US AI governance for enterprise.
No federal AI law, but FTC, CFPB, EEOC, and sector regulators are all active. States are moving fast. And if you have EU customers, the EU AI Act applies regardless of where you're based.
State AI laws: the active patchwork
Six states with active or developing AI requirements, and more coming.
Federal agency AI enforcement
No AI law, but existing authorities, actively used.
AI-generated fake reviews, deceptive AI capability claims, AI discrimination, health AI claims. Consent decrees require algorithmic audits and in some cases model deletion.
Adverse action notice requirements for AI credit decisions; CFPB position that AI model complexity does not excuse failure to provide specific denial reasons to applicants.
Disparate impact of AI hiring tools on protected groups; employer liability regardless of intent; guidance on AI hiring assessment tools.
Model risk management requirements apply to AI models. SR 26-2 (April 2026) superseded SR 11-7, examiners assess ML-specific MRM practices under the revised guidance.
AI as Software as a Medical Device; predetermined change control plan for iterative AI medical products; De Novo and 510(k) pathways.
US AI governance articles
The US is the front line of AI insurance exclusions
ISO/Verisk generative-AI exclusion endorsements took effect in January 2026, and carriers are adding AI carve-outs to general-liability, D&O, and E&O policies — while a standalone AI-liability market emerges. See how the coverage gap works.