The short answer
There is no comprehensive federal AI law in the United States. Federal policy since 2025 has focused on removing barriers to AI, and a December 2025 executive order directs the Department of Justice to challenge state AI laws it considers burdensome. Executive orders do not repeal state laws, though, so state AI laws stay in force unless courts or legislatures change them.
What applies to you depends on where you operate and what you use AI for. Texas's AI law has been in effect since January 1, 2026. Colorado's and California's rules on automated decisions take effect on January 1, 2027. Hiring rules in Illinois and New York City, HIPAA for health information, and agency policies for public-sector work already apply. The common thread: know where you use AI, protect the data it touches, keep people accountable for decisions that affect others and be able to explain what you did.
This article is general information, not legal advice. Your legal advisers should confirm how the rules apply to you.
Federal: frameworks, not a statute
- Executive orders. Executive Order 14179 (January 2025) replaced earlier federal AI policy, and America's AI Action Plan followed in July 2025. Executive Order 14365 (December 2025) set up a Department of Justice task force to challenge state AI laws and asked for a national framework; recommendations released in March 2026 are not binding.
- Existing law still applies. The FTC Act prohibits unfair or deceptive practices, including misleading claims about AI products, and sector privacy laws such as HIPAA and the GLBA apply to the data AI systems use.
- NIST AI Risk Management Framework. The voluntary NIST AI RMF and its Generative AI Profile (NIST AI 600-1) organize AI risk work into four functions: govern, map, measure and manage. It is the most widely used reference for AI governance in the US, and Texas's law recognizes it in one of its defenses.
- Federal agencies. OMB memoranda M-25-21 and M-25-22 govern how federal agencies use and buy AI, which matters to anyone selling AI-enabled services to them.
State laws in force or coming
Texas (in effect since January 1, 2026)
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) applies to organizations that do business in Texas, offer products or services used by Texans, or develop or deploy AI in Texas. It prohibits developing or deploying AI with the intent to encourage self-harm or crime, to unlawfully discriminate (disparate impact alone does not show intent), or to infringe constitutional rights, along with certain sexual-content uses. Government agencies must tell people when they are interacting with AI, and health care providers must disclose AI used in a patient's care. The Texas Attorney General enforces the law, with a 60-day notice and cure period and no private lawsuits. Finding a problem through internal review while substantially complying with a recognized framework, such as the NIST Generative AI Profile, supports a defense, but it is not a blanket safe harbor.
Colorado and California (January 1, 2027)
- Colorado replaced its 2024 AI Act in 2026 with a narrower law on automated decision-making technology used for consequential decisions. From January 1, 2027, deployers must give notice, explain adverse decisions on request and let people correct their data and ask for human review.
- California's privacy regulator adopted regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits. Businesses that use ADMT to make significant decisions about consumers, such as in employment, lending, housing, education or health care, must comply by January 1, 2027.
Employment
Illinois law, effective January 1, 2026, bars employers from using AI that has a discriminatory effect in employment decisions and requires notice when AI is used. New York City's Local Law 144 requires a bias audit and notice to candidates before an automated employment decision tool is used.
Public agencies and their vendors
Maryland's AI Governance Act of 2024 requires state units to inventory high-risk AI and complete impact assessments by December 31, 2026 for systems procured from February 2026, and by July 1, 2027 for older systems. The Maryland Department of Information Technology's Responsible AI Policy also applies to contractors: AI goes through an intake process with risk tiers, and high-risk AI needs a risk assessment before deployment. Other states have similar policies, so check the requirements in any solicitation.
Rather talk it through? If you are not sure which of these rules touch your AI tools, we can map your AI use against them in a short review. Talk to a Promatics specialist
Health care
HIPAA applies to AI the way it applies to any vendor: an AI service that creates, receives, maintains or transmits protected health information for a covered entity is a business associate and needs a business associate agreement. Covered health programs must also manage the risk of discrimination in patient care decision support tools under the Section 1557 rule. Our guide to AI and HIPAA covers this in more detail.
What to do now
- List the AI tools and features in use, including ones staff use without approval (shadow AI).
- For each, record what information goes in, where it is processed and whether the vendor uses it for training.
- Keep protected health information, financial data and other regulated data out of tools without suitable business terms and agreements.
- For information too sensitive for any outside AI provider, consider models hosted on servers you control, in a US region and, for protected health information, under a business associate agreement with the hosting provider.
- Identify decisions about people (hiring, lending, housing, eligibility, care) where AI plays a part, and keep a person accountable for each.
- Check which state laws apply to you, starting with Texas, Colorado, California, Illinois and New York City.
- Prepare notices and explanations for automated decisions that will be covered from January 1, 2027.
- If you sell to public agencies, read their AI policies and be ready to provide technical documentation and risk information.
- Adopt the NIST AI RMF as your reference and publish an AI acceptable use policy.
- Keep records of approvals, assessments and changes.
When to bring in help
A small organization using a few mainstream AI tools can often handle the basics with a clear policy and sensible settings. Bring in help when AI touches decisions about people, when you operate in several states, when you handle health information, when you sell to public agencies, or when clients, funders or insurers ask for evidence of AI controls.
Our AI governance and security service inventories your AI use, sets proportionate rules, applies technical controls and documents everything against the NIST AI RMF and the state rules that apply to you. We work alongside your legal advisers, who remain responsible for legal interpretation. If you are just getting started, an AI readiness assessment covers governance as part of a broader plan.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- AI Risk Management Framework, National Institute of Standards and Technology
- Ensuring a National Policy Framework for Artificial Intelligence (Executive Order 14365), Federal Register
- HB 149, Texas Responsible Artificial Intelligence Governance Act (bill history), Texas Legislature Online
- CCPA updates, cybersecurity audits, risk assessments and automated decisionmaking technology regulations, California Privacy Protection Agency
- Maryland Responsible AI Policy, Maryland Department of Information Technology
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.