Government regulations on artificial intelligence in the United States do not sit in a single statute. Federal oversight comes from a January 2025 executive order that emphasizes innovation over prescriptive safety mandates, voluntary standards from the National Institute of Standards and Technology, and enforcement by agencies applying laws that predate modern AI. On top of that federal layer, states have passed mandatory rules on algorithmic discrimination, transparency, and privacy, and courts are still working out how copyright applies to training data. If you build or deploy an AI system, your compliance picture is assembled from all of these pieces at once.
The Current Federal Executive Posture
The federal executive stance shifted sharply on January 23, 2025, when Executive Order 14110 was revoked and replaced with a directive titled “Removing Barriers to American Leadership in Artificial Intelligence.”1The White House. Removing Barriers to American Leadership in Artificial Intelligence The prior order, signed in October 2023, had required developers of powerful dual-use foundation models to share safety test results with the Department of Commerce and to document red-teaming before deployment.2Federal Register. Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence Those mandatory reporting obligations are no longer in effect.
The replacement order declares it “the policy of the United States to sustain and enhance America’s global AI dominance in order to promote human flourishing, economic competitiveness, and national security.”3Federal Register. Removing Barriers to American Leadership in Artificial Intelligence It instructed agencies to review and potentially rescind regulations and guidance issued under the prior order, and it directed the Office of Management and Budget to revise its earlier memoranda on federal agency AI governance to match the new posture. The order also called for an AI Action Plan to be developed within 180 days.
What this means in practice: the federal executive branch is currently favoring voluntary industry self-governance over prescriptive safety mandates for private developers. It does not mean AI is unregulated. The statutes that agencies have long enforced against discrimination, deception, and unsafe products still cover automated systems.
NIST Standards as the Federal Yardstick
The clearest federal guidance on responsible AI development comes from the National Institute of Standards and Technology. NIST released its AI Risk Management Framework (AI RMF 1.0) in January 2023, organized around four core functions: govern, map, measure, and manage.4National Institute of Standards and Technology. AI Risk Management Framework In July 2024, NIST added NIST AI 600-1, a Generative AI Profile aimed at large language models and other generative systems. It walks organizations through documenting the origin and history of training data, establishing transparency policies, testing for CBRN misuse potential, and planning to halt deployment of systems that pose unacceptable risk.5National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile It also asks organizations to set minimum performance thresholds before approving deployment and to prevent generative systems from producing illegal content.
Both documents are voluntary. Neither carries the force of law on its own. Ignoring them still has consequences: federal contractors are frequently expected to show alignment with NIST standards, and state regulators have begun referencing the AI RMF when defining what counts as “reasonable care” under their own compliance laws. Treat these frameworks as the benchmark regulators will use to judge whether you took safety seriously.
How Existing Federal Laws Apply to AI
The most important thing to understand about U.S. AI regulation is that laws written decades before modern AI still apply when AI is used. The FTC, CFPB, EEOC, and DOJ Civil Rights Division issued a joint statement making that principle explicit for automated systems.6Federal Trade Commission. Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems Complicated technology is not a defense.
Deceptive AI Claims (FTC)
The Federal Trade Commission is the primary federal enforcer against companies that mislead consumers about their AI products. In September 2024, the FTC launched “Operation AI Comply,” a sweep targeting companies that used AI to “trick, mislead, or defraud people.”7Federal Trade Commission. FTC Announces Crackdown on Deceptive AI Claims and Schemes
The commission’s posture has since softened on prophylactic enforcement. In December 2025, the FTC set aside a prior enforcement order against an AI company, concluding that the original complaint “failed to satisfy the legal requirements of the FTC Act” and that the order “unduly burdens artificial intelligence innovation.”8Federal Trade Commission. FTC Reopens and Sets Aside Rytr Final Order in Response to the Trump Administrations AI Action Plan The Bureau of Consumer Protection said the FTC “will continue to hold accountable actors that use AI to violate the law or deceive consumers about the capabilities of their generative AI.” Outright fraud and unsubstantiated capability claims still draw enforcement.
Credit Decisions (CFPB)
The Consumer Financial Protection Bureau has stated plainly that using a complex algorithm does not excuse a lender from explaining why it denied someone credit. CFPB Circular 2022-03 requires creditors who use AI or machine learning to give applicants a notice disclosing the “specific principal reasons” for adverse action. A creditor “cannot justify noncompliance with ECOA and Regulation B’s requirements based on the mere fact that the technology it employs to evaluate applications is too complicated or opaque to understand.”9Consumer Financial Protection Bureau. Consumer Financial Protection Circular 2022-03 – Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms If a black-box model cannot produce a specific, accurate reason for a denial, the compliance failure is with the lender, not the technology.
Securities and “AI Washing” (SEC)
The Securities and Exchange Commission has targeted public companies that overstate or mischaracterize their AI capabilities to investors. In April 2025, the SEC filed a civil action against the founder of an AI startup who allegedly claimed automation rates above 90 percent when the actual rate was “essentially zero,” charging violations of the Securities Exchange Act and Securities Act. The SEC identified AI disclosures as a focus area in its Fiscal Year 2026 examination priorities, reviewing whether companies accurately represent how AI affects their financial results, risk exposure, and business models.
Healthcare (HHS)
The Department of Health and Human Services issued a final rule under Section 1557 of the Affordable Care Act, effective July 2024, prohibiting discrimination on the basis of race, color, national origin, sex, age, or disability in health programs, including when AI tools are used in clinical decisions. Covered entities must take reasonable steps to identify and mitigate discriminatory impacts from the AI tools they deploy: risk assessment algorithms, diagnostic tools, treatment planning software, and prior authorization systems. Regular testing and validation are required, along with transparent communication to patients about when AI plays a role in their care. If a tool produces discriminatory outcomes, corrective action is mandatory. A provider cannot shift responsibility onto a third-party developer.
Housing (HUD)
HUD guidance issued in 2024 confirms that the Fair Housing Act applies fully to AI-driven tenant screening and housing-related advertising. The guidance states that “the use of a third-party report or screening tool does not absolve a housing provider of liability for violating the Fair Housing Act.”10U.S. Department of Housing and Urban Development. HUD Issues Fair Housing Act Guidance on Applications of Artificial Intelligence Liability can arise under two theories: disparate treatment, where an algorithm intentionally discriminates, and disparate impact, where a facially neutral screening tool produces discriminatory effects on a protected group. Algorithms trained on historically discriminatory data or using proxies for protected characteristics can produce illegal outcomes without anyone intending to discriminate.
Employment (NLRB and DOL)
No federal law currently mandates specific disclosures when employers use AI to screen candidates or monitor employees, but pressure is building. The National Labor Relations Board has signaled that employer use of AI-driven surveillance tools could interfere with workers’ rights to organize, and the NLRB General Counsel has advocated for a presumption that such monitoring is illegal when it tends to chill protected labor activity. The Department of Labor released an AI Literacy Framework in February 2026 that, while not binding, treats responsible AI use as a core workplace competency and states that humans remain accountable for AI-assisted work. It advises employers to establish acceptable-use policies and document training efforts.
Intellectual Property and AI
Two federal offices have drawn firm lines on AI and IP. The U.S. Copyright Office requires human authorship as a prerequisite for registration and will not register works “produced by a machine or mere mechanical process” without creative input from a human author. Applicants must disclose AI-generated content and exclude it from the registration claim.11Federal Register. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence The Office distinguishes AI used as a creative tool, where a human directs and shapes output, from AI acting as a substitute for human creativity. Only the former produces copyrightable work.
The U.S. Patent and Trademark Office takes an analogous position on inventorship. Under 2025 USPTO guidance, AI systems cannot be named as inventors on patent applications; patent law limits inventorship to “natural persons” under 35 U.S.C. ยงยง 101 and 115, and the Supreme Court declined to revisit the requirement in early 2026. Using AI as a tool in the inventive process does not disqualify a resulting invention, as long as at least one human made a “significant contribution to the invention’s conception.” Document the human decisions.
Whether training an AI model on copyrighted material is lawful remains unsettled. Federal courts have split on the facts. When a model was trained on a competitor’s proprietary database to build a substitute product serving the same customers, the court found no fair use. When copyrighted works were converted into numerical weights to study linguistic patterns, without storing or outputting expressive content, courts found the use “quintessentially transformative.” The distinction turns on whether the training reproduces the original’s market function or serves a different analytical purpose.
What States Are Requiring
With no comprehensive federal AI statute, states have become the primary legislative actors. As of early 2026, lawmakers in 45 states had introduced over 1,500 AI-related bills, building on more than 1,200 introduced across all 50 states in 2025. Approaches vary, but several patterns recur.
Algorithmic Discrimination Programs
A growing number of states now require businesses to run risk management programs to prevent algorithmic discrimination when AI is used in high-stakes decisions like hiring, lending, and housing. These laws typically require developers to disclose intended uses and known limitations to deployers, and require deployers to conduct impact assessments before production use. Violations are generally treated as deceptive trade practices, enforceable by the state attorney general.
Bias Audits and Explainability
Several state laws now require bias audits as a condition of deploying AI in high-stakes contexts. Audits involve a technical review of system outputs to identify disparate impact patterns based on protected characteristics. Third-party audit costs vary with system complexity, and businesses should expect to budget for this layer. Explainability is a related through-line: laws in multiple states now require deployers to provide notice, and sometimes an opportunity to appeal, when AI drives a consequential decision about a person’s life.
Transparency Mandates
Several states require businesses to disclose when a consumer is interacting with an automated system rather than a human, and to explain when an AI system makes a decision that significantly affects someone’s rights or opportunities. Some states have enacted standalone AI transparency acts with civil penalties reaching $5,000 or more per violation, collectible through actions brought by the attorney general or local prosecutors.
Privacy and Training Data
Comprehensive state privacy laws increasingly address AI. Several states give individuals the right to opt out of automated decision-making, require businesses to conduct risk assessments for high-risk processing activities involving AI, and impose per-violation penalties that can exceed $7,500 for intentional violations. In at least one major state framework, businesses must submit annual compliance certifications and risk assessment summaries to the state privacy agency, with the first submissions due by 2028 for processing activities that began in 2026. Regulators can request copies of risk assessments at any time, with a 30-day deadline to comply.
Data scraping for training raises separate exposure. Collecting large volumes of internet data risks sweeping in protected personal identifiers without consent, and state privacy laws increasingly require clear audit trails showing where training data came from and how consent was obtained.
Critical Infrastructure and Energy
The Department of Energy is approaching AI safety from a different angle, focused on protecting the power grid and critical energy infrastructure. DOE is developing adversarial testing protocols for AI models used in grid management, specifically targeting cyber threats, and building AI testbeds where developers can test tools, hardware, and algorithms before production deployment.12Department of Energy. Artificial Intelligence The department is also partnering with academic researchers on privacy-enhancing technologies that allow AI deployment while mathematically protecting underlying data. The consequences of an AI failure at grid scale are qualitatively different from those in a hiring tool, and the DOE’s controlled-testing approach reflects that.
Putting the Pieces Together
If you develop or deploy AI in the United States, your compliance obligations come from four layers stacked on top of each other. At the federal executive level, the current policy is pro-innovation, and mandatory pre-deployment safety reporting is not currently required. From federal agencies, existing laws on deception, credit, housing, healthcare, employment, and securities all apply to automated systems, and the deploying entity, not the vendor, generally carries the liability. From NIST, voluntary frameworks set the yardstick regulators and contract counterparties will use to judge whether you exercised reasonable care. From the states, mandatory rules on discrimination risk programs, transparency, privacy, and bias audits create obligations that vary by jurisdiction and by the kind of decision your system makes. Building the documentation trail, impact assessments, adverse action explanations, human oversight records, is significantly cheaper than defending an enforcement action or a private lawsuit later.