AI Regulation in the USA: What Businesses Need to Know Before Implementing AI

Unlike the European Union, the United States has no single, comprehensive AI law. That doesn't mean AI is unregulated. Federal agencies apply existing laws to AI, a growing number of states have passed AI-specific rules, and sector regulations in health, finance and employment all reach AI systems.

For a business implementing AI in the US, the result is a patchwork. This guide outlines the main pieces so you can ask the right questions early. It's an engineering-led overview, not legal advice, and the landscape is changing quickly, so confirm details with your counsel.

Federal guidance: the NIST AI Risk Management Framework

The National Institute of Standards and Technology published the AI Risk Management Framework (AI RMF 1.0) in 2023, and a Generative AI Profile in 2024. The framework is voluntary, but it has become a common reference point for enterprises, auditors and procurement teams.

It organises AI risk work into four functions:

• Govern: policies, roles and a culture of risk management.
• Map: understand the context, purpose and potential impacts of each AI system.
• Measure: test and track risks such as inaccuracy, bias, security weaknesses and privacy issues.
• Manage: prioritise and act on risks, and monitor systems over time.

If you need to show a customer, board or regulator that your AI is under control, aligning with the AI RMF is a practical starting point.

Federal enforcement under existing laws

Federal agencies have made it clear that existing laws apply to AI. The Federal Trade Commission has acted against deceptive claims about AI products and unfair uses of data. Anti-discrimination laws apply to AI used in hiring, lending and housing. Consumer financial protection rules require lenders to explain the reasons for adverse credit decisions, even when a complex model is involved.

The practical lesson: don't overstate what your AI does, keep evidence of testing, and make sure automated decisions can be explained.

State AI laws

States have moved faster than Congress. A few examples show the range:

• Colorado: the Colorado AI Act targets high-risk AI systems that make or substantially influence consequential decisions, such as in employment, lending, housing, insurance, education and healthcare. It requires developers and deployers to use reasonable care to avoid algorithmic discrimination. Its start date has already been pushed back once, so check its current status.
• Texas: the Texas Responsible AI Governance Act, in effect from January 2026, sets rules mainly for government use of AI and prohibits certain harmful uses.
• Utah: requires disclosure when consumers interact with generative AI in certain regulated contexts.
• New York City: Local Law 144 requires bias audits and notices for automated employment decision tools.
• Illinois: has rules on AI in employment decisions and on AI analysis of video interviews.

Federal policy has also moved toward limiting state AI rules, so this picture may change. Track the states where your users and employees are, not just where your company is based.

Privacy laws

There's no federal privacy law covering all personal data, but many states now have one. California's CCPA, as amended by the CPRA, is the most influential. The California Privacy Protection Agency has adopted regulations on automated decision-making technology, risk assessments and cybersecurity audits, which phase in over the coming years.

Other states, including Virginia, Colorado, Connecticut and Texas, give consumers rights to opt out of certain profiling and require data protection assessments for higher-risk processing.

Sector rules

Healthcare

AI that touches protected health information must follow HIPAA. That means business associate agreements with any AI provider that processes PHI, minimum-necessary use of data, access controls and audit trails. AI used as a medical device may also fall under FDA oversight.

Financial services

Banks and lenders apply model risk management practices to AI, and must meet fair lending and adverse action requirements. Broker-dealers and investment advisers face rules on communications and conflicts of interest when AI is used with customers.

Employment

AI in hiring, promotion and performance management attracts scrutiny under anti-discrimination law and the state and city rules above. Bias testing and human review are essential.

What this means for your AI project

1. Classify early. Decide whether your use case affects consequential decisions about people. If it does, expect more obligations.
2. Know your states. List where your customers and employees are, and check which AI and privacy laws apply.
3. Test and document. Keep records of evaluation, bias testing and the controls you put in place.
4. Disclose honestly. Tell people when they're interacting with AI, and don't overstate what it can do.
5. Keep humans in the loop for decisions with significant effects on individuals.
6. Choose providers carefully. Use enterprise terms that prevent your data being used for training, and sign BAAs where health data is involved.
7. Align with the NIST AI RMF so you can show a structured approach to risk.

Frequently asked questions

Is there a federal AI law in the United States?

There is no single comprehensive federal AI law. Federal agencies apply existing consumer protection, anti-discrimination and sector laws to AI, and NIST provides voluntary guidance.

Is the NIST AI RMF mandatory?

No, it's voluntary for private companies. It's widely used because customers, auditors and some contracts expect a structured approach to AI risk.

Which AI uses attract the most regulation in the US?

AI that makes or influences consequential decisions about people, such as hiring, lending, housing, insurance, education and healthcare.

Do we have to tell customers they're talking to AI?

Some states require it in certain situations, and it's good practice everywhere. Clear disclosure also reduces the risk of deceptive practice claims.

Key takeaways

• The US relies on existing laws, state AI laws and voluntary frameworks rather than one AI act.
• Consequential decisions about people carry the most obligations.
• Track the states where your users and staff are.
• Align with the NIST AI RMF and keep evidence of testing.

Implementing AI in the US?

AnAInfo works with US companies on AI agents, knowledge assistants and automation, with risk work structured around the NIST AI RMF and designed alongside your counsel. Read our AI implementation roadmap or contact us to talk through your use case.