AI is restricted through several layers stacked on top of each other: intellectual property law decides what AI output you can own, the EU AI Act bans certain uses outright, U.S. federal and state laws target specific harms like non-consensual deepfakes and algorithmic discrimination, sector regulators police AI in finance, healthcare, law, and insurance, and the AI companies themselves enforce usage policies that go beyond anything the law requires. Understanding how AI is restricted means looking at all of these at once, because a use that is perfectly legal under U.S. federal law can still be banned by the platform you are using, forbidden by your employer, or illegal in the EU.
Copyright and Patent Limits on AI Output
Federal copyright law protects “original works of authorship,” and the Copyright Office reads that phrase to require a human creator.1Office of the Law Revision Counsel. 17 U.S. Code 102 – Subject Matter of Copyright: In General The D.C. Circuit confirmed this reading in Thaler v. Perlmutter, holding that the Copyright Act “requires all eligible work to be authored in the first instance by a human being.”2United States Court of Appeals for the District of Columbia Circuit. Thaler v. Perlmutter If an AI system independently produces text, an image, or a song with no meaningful human creative input, that output cannot be registered and effectively sits in the public domain.
Mixed works are a different question. In the Zarya of the Dawn decision, the Copyright Office granted registration for a book’s text and for the author’s selection and arrangement of AI-generated images, but explicitly excluded the images themselves because Midjourney, not the author, created them.3U.S. Copyright Office. Zarya of the Dawn Registration Decision To claim copyright on AI-assisted work, you need to show that a human made the meaningful creative choices rather than accepting whatever a prompt produced.
The biggest unresolved copyright question is whether training AI models on copyrighted material qualifies as fair use under 17 U.S.C. § 107, which weighs the purpose of the use, the nature of the work, the amount used, and the effect on the market.4Office of the Law Revision Counsel. 17 U.S. Code 107 – Limitations on Exclusive Rights: Fair Use Multiple suits from authors, artists, and news publishers are working through the courts, and no appellate decision has settled it. Anyone building or fine-tuning a model on scraped copyrighted data carries real legal exposure until it does.
Patents follow the same principle. The USPTO’s revised guidance, published in November 2025, confirms that “AI systems, regardless of their sophistication, cannot be named as inventors or joint inventors on a patent application.”5Federal Register. Revised Inventorship Guidance for AI-Assisted Inventions A human must have conceived the complete invention. Using AI as a tool is fine, but you have to document how the person conceived, refined, and integrated whatever the AI produced. An application listing an AI as sole inventor gets rejected.
The EU AI Act’s Banned Uses
The European Union’s AI Act is the most comprehensive AI-specific law in the world and bans certain uses outright as unacceptable risks to fundamental rights.6Shaping Europe’s digital future. AI Act Eight categories are prohibited under Article 5, including systems that manipulate people through deceptive techniques designed to distort behavior, systems that exploit vulnerabilities tied to age, disability, or economic status, and government-run social scoring based on behavior or personality.7AI Act. EU Artificial Intelligence Act – Article 5: Prohibited AI Practices
Penalties are heavy. Deploying a banned AI system can bring fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher.8AI Act. EU Artificial Intelligence Act – Article 99: Penalties Lower tiers apply to other violations like failing transparency requirements for high-risk systems. The reach is extraterritorial: any company offering AI products or services to people in the EU is potentially subject, wherever the company is based.
U.S. Federal Rules
The United States has no single comprehensive AI statute. Executive Order 14110, issued in October 2023, imposed safety and transparency reporting on developers training large models. It was revoked in January 2025 by Executive Order 14179, “Removing Barriers to American Leadership in Artificial Intelligence,” which directed agencies to review and suspend, revise, or rescind actions taken under the earlier order.9Federal Register. Removing Barriers to American Leadership in Artificial Intelligence Many of the reporting obligations from 2023 no longer apply.
Federal restrictions instead come from targeted statutes. The TAKE IT DOWN Act, signed in May 2025, created the first federal criminal penalties for non-consensual intimate deepfakes. Publishing a realistic AI-generated intimate image of an identifiable adult without consent carries up to two years in prison; if the depicted person is a minor, up to three years. Threatening to publish such content carries up to 18 months for adult victims and 30 months for minors.10Congress.gov. The TAKE IT DOWN Act: A Federal Law Prohibiting Non-Consensual Intimate Images Platforms must remove reported images within 48 hours of a valid takedown request.11United States Senate. Bipartisan TAKE IT DOWN Act Signed into Law
Political ads are handled differently. The FEC declined to write specific disclaimer rules for AI-generated campaign material in 2024, instead adopting an interpretive rule that the existing ban on fraudulent misrepresentation applies to AI content the same way it applies to forged documents.12Federal Election Commission. Commission Approves Notification of Disposition, Interpretive Rule on Artificial Intelligence in Campaign Ads Impersonating a candidate with AI is already illegal; using AI to draft ad copy or graphics is not, and no federal disclosure is required.
State Laws
States have moved faster than Congress, and the results vary. Some target biometric data, requiring consent before AI systems collect fingerprints, facial scans, or voiceprints, with statutory damages per violation and higher amounts for intentional misconduct. Others focus on algorithmic decision-making in housing, insurance, and consumer transactions, giving residents the right to opt out or request human review. A company operating nationally has to track requirements across dozens of jurisdictions.
Hiring and Employment
AI-powered hiring tools are restricted primarily through Title VII of the Civil Rights Act. The EEOC uses the four-fifths rule as an initial screen: if a protected group’s selection rate through an AI tool falls below 80% of the rate for the most-selected group, that creates a preliminary finding of adverse impact. Once adverse impact is established, the employer must prove the tool is job-related and consistent with business necessity, or show the statistics were flawed. The more opaque the algorithm, the harder that defense becomes.
The Americans with Disabilities Act adds another layer. Employers using AI assessments must provide reasonable accommodations for candidates who cannot interact with the tool as designed. When an employee requests AI as an accommodation, the employer evaluates whether it lets the person perform their core responsibilities, considers privacy and security risks, and weighs cost and feasibility. If the specific tool poses an undue hardship, the employer still has to identify an effective alternative.
Industry Rules
Financial Services
The Equal Credit Opportunity Act requires lenders to give specific reasons for any adverse credit decision, and using an algorithm does not lower that bar. The CFPB has said creditors cannot satisfy the requirement by citing a vague category like “purchasing history.” If a model lowered someone’s credit limit based on spending patterns, the notice has to identify the actual negative behaviors flagged.13Consumer Financial Protection Bureau. CFPB Issues Guidance on Credit Denials by Lenders Using Artificial Intelligence That effectively rules out black-box models for credit decisions. Financial institutions using third-party AI must also comply with the FTC Safeguards Rule, which requires a written information security program covering customer data handled by AI vendors.14Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
Healthcare and the FDA
Healthcare organizations processing patient data with AI must comply with HIPAA. When a provider shares protected health information with an AI vendor, the vendor becomes a business associate and must sign a formal agreement covering the privacy and security rules. Feeding patient records into a consumer AI chatbot without such an agreement is a clear violation.
Clinical AI tools face a second layer from the FDA, which classifies certain AI-enabled software as a medical device. These products go through premarket review via the 510(k) clearance process, De Novo classification, or premarket approval, depending on risk.15U.S. Food and Drug Administration. Artificial Intelligence in Software as a Medical Device Because AI models change over time, the FDA issued guidance in August 2025 on Predetermined Change Control Plans, which let developers pre-approve a range of planned modifications without filing a new marketing submission for each update.16U.S. Food and Drug Administration. Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions
Law Practice
Attorneys face restrictions from courts and from professional ethics. Judges in a growing number of jurisdictions require lawyers to certify they have personally verified every citation and argument in filings that involved AI. The consequences for failing to do so are concrete: lawyers have been sanctioned for submitting AI-drafted briefs containing fabricated case citations, with penalties ranging from fines to having pleadings struck.
The American Bar Association’s Formal Opinion 512 addresses the ethical side. Under Model Rule 1.6, lawyers must keep client information confidential regardless of technology, so entering privileged material into a public AI tool without proper safeguards breaches the duty of confidentiality. Model Rule 1.1 requires lawyers to understand the risks of the AI tools they use, and the opinion says lawyers must consult with clients about whether AI will be part of how their case is handled.17American Bar Association. ABA Issues First Ethics Guidance on a Lawyer’s Use of AI Tools
Insurance
State insurance regulators restrict how AI can be used for underwriting and claims. Models that rely on proxy variables like ZIP code or shopping behavior draw scrutiny because those inputs can correlate with race or income. Insurers must document their algorithmic processes and turn those records over to state commissioners during audits. A company that cannot show its AI-driven pricing is fair can face license suspensions and multimillion-dollar settlements.
Platform Usage Policies
AI companies enforce their own restrictions through terms of service that reach further than any current law. OpenAI, Anthropic, Google, and others prohibit generating instructions for building weapons or synthesizing dangerous biological agents, writing malicious code or planning cyberattacks, creating non-consensual sexual content, and impersonating real people. Violations result in account termination, and companies reserve the right to report activity to law enforcement when it suggests an imminent threat.
Safety systems inside commercial models block many prohibited outputs before the user sees them. When a model refuses, that is the safety layer recognizing the request falls outside allowed boundaries. These platform rules move faster than legislation: a developer can revise a usage policy and retrain its filters in weeks. The tradeoff is that these rules are set unilaterally and can change without public input.
Corporate and Workplace Policies
Most large organizations restrict how employees can use AI, and the driving concern is data leakage. When someone pastes proprietary source code, financial projections, or client data into a consumer AI chatbot, that information may be stored, used for training, or otherwise leave the organization’s control. Many companies now ban public AI tools for any work involving confidential information, and some block access to consumer AI websites on corporate networks.
Enterprise AI products are treated differently. They typically come with contractual guarantees that submitted data will not be used for training and will not leave the customer’s environment. That distinction between approved enterprise tools and unapproved consumer versions is a real compliance line in most workplaces. Employees who use the wrong tool for a sensitive task can face discipline up to termination, not because AI itself is forbidden but because the data protections are missing.
Professional services firms operate under tighter constraints. Accounting firms, law practices, and consulting agencies are often bound by client contracts and professional standards that prohibit running client data through automated systems without explicit consent. Internal policies at these firms usually spell out which tasks may involve AI and which must be done manually, and compliance teams update those policies regularly as both the tools and the surrounding rules change.