AI law and policy in the United States

The United States leads the world in AI investment and frontier model development, and its approach to AI governance reflects a strong preference for innovation and market-led development. There is no comprehensive federal AI statute. Federal policy has shifted sharply between administrations, from an emphasis on safety and rights in 2023 to an emphasis on removing barriers and establishing a single, minimally burdensome national framework from 2025. Meanwhile, states have legislated actively, and federal agencies apply existing laws to AI. This lesson explains federal policy, the rules governing the federal government's own use of AI, federal enforcement under existing law, the state law landscape and the federal effort to preempt it, and how organizations should navigate this framework.

Federal legislation and policy

Congress has held many hearings and considered numerous AI bills, but has enacted only targeted measures, such as the TAKE IT DOWN Act of 2025, which criminalizes publishing non-consensual intimate images, including AI-generated deepfakes, and requires platforms to remove them promptly on request (Lesson 8). Federal AI policy has been set mainly by executive action. Executive Order 14110 (October 2023) directed agencies to develop safety standards and protections, and required developers of the most powerful models to report safety test results. On taking office in January 2025, the new administration revoked it and issued Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence, followed by America's AI Action Plan (July 2025), which emphasized accelerating innovation, building AI infrastructure such as data centers and power, and international diplomacy and security. In December 2025, Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, sought a minimally burdensome national standard and directed action against state AI laws considered onerous (see below).

Government use of AI

The federal government's own use and purchase of AI is governed by Office of Management and Budget memoranda issued in April 2025 (M-25-21 on use and M-25-22 on acquisition), which replaced earlier 2024 guidance. They require agencies to appoint chief AI officers, maintain public inventories of AI use cases, and apply minimum risk management practices to "high-impact" AI, whose outputs serve as a principal basis for decisions with significant effects on rights or safety: pre-deployment testing, impact assessments, ongoing monitoring, human oversight, and the ability to stop use if risks cannot be managed. They also direct agencies to prefer American AI products and to protect government data in contracts. State and local governments have adopted their own policies for AI in public services.

Impact assessments of this kind are a model for any organization: a structured questionnaire about the decision, the people affected, the data and the degree of automation produces a score, mitigation measures reduce it, and the resulting level determines the required safeguards.

# An algorithmic impact assessment: questionnaire answers produce a raw risk score,
# mitigation measures reduce it, and the result maps to an impact level with required safeguards.
risk_answers = {  # question: points
    "decision affects rights, benefits or liberty": 8,
    "fully automated without human review": 6,
    "uses personal information": 4,
    "affects vulnerable groups": 5,
    "model is complex or opaque": 3,
    "decision hard to reverse": 4,
    "large number of people affected": 3,
}
mitigations = {"human review of all adverse decisions": 5, "documented testing for bias": 3,
               "plain-language explanation to affected people": 2, "recourse and appeal process": 3}
raw = sum(risk_answers.values())
max_raw = 40
mitigated = raw - sum(mitigations.values())
share = mitigated / max_raw
level = 1 + sum(share > t for t in (0.25, 0.50, 0.75))
safeguards = {1: "basic notice", 2: "notice, peer review, documentation",
              3: "plus human review of decisions, bias testing, explanation", 4: "plus independent review and senior approval"}
print(f"raw risk score {raw} of {max_raw}; after mitigation {mitigated} ({share:.0%})")
print(f"impact level {level}: {safeguards[level]}")
for drop in ["human review of all adverse decisions"]:
    m2 = raw - (sum(mitigations.values()) - mitigations[drop])
    print(f"without {drop}: score {m2} ({m2 / max_raw:.0%}), level {1 + sum(m2 / max_raw > t for t in (0.25, 0.50, 0.75))}")

raw risk score 33 of 40; after mitigation 20 (50%)
impact level 2: notice, peer review, documentation
without human review of all adverse decisions: score 25 (62%), level 3

The system starts with a high raw risk score because it affects rights and is fully automated, but documented mitigations, including human review of adverse decisions, bias testing, explanations and an appeal process, bring it down to level 2. Removing human review alone pushes it to level 3, triggering stronger requirements. Assessments like this encourage designers to build mitigations in, and make the reasoning behind deployment decisions visible to reviewers and the public.

Existing law applied to AI

Federal agencies have repeatedly stated that existing laws apply to AI, and enforcement continues under them, though priorities have shifted:

• Consumer protection: the Federal Trade Commission (FTC) acts against unfair or deceptive practices involving AI, including false claims about AI capabilities, undisclosed data use and harmful applications such as unreliable facial recognition (Lesson 8).
• Civil rights: anti-discrimination laws in employment, credit and housing apply to algorithmic decisions regardless of agency guidance, and private plaintiffs and states can enforce them (Lesson 5).
• Sector regulators: financial regulators apply model risk management guidance, the FDA regulates AI-enabled medical devices, and other agencies regulate AI within their domains (Lesson 9).
• Standards and evaluation: NIST develops voluntary frameworks such as the AI Risk Management Framework (Lesson 10), and its Center for AI Standards and Innovation works with developers on testing and standards.
• Voluntary commitments: leading AI companies made voluntary commitments to the White House in 2023 on safety testing and transparency, and many publish frontier safety frameworks.

Provincial and state laws

States have enacted many AI laws, which vary widely:

• Colorado enacted the first broad state AI act in 2024, aimed at algorithmic discrimination in consequential decisions, but repealed and replaced it in May 2026 with the narrower Automated Decision-Making Technology Act, effective January 1, 2027 subject to rulemaking, requiring developer documentation, consumer notices, post-decision disclosures and human review on request, enforced by the attorney general. California has enacted laws on frontier model transparency (SB 53), training data transparency for generative AI developers, AI content provenance, and, through its privacy agency, regulations on automated decision-making technology. Texas enacted the Texas Responsible AI Governance Act, effective January 1, 2026, prohibiting certain harmful uses and governing state agency AI. Illinois amended its Human Rights Act to address AI in employment decisions from 2026, New York City requires bias audits of automated employment decision tools, Utah requires disclosure of generative AI interactions in certain contexts, and many states have laws on deepfakes in elections and intimate imagery. New York's RAISE Act on frontier models takes effect in 2027.

The national framework question

Executive Order 14365 directed the Attorney General to establish an AI Litigation Task Force to challenge state AI laws, the Commerce Department to identify onerous state laws, and agencies to consider conditioning some federal grants (including broadband infrastructure funds) on states not enforcing conflicting AI laws, and called for federal legislation to preempt state laws. In July 2025, however, the Senate voted 99 to 1 to remove a proposed ten-year moratorium on state AI laws from a budget bill, and as of 2026 Congress had not enacted preemption. An executive order cannot itself preempt state law; state laws remain enforceable unless courts invalidate them or Congress acts. Organizations therefore must continue to comply with state laws while watching litigation and legislation, and some states have narrowed their laws, as Colorado did, partly in response to federal pressure.

Navigating an evolving framework

In an environment where rules are changing and sometimes contested, organizations can take several practical steps:

• Track developments systematically: assign responsibility for monitoring legislation, regulatory guidance, enforcement actions and court decisions in each jurisdiction of operation.
• Build on principles that persist across regimes: inventories, risk assessment, documentation, testing, human oversight and notice are required or encouraged almost everywhere, so investments in them remain useful as specific rules change.
• Comply with the strictest applicable rule where feasible, rather than maintaining many variants.
• Pay close attention to government customers and regulated sectors, where rules are often more detailed and enforced through procurement and supervision.
• Engage in consultations: governments in both countries regularly seek input on AI policy, and practitioners can contribute technical expertise.

Who regulates what: a practical map

For any AI deployment, it helps to identify the regulators whose existing mandates reach it. A useful exercise is to list, for each system, the regulator of personal information (a privacy commissioner or consumer protection agency), the regulator of discrimination (a human rights commission or civil rights enforcement agency), the regulator of advertising and consumer claims, any sector regulator (banking, insurance, health, transport, telecommunications, securities), and any government customer whose procurement rules apply. Each has its own powers, guidance and enforcement priorities, and their publications on AI are among the best indicators of what they will expect. Where several regulators share jurisdiction, as with a bank's AI hiring tool, the organization must satisfy all of them, and coordinated guidance from regulators is increasingly common.

Because AI policy is evolving quickly, organizations also benefit from tracking signals beyond formal law: government consultations and strategy documents, statements by ministers and agency heads, enforcement actions in neighboring jurisdictions, and standards development. These often show the direction of future requirements years before they become binding.