Correction (28 October 2026): An earlier version described the Colorado AI Act (SB 24-205) as taking effect in 2026. Colorado repealed and re-enacted it through SB 26-189, signed by the Governor on 14 May 2026 (Session Laws, chapter 131), as rules on automated decision-making technology used in consequential decisions; developer and deployer duties apply from 1 January 2027. The Colorado section, the timeline and the source list have been updated.

The United States has no single, comprehensive federal law governing artificial intelligence. Instead, AI is regulated through three overlapping layers: a light-touch federal executive posture, a fast-growing patchwork of state statutes, and voluntary risk-management frameworks that increasingly set the market standard.

0Comprehensive federal AI statutes
1stColorado — first comprehensive state AI law
Dozensof state AI bills introduced each session
VoluntaryNIST AI Risk Management Framework

Three layers of US AI governance

Federal executive & sectoral

Executive orders set direction; existing agencies (FTC, EEOC, FDA, financial regulators) apply current law to AI within their sectors.

State legislation

States are moving faster than Congress, with measures ranging from comprehensive rules to narrow bans on specific uses such as hiring, biometrics and deepfakes.

Voluntary frameworks

The NIST AI RMF and sector guidance are non-binding, but procurement, insurers and courts increasingly treat them as the standard of care.

The federal layer: light-touch and shifting

Federal AI policy has moved primarily through executive action rather than legislation, and its direction changes with each administration. The 2023 executive order on safe, secure and trustworthy AI was rescinded in January 2025 and replaced with a policy emphasising innovation and reduced regulatory friction. What stays constant is sectoral enforcement: agencies apply existing consumer-protection, anti-discrimination and product-safety law to AI systems without waiting for new statutes.

The state patchwork

With Congress gridlocked, the states now drive US AI law, and the result is a compliance map that varies by jurisdiction and by use case.

Colorado (SB 24-205, re-enacted by SB 26-189)

SB 24-205, enacted in 2024 as the first comprehensive state AI law, imposed duties of care on developers and deployers of high-risk AI to prevent algorithmic discrimination. SB 26-189, signed on 14 May 2026, repealed and re-enacted it as rules on automated decision-making technology used in consequential decisions about education, employment, housing, financial and lending services, insurance, health care and essential government services. From 1 January 2027, developers must give deployers technical documentation, and deployers must notify consumers, explain the technology's role in adverse decisions and offer human review on request. The Attorney General enforces the rules under the Colorado Consumer Protection Act; the act creates no new private right of action.

California

A cluster of laws on generative-AI transparency, training-data disclosure, deepfakes and automated decision-making.

Illinois (BIPA)

The strict Biometric Information Privacy Act drives much of the litigation around facial recognition and biometric AI.

New York City (LL 144)

Bias audits are required for automated employment decision tools used to screen candidates.

NIST AI Risk Management Framework

The NIST AI RMF is voluntary, but it has become the common vocabulary for AI governance in the US. It organises trustworthy-AI practice into four functions:

Govern

Build a culture and accountability structure for AI risk across the organisation.

Map

Establish the context and identify the risks tied to each AI system and its use.

Measure

Analyse, assess and track risks with quantitative and qualitative methods.

Manage

Prioritise and act on risks, with monitoring and response across the lifecycle.

How it evolved

2023 — NIST releases the AI Risk Management Framework 1.0.
2023 — Federal executive order on safe, secure and trustworthy AI.
2024 — Colorado enacts the first comprehensive state AI law (SB 24-205).
2025 — The 2023 order is rescinded; the federal posture shifts toward innovation.
2026 — Colorado repeals and re-enacts SB 24-205 as rules on automated decision-making technology (SB 26-189, signed on 14 May); they apply from 1 January 2027. More states follow with their own bills.

What it means for companies

Companies that build or deploy AI reaching US users cannot rely on a single national rulebook. The sensible course is to map exposure state by state and use case by use case, adopt the NIST AI RMF as a defensible baseline and document risk decisions, since sectoral regulators are already applying existing law to AI.

📄