How AI Is Regulated in the US: Federal Rules, State Laws and Enforcers

People often say the United States "doesn't regulate AI." That is not quite right. America has no single, comprehensive AI law of the kind the European Union adopted, but AI is far from unregulated. It is governed through a layered system: long-standing federal laws applied to new technology, enforcement by agencies, policy set by the White House, and a rapidly expanding set of state laws. The result is less tidy than one statute, and it changes often, which is why understanding the structure matters more than memorizing any single rule.

Layer one: existing federal laws already apply

Most legal obligations around AI come from laws that predate it. Using an algorithm does not create an exemption.

• Consumer protection. Section 5 of the FTC Act prohibits unfair or deceptive practices. That covers exaggerated claims about what an AI product can do, undisclosed data practices and AI-generated fake reviews.
• Civil rights and anti-discrimination. Title VII (employment), the Fair Housing Act, the Equal Credit Opportunity Act and the Americans with Disabilities Act apply when AI influences decisions about jobs, housing, lending and access.
• Credit and consumer reporting. The Fair Credit Reporting Act and ECOA's adverse action rules require lenders to give specific reasons when they deny credit, even if a complex model made the call.
• Sector rules. The FDA oversees AI used in medical devices. HIPAA governs health information. Financial regulators supervise banks' use of models. The FCC applies telemarketing law to AI-generated voices in robocalls.
• Intellectual property. Copyright and patent law determine what can be protected and when training or outputs infringe, questions courts and the US Copyright Office are actively working through.
• Children's privacy. The Children's Online Privacy Protection Act (COPPA) applies to services collecting data from kids under 13, AI-powered or not.

Layer two: federal agencies and enforcement

Agencies translate those laws into action through enforcement, guidance and rules. The Federal Trade Commission is the most active on AI in consumer markets and publishes its AI-related actions and business guidance at ftc.gov. Other agencies, from the Consumer Financial Protection Bureau to the Equal Employment Opportunity Commission and the Securities and Exchange Commission, weigh in where AI touches their areas.

Agency priorities shift with leadership, and guidance documents can be withdrawn or replaced. The underlying statutes, however, stay in force until Congress changes them, which is why companies that focus on the statutes are less exposed to policy swings.

Layer three: executive-branch policy

Presidents shape AI policy mainly through executive orders and national strategies that direct how federal agencies act, how the government buys and uses AI, and what research and infrastructure it supports. These have changed direction between administrations: the Biden administration's 2023 executive order on AI safety was revoked in January 2025, and the Trump administration has emphasized reducing regulatory barriers and promoting US AI leadership, including through a national AI action plan. Executive orders generally bind federal agencies rather than private companies directly, though they influence procurement requirements and agency enforcement priorities.

The federal government has also signaled interest in limiting the reach of state AI laws, and Congress has debated whether to preempt them. How that tension resolves is one of the most important open questions in US AI policy, so check current developments rather than relying on any summary, including this one.

Layer four: voluntary standards

The National Institute of Standards and Technology (NIST) publishes the AI Risk Management Framework, released in 2023, along with companion resources including a profile for generative AI. It is voluntary, but it has become a common reference point: companies use it to structure internal governance, and some state laws point to recognized frameworks like it as evidence of reasonable care.

Layer five: the states

With no comprehensive federal statute, states have moved quickly. Hundreds of AI-related bills are introduced in state legislatures each year, and a growing number pass. They tend to fall into a few groups:

Texas enacted its own AI governance law in 2025, focusing largely on government use and certain prohibited practices, showing that state activity is not limited to any one region or political leaning.

How to keep track

Because the landscape shifts constantly, set up a simple monitoring routine rather than relying on a one-time review:

1. Inventory your AI use. List where your organization uses AI, what data it touches and whether it affects decisions about people.
2. Map your footprint. Note the states where your customers, applicants and employees are, since many laws follow the affected person.
3. Watch primary sources. Congress.gov for federal bills, the Federal Register for agency rules, the FTC's AI pages, and your state legislature and attorney general websites.
4. Use trackers wisely. Law firms, trade associations and the National Conference of State Legislatures publish state AI legislation trackers. Confirm anything important against the bill text.
5. Document your risk management. Using the NIST framework and keeping records of testing, monitoring and human oversight puts you in a stronger position under almost any regime.
6. Review at least quarterly, and immediately when you launch a new AI use that touches hiring, lending, housing, healthcare, insurance or children.

The practical bottom line

For most businesses, the compliance center of gravity is not a new AI statute. It is applying familiar obligations, honesty in marketing, fairness in decisions about people, care with personal data, to systems that make those obligations easier to break at scale. Get those right, add the specific state requirements that apply to your footprint, and you will be well positioned whichever direction federal policy takes next.