules on the disclosures it requires.
- Texas Attorney GeneralHas exclusive authority to enforce the Texas Responsible Artificial Intelligence Governance Act.
United States
The US has no comprehensive federal AI law. Obligations come from federal frameworks and policy, and from a growing set of state and city laws.
LawColorado ADMT law (SB 26-189)Colorado SB 26-189, Automated Decision-Making TechnologyColorado's SB 26-189 replaced the Colorado AI Act before it took effect. What developers and deployers of decision technology must do from 1 January 2027.LawCalifornia CCPA ADMT regulationsCCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity AuditsCalifornia's CCPA regulations on automated decisionmaking technology and risk assessments. Who they cover, what they require, and the 2027 and 2028 deadlines.LawConnecticut AI in employment (PA 26-15)Connecticut Public Act 26-15, automated employment-related decision technologyConnecticut's Public Act 26-15 sets notice duties for AI used in hiring and other employment decisions from 1 October 2027. Who it covers and what it requires.LawNYC Local Law 144NYC Local Law 144 of 2021, Automated Employment Decision ToolsNYC Local Law 144 requires a yearly independent bias audit and candidate notice before employers use automated employment decision tools. What it requires.Public sector policyExecutive Order 14365Executive Order 14365, Ensuring a National Policy Framework for Artificial IntelligenceExecutive Order 14365 directs US agencies to challenge state AI laws and seek a federal standard. What it does, what it does not do and what it means for you.LawTexas TRAIGATexas Responsible Artificial Intelligence Governance Act (HB 149)The Texas Responsible AI Governance Act has been in force since 1 January 2026. Its prohibited uses, disclosure duties, penalties and the NIST-linked defence.LawIllinois AI in employment lawIllinois Human Rights Act amendments on AI in employment (HB 3773, Public Act 103-0804)Illinois HB 3773 makes discriminatory AI use and missing AI notice civil rights violations for employers. What it requires, who it covers and the rule status.LawCalifornia ADS employment regulationsCalifornia Civil Rights Council Employment Regulations Regarding Automated-Decision SystemsCalifornia's Civil Rights Council regulations apply anti-discrimination law to automated-decision systems at work. Scope, agent liability, records, testing.Public sector policyOMB M-25-21OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public TrustOMB M-25-21 sets how US federal agencies govern AI, with minimum practices for high-impact AI. What it requires, its deadlines and what it means for vendors.LawUtah AI Policy ActUtah Artificial Intelligence Policy Act and AI consumer protection disclosuresUtah requires disclosure of generative AI in consumer dealings and regulated occupations. What SB 149 and SB 226 require, the penalties and the 2027 repeal.LawCalifornia SB 53Transparency in Frontier Artificial Intelligence Act (California SB 53)California's SB 53 requires frontier AI developers to publish safety frameworks and transparency reports and to report critical safety incidents to Cal OES.LawUS state privacy laws on profilingUS state consumer privacy laws, profiling opt-outs and assessmentsMost US state privacy laws let consumers opt out of profiling for significant decisions and require assessments of risky profiling. How the model works now.Regulator guidanceNAIC AI Model BulletinNAIC Model Bulletin on the Use of Artificial Intelligence Systems by InsurersThe NAIC Model Bulletin sets regulators' expectations for insurers using AI, centred on a written AIS Program. What it asks for and how states adopt it.Regulator guidanceUS bank model risk guidance (SR 26-2)Supervisory Guidance on Model Risk Management (SR 26-2, replacing SR 11-7)SR 26-2 replaced SR 11-7 as US banking agencies' model risk guidance in April 2026. What it expects, who it targets and why generative and agentic AI are out.
International
Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.
StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.StandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Voluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Voluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.StandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Voluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.LawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Voluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.
Questions
Does the United States have a federal AI law?
No. There is no comprehensive federal AI statute. Executive Order 14365 asks federal agencies to challenge state AI laws and seeks a federal standard, but it does not preempt state law, and Congress has not passed a preemption statute. Federal agencies' own use of AI is governed by OMB Memorandum M-25-21.
Which states have AI laws?
Many. The main ones for organizations using AI are Colorado SB 26-189, California's CCPA ADMT rules and employment ADS regulations, Texas TRAIGA, Illinois's AI employment amendments, Connecticut Public Act 26-15, Utah's AI disclosure rules and NYC Local Law 144, plus the profiling rights in most state privacy laws.
Is the NIST AI RMF mandatory?
No. It is voluntary, but it is the federal government's reference framework for AI risk, and Texas TRAIGA gives a defense to organizations whose testing or internal review substantially complies with its Generative AI Profile or another recognized framework.
What happened to the Colorado AI Act?
It never took effect. Colorado SB 26-189, signed on May 14, 2026, repealed it and replaced it with a narrower law on automated decision-making technology that applies from January 1, 2027.
Start with the AI you run.
Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.