AI regulation in the US 2025 to 2026 is a patchwork, not a single act: federal executive action and agency enforcement on one side, hundreds of state bills and a growing set of enacted state laws on the other. For enterprises, the risk is building compliance around a rule that shifts. The durable control is usage-level evidence of what employees and AI agents did, which policy applied, and what action followed. Aurascape produces that evidence at the interaction layer.

Last updated: September 2026.

Which US AI Laws Actually Bind Enterprises in 2026?

US AI regulation means a layered set of existing federal statutes applied to AI, federal executive policy, agency guidance, and a fast-growing body of state and local law, rather than one omnibus statute on the European model. Binding duties come from two places: existing federal statutes, and state laws whose scope and effective dates reach the company, the workflow, and the decision at issue. Executive policy sets federal enforcement priorities and changes with each administration. Agency guidance interprets existing law for AI use cases and carries less weight than a statute. Voluntary frameworks, chiefly the NIST AI Risk Management Framework, shape what a defensible program looks like without creating a legal duty on their own.

State legislatures produced most of the new text in this period. State lawmakers introduced 1,208 AI-related bills in 2025, the first year in which every state introduced at least one, and 145 of those bills became law (MultiState, 2025). Volume is not the useful signal. Many enacted measures are narrow, or govern state agency use rather than private deployers. Direction is the signal. Recurring duties address disclosure, discrimination in covered decisions, regulated data, risk assessment, and qualifying incident reports. A program built to evidence those five things survives a change in which statute applies.

Federal AI Policy, Agency Enforcement, and the Preemption Fight

Federal AI policy since January 2025 has moved mainly through executive action rather than legislation:

• January 2025. Executive Order 14179 revoked the prior AI executive order and directed an adoption-first federal AI policy (Federal Register, 2025).
• July 2025. The administration released a federal AI action plan organized around innovation, infrastructure, and international position.
• 2025 to 2026. Congress removed the 2025 state-law moratorium from the final budget measure, and later preemption efforts continued through legislation and executive channels.

Executive policy sets direction. Enforcement runs through agencies applying statutes that predate the technology, and four of them reach ordinary enterprise AI use.

The Federal Trade Commission (FTC) acts under its authority over unfair or deceptive acts and practices. Its 2024 enforcement sweep targeted companies making deceptive claims about what their AI could do, along with schemes that used AI to power consumer harm (Federal Trade Commission, 2024). Two exposures follow for enterprises. Marketing claims about an AI feature must match what the system does. And consumer-facing AI that misleads a customer about price, terms, eligibility, or whether a person is involved can be a deception case with no AI-specific statute in play. Every state also has an unfair or deceptive acts and practices statute, which gives state attorneys general a parallel route to the same conduct.

The Equal Employment Opportunity Commission (EEOC) has stated that Title VII and the Americans with Disabilities Act reach employment decisions made or informed by automated tools, including AI-based hiring software, and that an employer using a vendor’s tool can still face adverse-impact exposure (U.S. Equal Employment Opportunity Commission, 2023).

The Consumer Financial Protection Bureau (CFPB) has stated that a lender using a complex algorithm for a credit decision still owes the applicant specific and accurate adverse action reasons under the Equal Credit Opportunity Act and Regulation B, and that an unexplainable model does not excuse a generic notice (Consumer Financial Protection Bureau, 2023). Banks and investment firms carry model risk management and vendor oversight duties on top of that notice obligation, a combination covered in AI compliance frameworks for banks and investment firms.

The Department of Health and Human Services finalized nondiscrimination provisions under Section 1557 of the Affordable Care Act that cover patient care decision support tools, including AI-driven ones, at covered health entities (U.S. Department of Health and Human Services, 2024). HIPAA governs the data those tools touch, so one clinical AI workflow can raise a nondiscrimination duty and a data handling duty at once, a pairing covered in AI compliance frameworks for healthcare and pharmaceutical organizations.

Guidance changes faster than statutes. The statutes underneath it do not. An evidence program tied to interactions outlasts any single guidance document or enforcement priority.

Selected State and Local AI Rules

The table below summarizes selected state and local laws with direct enterprise relevance. Scope and effective dates vary, so confirm a row’s current status before scoping work to it.

Six of those rows carry unresolved status or date questions that change how they apply.

Two of those rows describe developer duties rather than user duties. California’s SB 53 and New York’s RAISE Act attach to organizations training frontier models above a compute threshold. An enterprise that buys a commercial model is not a covered developer. Its exposure runs instead through the decision, disclosure, and data rows above, plus whatever it agreed to in its vendor contracts.

Synthetic content is regulated on a separate track from decision-making AI. Tennessee’s ELVIS Act extends state protection of name, image, and likeness to voice, which reaches cloned-voice use in advertising and customer service. At the federal level, the TAKE IT DOWN Act addresses nonconsensual intimate imagery, including AI-generated depictions, with notice and removal duties for covered platforms. Marketing, communications, and product teams carry most of this exposure, and the evidence question is the one the decision rules ask: which AI tool generated the asset, on whose account, from what source material.

What Compliance Teams Must Be Able to Evidence

Across these rules, the same evidence keeps coming up: the system in use, the covered decision, the data involved, the disclosure given, the review performed, and the action taken. The table maps each recurring duty to the record that answers it. Not every law above imposes every row, so read the middle column as what the rule requires where its scope reaches the organization.

Each row resolves to a fact about a specific AI interaction: who used AI, which account, what data moved, what the AI returned, which tool ran, and what policy decision followed. A written policy describes intent. An interaction record can supply the event-level facts a specific evidence request asks for. Discovery comes first, because none of these rows is testable until the organization knows where AI is running, a sequence covered in AI compliance frameworks for enterprise AI.

Six Steps to Build AI Compliance Evidence Across Changing US Rules

This sequence holds whichever rule bites first, because each step produces a fact an examiner or auditor can test. It also lines up with the govern, map, measure, and manage functions of the NIST AI Risk Management Framework (NIST, 2023), a voluntary structure that gives compliance and security teams shared language for inventory, testing, and ongoing management.

1. Discover what is running. Inventory AI apps, embedded AI features, copilots, coding assistants, IDE plugins and extensions, personal versus enterprise accounts, and locally installed agents. Discovery tells you where each obligation has to be applied and tested.
2. Classify and decide. Score each app on risk and capability, set sanctioned status, and tag apps by business function, so a policy written against a tag picks up new tools as they appear.
3. Map obligations to interactions, not to tool lists. Translate each duty into a condition on an interaction: this data type, this account type, this mode, this decision context. Tool lists age out as new services appear. Interaction conditions stay tied to data, account, mode, entitlement, and business context.
4. Enforce at the moment of use. Apply allow, coach, notify, redact, redirect, and block according to the interaction’s data, account, mode, entitlement, and business context, so the control lands before regulated data reaches an AI service and before an output reaches a downstream workflow.
5. Govern the agent-to-tool execution path. Approve tools individually, hold high-risk write and execute calls for human confirmation, and stop calls that appear outside the approved path.
6. Produce the record. Keep interaction records for audit and effectiveness, governed by role-based access control (RBAC) for privacy, and give compliance and legal direct access instead of a ticket queue.

Deploying Aurascape at The Police Credit Union followed that order. Phase one delivered visibility: an AI app inventory, automated discovery, risk assessments, and entitlement and data exposure visibility. Phase two delivered protection: coaching users away from risky use, requiring enterprise accounts for approved apps, and mapping data protections to credit union classifiers. Controls mapped to GLBA, FFIEC, Reg P, NCUA Part 748, NCUA examination expectations around AI, and the four functions of the NIST framework (Aurascape case study, 2026).

A Fortune 500 financial services firm took the same path into developer tooling. Deploying Aurascape secured 15,000+ developers across 8 targeted AI tools, with source code and client data governed inside the interaction and enterprise account access enforced (Aurascape case study, 2026). The sector obligations attached to that workflow are covered in AI compliance frameworks for financial services.

How Aurascape Produces Evidence at the Interaction Layer

Aurascape enforces policy on employee and agent interactions, using identity, account type, data, mode, entitlement, conversation context, and tool activity. The enforcement record is the evidence compliance teams need. Discovery covers the long tail, not the shortlist: the platform maintains a continuously updated catalog of 30,000+ AI apps and agents, and detects AI apps and agents running locally on endpoint devices, including an agent launch and its configuration with its MCP server connections, before the agent takes its first action (Aurascape, 2026). That answers the inventory row directly, including the personal-account and unsanctioned use a self-reported inventory misses.

Inside the interaction, Aurascape decrypts and decodes AI traffic and applies 600+ real-time data classifiers to prompts, responses, uploads, code, connector output, and tool calls. Policy then acts inline: allow, coach, notify, redact, redirect, and block. That satisfies the disclosure, data handling, and covered-decision rows at the moment they arise, rather than reconstructing them later. Auri gives security, IT, compliance, and legal teams role-based natural language access to the resulting records, without a security console or query language. Aurascape deploys across the network, endpoint, and API planes as an additive layer alongside an existing SSE, CASB, SWG, or DLP stack, with no rip and replace (Aurascape, 2026).

For agents, the Zero-Bypass MCP Gateway governs the tool-execution channel and marks each tool call it approves. The AI Proxy secures the intelligence channel between the agent and the model, and checks for that mark. In those workflows, a tool call that arrives without the mark is caught on the model path and blocked before the model acts. Model Context Protocol (MCP) is one common tool-execution pattern, not the whole agent access-control problem, so local agent discovery and policy cover the paths outside it (Aurascape, 2026). Those controls address the traceability row: for MCP workflows they can capture the user, application, server, tool, relevant data categories, and the policy action taken.

Frequently Asked Questions

Is there a federal AI law in the United States?

No single federal AI statute governs enterprise AI use. Federal exposure runs through existing authorities, including Title VII, the Equal Credit Opportunity Act, Section 1557, and the prohibition on unfair or deceptive acts and practices, each applied to AI use case by case.

What is the AI regulation in the US in 2025 and 2026?

Four layers apply at once: existing federal statutes enforced by agencies, federal executive policy, state and local AI laws, and voluntary frameworks. Which layer bites depends on the company, the workflow, and the decision involved.

Which US AI laws apply to automated hiring tools?

Federal discrimination law applies through Title VII and the Americans with Disabilities Act, as the EEOC has stated for automated selection tools. State duties can stack on top, such as the Illinois Human Rights Act amendments and, for New York City roles, the bias audit and candidate notice duties of Local Law 144. One hiring workflow that screens candidates for a New York City role using AI can trigger all three.

Can the FTC act on AI without a new AI law?

Yes. The FTC uses its existing authority over unfair or deceptive acts and practices, which reaches overstated claims about an AI product and consumer-facing AI that misleads. State unfair or deceptive acts and practices statutes give state attorneys general a parallel route.

Do US rules cover deepfakes and synthetic content?

Yes, through targeted laws rather than a general synthetic media statute. Tennessee’s ELVIS Act protects voice alongside name, image, and likeness, and the federal TAKE IT DOWN Act addresses nonconsensual intimate imagery including AI-generated depictions. Enterprise exposure concentrates in marketing, communications, and customer-facing voice applications.

Is the NIST AI Risk Management Framework mandatory?

No, it is voluntary. Its govern, map, measure, and manage functions give compliance teams a structure that lines up with the recurring duties above: inventory, risk classification, testing, and ongoing management.

What evidence do auditors and regulators ask for?

Evidence requests depend on the governing rule. Event records often need to show the account, the data, the AI output, the covered decision, the review performed, and the policy action taken. Interaction-level records answer those requests with facts rather than intent.

Do US AI rules cover AI agents and tool calls?

Existing laws can apply when an agent participates in a covered employment, credit, health care, privacy, or consumer workflow. The statute attaches to the covered decision or conduct, so the practical requirement is a record linking the agent’s action to the data it touched, the tool it invoked, and the policy that allowed it.

Does the EU AI Act apply to US companies?

Yes, when a US company places an AI system on the EU market or the system’s output is used within the EU, under the regulation’s own territorial scope provisions (EUR-Lex, 2024). One set of interaction records can serve evidence requests in both programs, while legal teams map each record to the specific requirement at issue.

Aurascape gives compliance, legal, and security leaders a record of what employees and AI agents did with AI, captured at the moment it happened. Discovery of the long tail, inline classification and policy action, and governance of the agent tool-execution path produce evidence that supports obligations across federal statutes, state and local laws, sector rules, and customer contracts. Aurascape produces interaction-level evidence for AI compliance reviews and audits, on the paths where employees and agents use AI every day.

See how Aurascape produces interaction-level evidence for AI compliance →