There is no single federal statute governing artificial intelligence in the United States. Federal AI legislation is a patchwork: one active presidential executive order, enforcement by agencies applying decades-old consumer protection, civil rights, and securities statutes to AI products, intellectual property rules from the USPTO and Copyright Office, binding AI provisions tucked inside annual defense authorization law, a voluntary NIST risk framework, and several bills that have been introduced but not enacted. The picture shifted sharply on January 23, 2025, when the current administration revoked the prior safety-focused executive order and replaced it with a directive prioritizing American AI competitiveness. Knowing what is actually in force, what has been repealed, and what remains a proposal matters, because the obligations on AI developers and users look very different depending on which category a rule falls into.
The Active Executive Order and What It Replaced
Executive Order 14179, signed on January 23, 2025, is the operative presidential directive. Its stated policy is to “sustain and enhance America’s global AI dominance in order to promote human flourishing, economic competitiveness, and national security.” The order directed senior White House officials to develop an AI action plan within 180 days and to review every policy issued under the earlier Executive Order 14110 for anything inconsistent with the new pro-innovation stance. Where prior rules were found to obstruct that stance, agency heads were told to suspend, revise, or rescind them. The Office of Management and Budget was instructed to revise its AI governance memoranda (M-24-10 and M-24-18) within 60 days.1Federal Register. Removing Barriers to American Leadership in Artificial Intelligence
A follow-up executive order issued in December 2025 addressed state-level AI regulation and asserted a national policy framework aimed at preventing conflicting state requirements.2The White House. Ensuring a National Policy Framework for Artificial Intelligence
The revoked Executive Order 14110, signed in October 2023, had taken the opposite approach. It required developers of large-scale “dual-use foundation models” to notify the federal government when training such systems and to share the results of safety evaluations, including adversarial “red-team” testing meant to probe for the ability to assist with biological, nuclear, or cyber threats. It also tasked the Department of Commerce with developing watermarking standards for AI-generated content and required companies operating large computing clusters to report the location and capacity of that hardware.3GovInfo. 3 CFR 14110 – Executive Order 14110 of October 30, 2023 None of these mandates remain in effect. EO 14179 explicitly revoked EO 14110 and directed agencies to unwind actions taken under it.4The White House. Removing Barriers to American Leadership in Artificial Intelligence If you have read about federal requirements for AI safety testing, red-teaming, content watermarking, or computing cluster reporting, those obligations originated with EO 14110 and are no longer enforceable.
Federal Agency Enforcement Under Existing Statutes
The most durable federal AI regulation comes from agencies applying laws that predate AI entirely. The FTC, EEOC, SEC, and HHS have all taken the position that existing consumer protection, civil rights, securities, and health technology statutes apply to automated systems without any need for new legislation. This is where most of the real enforcement is happening.
The FTC and Deceptive AI Claims
The Federal Trade Commission uses Section 5 of the FTC Act, which declares unfair or deceptive acts in commerce unlawful, to pursue companies whose AI products mislead consumers.5Office of the Law Revision Counsel. 15 U.S. Code 45 – Unfair Methods of Competition Unlawful; Prevention by Commission No AI-specific statute is required. In September 2024, the agency announced a crackdown on deceptive AI claims. DoNotPay, which marketed itself as “the world’s first robot lawyer,” agreed to pay $193,000 and notify customers about the limitations of its service after the FTC found the company had never tested whether its AI output matched a human lawyer’s quality. The same sweep targeted Ascend Ecom and FBA Machine for using exaggerated AI claims to sell online storefront schemes, and charged Rytr for providing subscribers with the means to generate fake consumer reviews.6Federal Trade Commission. FTC Announces Crackdown on Deceptive AI Claims and Schemes
Under its Penalty Offense Authority, the FTC can impose civil penalties of up to $50,120 per violation against companies that received a formal notice of penalty offenses and then engaged in conduct the Commission has identified as unfair or deceptive. That amount is adjusted for inflation each January.7Federal Trade Commission. Notices of Penalty Offenses Because the structure applies per violation, a company with widespread AI misrepresentations can accumulate substantial exposure.
The EEOC and Algorithmic Hiring Tools
The Equal Employment Opportunity Commission enforces Title VII of the Civil Rights Act, which prohibits employment discrimination based on race, color, religion, sex, and national origin. The agency has made clear that these protections apply with full force when employers use AI-powered hiring and screening tools.8U.S. Equal Employment Opportunity Commission. What Is the EEOC’s Role in AI If an algorithm screens out a disproportionate number of applicants from a protected group, the employer faces the same liability as if a human recruiter made those decisions.
The EEOC applies the four-fifths rule as an initial test: if the selection rate for one group is less than 80% of the rate for another, the tool is flagged for potential adverse impact. Employers can’t avoid responsibility by blaming the vendor who built the software. EEOC guidance states that employers may be held responsible for the discriminatory effects of selection tools administered by their agents, including outside software vendors. The guidance also notes that the development process for algorithmic tools often produces multiple comparably effective alternatives, and that a vendor’s failure to select a less discriminatory version can itself create liability.9U.S. Equal Employment Opportunity Commission. Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964
The SEC and “AI Washing”
The Securities and Exchange Commission has focused on public companies exaggerating their AI capabilities to attract investors. In 2024, the agency charged two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., with false and misleading statements about their use of AI. Delphia claimed its investment process incorporated AI and machine learning using client data, but the SEC found the firm did not actually have those capabilities. Global Predictions called itself the “first regulated AI financial advisor” without basis. The firms paid a combined $400,000 in civil penalties.10U.S. Securities and Exchange Commission. SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Purported Use of Artificial Intelligence
The SEC’s Division of Examinations has identified AI as a focus area for fiscal year 2026. The agency expects companies to avoid generic AI risk disclosures and instead describe their actual state of deployment, the data and models they use, and the governance structures overseeing AI. Forward-looking claims must be consistent with real budgets, staffing, vendor contracts, and product readiness.
HHS Transparency Rules for Health AI
HHS took a different route by creating AI-specific transparency rules for health technology. The HTI-1 final rule establishes first-of-its-kind transparency requirements for AI and predictive algorithms built into certified health IT systems.11HealthIT.gov. HTI-1 Final Rule Developers of certified health IT must disclose detailed information about predictive decision support tools, including what data was used to train the model, how it should be used and maintained, and how it performs on validity and fairness metrics. The rule requires 31 distinct source attributes for predictive tools, from development details to ongoing validation schedules.
Intellectual Property Rules Already in Force
Patent Inventorship
Only natural persons can be named as inventors under federal patent law. The Federal Circuit has held that AI systems, no matter how sophisticated, cannot qualify as inventors or joint inventors. The USPTO’s revised guidance, published in November 2025, reaffirms that conception is the touchstone of inventorship: the human inventor must have formed a “definite and permanent idea of the complete and operative invention” in their mind. If an AI system generates an output that a person then recognizes and refines into a patentable invention, the person is the inventor. Where multiple people contribute with AI assistance, traditional joint inventorship analysis applies, including the requirement that each person make a contribution significant in quality relative to the full invention.12Federal Register. Revised Inventorship Guidance for AI-Assisted Inventions A patent application listing an AI system as an inventor will be rejected.
Copyright Registration
The U.S. Copyright Office applies a parallel principle: copyright protects only material that is the product of human creativity. When an AI system determines the expressive elements of a work, that output is not copyrightable. A work that combines human-authored and AI-generated elements can be registered, but the applicant must disclaim the AI-generated portions and describe them in the “Limitation of the Claim” section of the registration form. Only the human-authored components receive protection.13Federal Register. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence
Training Data and Fair Use
Whether using copyrighted works to train generative AI qualifies as fair use is the most contested intellectual property question in the field. The Copyright Office published a report in May 2025 analyzing training-data use through the four statutory fair use factors: purpose and character of the use (including whether it is commercial or transformative), nature of the copyrighted work, how much of the work was used, and effect on the market for the original. The report lays out the analytical framework without issuing a blanket ruling that training is or is not fair use, and explores voluntary licensing, compulsory licensing, and opt-out mechanisms.14U.S. Copyright Office. Copyright and Artificial Intelligence, Part 3: Generative AI Training Courts will decide where the line falls.
Binding AI Provisions Inside the Defense Authorization Act
Civilian AI legislation has stalled, but Congress has embedded AI requirements into the National Defense Authorization Act, which passes annually with bipartisan support. The FY2026 NDAA (P.L. 119-60) includes over a dozen AI-related sections directed at the Department of Defense.15Congress.gov. Cyber and Artificial Intelligence Provisions in the FY2026 National Defense Authorization Act Among them:
- A comprehensive AI cybersecurity governance policy covering all AI and machine learning systems the DOD uses, addressing data poisoning, jailbreaks, counterfeit components, and unauthorized access.
- A prohibition on the DOD using or acquiring AI systems from covered foreign adversaries, including systems from Chinese firms like DeepSeek and High Flyer, with a narrow waiver for national security functions like counterterrorism research.
- A cross-functional AI model assessment team charged with developing DOD-wide standards for AI performance, testing procedures, and compliance with the department’s ethical AI principles.
- A task force to create AI sandboxes, isolated computing environments where DOD personnel can experiment with and develop AI tools.
- AI-specific content in DOD cybersecurity training for all applicable personnel.
These provisions carry the force of enacted law, unlike the executive orders and unenacted bills that dominate civilian AI policy debates.
Bills Introduced But Not Enacted
Several AI-focused bills have been introduced in Congress. None have become law. They are signals of where policy may head, not current obligations.
The Algorithmic Accountability Act
First introduced in 2019 and reintroduced in multiple sessions, the most recent version is S. 2164, introduced in the Senate in June 2025 and referred to the Committee on Commerce, Science, and Transportation.16Congress.gov. S.2164 – 119th Congress (2025-2026): Algorithmic Accountability Act of 2025 It would require companies to conduct impact assessments for automated systems that make decisions affecting housing, employment, healthcare eligibility, and access to credit. The assessments would evaluate the system’s design, training data, and potential for biased outcomes, and the FTC would oversee enforcement and maintain a public repository of assessment data.17U.S. Senator Ron Wyden. Algorithmic Accountability Act of 2023 The bill has not advanced beyond committee in any session.
The CREATE AI Act
The Creating Resources for Excellence in AI and Emerging Technologies Act would establish the National AI Research Resource, a shared computing infrastructure giving academic researchers and students access to the processing power and datasets currently concentrated in a handful of private technology companies. The 2025 version, H.R. 2385, was introduced in the 119th Congress and remains in the introductory stage.18Congress.gov. H.R.2385 – 119th Congress (2025-2026): CREATE AI Act of 2025 The bipartisan Senate AI Working Group identified the NAIRR as a priority in its 2024 policy roadmap and recommended passing the CREATE AI Act as part of a broader cross-government AI research initiative.19U.S. Senate. Bipartisan Senate AI Working Group Policy Roadmap
The NIST Framework: Voluntary But Widely Referenced
The National Institute of Standards and Technology published the AI Risk Management Framework (AI RMF 1.0) in January 2023. It is not law and does not create binding obligations, but it has become the reference standard organizations, agencies, and auditors point to when evaluating whether an AI system is being managed responsibly. The framework is built around four core functions (Govern, Map, Measure, and Manage) and is designed to be voluntary, sector-neutral, and applicable to any use case.20National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0) The prior OMB memorandum M-24-10 directed federal agencies to follow minimum risk management practices closely aligned with the NIST framework, including AI impact assessments and ongoing monitoring, and several proposed state AI laws also reference it.
What Is Actually Binding Right Now
The gap between the volume of AI policy discussion and the amount of binding federal law catches many people off guard. If you are developing, deploying, or purchasing AI tools, your real legal exposure comes mostly from statutes written decades before large language models existed. The FTC Act, Title VII, and federal securities law all apply to AI-powered products and hiring tools now, with active enforcement behind them. The NDAA provisions bind the DOD and its contractors. The USPTO and Copyright Office rules govern how you can claim ownership of AI-assisted work. Everything else in the federal AI landscape is proposed, revoked, or voluntary.