iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
U.S. businesses do not have one universal federal AI rulebook. Requirements depend on existing federal laws, the industry and decisions involved, and the state or city where a business operates or where affected people live or work. A company may need to assess an AI use under several layers of law at once; Colorado, California, and New York City offer examples of rules that apply to particular activities, not to every business.
Start with the federal baseline
The Congressional Research Service (CRS) has reported that no federal law creating broad regulatory authority over AI development or use, or a general prohibition on AI, had been enacted as of its overview. That is a dated policy assessment, not a live inventory of later federal enactments. The practical point is that businesses should not assume either that there is one comprehensive federal AI statute or that AI use sits outside the law.
Existing legal duties can apply when AI is part of an ordinary business activity. Consumer-facing claims, hiring and other employment decisions, civil-rights obligations, privacy practices, financial services, health care, and other regulated activities may each raise different requirements. The relevant question is what the business does with the system, not simply whether it uses AI.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFederal proposals are not final rules
As of July 1, 2026, the Federal Trade Commission had published a proposed policy statement concerning suppression of accuracy in AI systems. The agency’s page identifies it as proposed; it should not be described as a final regulation or a general-purpose AI compliance mandate.
State and local rules can add use-specific duties
State and local requirements vary, and the examples below are not a complete state-by-state survey. Applicability can depend on a business’s role, the people affected, the purpose of the system, and the relevant statute’s definitions and scope.
| Jurisdiction or layer | What the cited source describes | How to read it |
|---|---|---|
| Colorado | SB 24-205 addresses developers and deployers of high-risk AI systems and includes reasonable-care duties to protect consumers from known or reasonably foreseeable algorithmic-discrimination risks. SB 25B-004 extended the effective date of SB 24-205 requirements to June 30, 2026. | Businesses with relevant Colorado activity should check the enacted text, current rules, and enforcement materials to determine scope and obligations. |
| California | The California Privacy Protection Agency says its CCPA rulemaking covers automated decisionmaking technology (ADMT), privacy risk assessments, cybersecurity audits, and other changes. The regulations were approved by the Office of Administrative Law and became effective January 1, 2026. | Coverage depends on whether the business and its processing meet applicable CCPA criteria and on the detailed regulatory definitions. |
| New York City employment | An EEOC-hosted 2023 testimony describes Local Law 144 as covering specified automated employment decision tools and requiring an independent bias audit, public posting of audit summaries, and advance notice to applicants. | The testimony is historical. Employers should confirm the current local law and implementing rules before relying on its description or dates. |
| Other federal and state laws | General consumer-protection, employment, civil-rights, privacy, and sector-specific requirements may apply to activities involving AI. | Which duties apply depends on the conduct, industry, data, decision, and location. |
Colorado: high-risk systems
Colorado’s Consumer Protections for Artificial Intelligence law, SB 24-205, sets out requirements for developers and deployers of high-risk AI systems. The General Assembly’s summary describes reasonable-care duties related to known or reasonably foreseeable algorithmic-discrimination risks. Because the effective date was extended to June 30, 2026, businesses assessing activity after that date should verify the current statutory text, implementing rules, and enforcement materials rather than infer detailed obligations from a summary.
Rank #2
California: privacy and automated decisionmaking
California’s CCPA regulations concerning ADMT and related topics became effective January 1, 2026, according to the California Privacy Protection Agency. The rulemaking’s subject matter does not mean every California business or every AI tool is covered: applicable business and processing criteria, along with the regulations’ definitions, determine scope.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →CRS also recorded California’s 2024 AI-related enactments, including SB 942 on digital marking of AI-generated outputs and AB 2013 on training-data transparency. That is a historical record of enactments, not a statement of each law’s current implementation, scope, or effective dates. Check the current statutory text before treating either as a present obligation for a particular product or business.
Employment decisions: federal duties and local examples
Using AI to assist with hiring, screening, performance review, or other employment decisions does not by itself remove relevant federal or state employment-discrimination requirements. New York City Local Law 144 is a narrower local example involving specified automated employment decision tools. The details in the EEOC-hosted 2023 testimony should be checked against current local law and rules before a covered employer relies on them.
Separate binding requirements from guidance
NIST AI Risk Management Framework
NIST describes its AI Risk Management Framework (AI RMF) as intended for voluntary use to help organizations incorporate trustworthiness into AI design, development, use, and evaluation. NIST says AI RMF 1.0 is being revised and lists a generative AI profile and a 2026 concept note for a critical-infrastructure profile. The framework can help structure governance, but it is not a generally binding private-sector regulation or a substitute for determining legal obligations.
Legislative activity is not the same as law in force
CRS reported that, as of late April 2025, at least 48 states and Puerto Rico had introduced more than 1,000 AI-related bills during the 2025 legislative season, citing the National Conference of State Legislatures. Those figures measure legislative activity, not enacted laws or the number of requirements applicable to businesses.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to scope an AI use for your business
Assess each system and use separately. A single business may develop one tool, deploy another, and use a third in a consequential decision; their legal exposure may differ.
Best Value
- Map geography. Record where the business operates and where affected consumers, workers, or other individuals are located. Check state and local rules for each relevant location.
- Identify your role. Determine whether the business develops, deploys, or provides the system, and whether it also acts as an employer or regulated service provider.
- Describe the use and decision. Specify whether AI materially influences hiring, credit, housing, education, health care, insurance, or another significant service or decision.
- Inventory the data and processing. Identify personal or sensitive information, profiling, and other processing that may bring privacy requirements into scope.
- Match the use to required controls. For potentially relevant laws, check whether they call for assessments, notices, disclosures, audits, human review, recordkeeping, or individual rights.
- Confirm status and timing. Distinguish enacted and effective requirements from proposed policies and voluntary guidance. Verify current statutes, regulations, and enforcement materials for the specific use.
These are practical scoping prompts, not a complete legal checklist. A national overview cannot determine which rules apply to a particular company without its jurisdictions, sector, data practices, role, and use cases.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
