Last updated: September 30, 2026
Artificial intelligence is advancing faster than most traditional regulatory systems were designed to handle. As generative AI and increasingly capable AI systems spread across industries, governments around the world are trying to answer a fundamental question: How should AI be governed?
The European Union has taken a comprehensive legislative approach through the EU AI Act. The United States has developed a different model.
Rather than relying on a single comprehensive federal AI law, the U.S. AI governance landscape consists of multiple layers: federal laws, presidential executive orders and policies, federal agency oversight, technical and risk-management frameworks such as the NIST AI Risk Management Framework, and a growing body of state AI laws.
Understanding U.S. AI regulation therefore requires looking at the system as a whole.
This article provides an overview of that system and serves as a starting point for understanding how AI policy is developing in the United States.
How Is AI Regulated in the United States?
Unlike the European Union, which has adopted the EU AI Act as a comprehensive regulatory framework, the United States does not currently have a single comprehensive federal statute governing AI development and use across the economy. Instead, U.S. AI governance is shaped by a combination of federal laws, executive actions, agency authorities, technical standards and frameworks, and state laws.
At the federal level, Congress can enact legislation affecting AI, while the President shapes national AI policy through executive orders and other executive actions. Federal agencies apply their existing statutory authorities to AI-related activities within their jurisdictions.
At the same time, the National Institute of Standards and Technology (NIST) develops technical standards and risk-management frameworks, while individual states increasingly adopt their own AI legislation.
A simplified picture looks like this:
Congress
→ Federal legislation affecting AI
The White House
→ Executive orders and national AI policy
Federal agencies
→ Sector-specific regulation, enforcement and guidance
NIST
→ AI standards, measurement and risk-management frameworks
State governments
→ State-level AI laws and regulations
The result is a decentralized and evolving regulatory environment.
For businesses, this means that understanding U.S. AI regulation requires more than checking whether a single federal AI law applies.
Federal AI Policy: The Role of the White House
Presidential policy has become an important part of the U.S. AI governance landscape.
On January 23, 2025, President Donald Trump issued Executive Order 14179, “Removing Barriers to American Leadership in Artificial Intelligence.”
The order established a federal policy of sustaining and enhancing U.S. leadership in AI, with an emphasis on economic competitiveness and national security. It also directed the development of a national AI action plan.
In July 2025, the White House subsequently released America’s AI Action Plan.
The plan organizes federal AI policy around three major pillars:
Accelerating AI Innovation
The plan seeks to encourage AI development and adoption while addressing regulatory barriers that the administration considers unnecessarily restrictive.
Building American AI Infrastructure
AI development increasingly depends on data centers, advanced semiconductors, energy infrastructure and computing capacity.
The Action Plan therefore treats physical and digital infrastructure as a central component of U.S. AI strategy.
Leading in International Diplomacy and Security
AI policy is also closely connected to national security, export policy, international standards and technological competition.
The Action Plan includes more than 90 federal policy actions across its three pillars.
In December 2025, the administration issued another significant executive order, Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence.”
That order addressed the growing tension between state-level AI regulation and the administration’s goal of developing a more unified national AI policy framework.
Together, these developments show that U.S. AI policy is not only about regulating risks. It also involves innovation, infrastructure, economic competitiveness, national security and international technological leadership.
Federal Agencies and Existing Laws
Another important feature of the U.S. system is that AI does not exist outside existing law.
Even when there is no AI-specific federal statute governing a particular activity, companies using AI may still be subject to existing laws covering areas such as consumer protection, competition, employment, privacy, financial services and other regulated activities.
The Federal Trade Commission (FTC), for example, has continued to examine how its existing authority under the Federal Trade Commission Act applies to companies marketing AI systems.
In July 2026, the FTC issued a proposed policy statement addressing how Section 5 of the Federal Trade Commission Act’s prohibition on deceptive acts or practices may apply to companies marketing AI systems, including situations in which AI outputs are allegedly distorted in ways that conflict with consumers’ reasonable expectations. As of September 2026, this remains a proposed policy statement rather than a final rule.
This illustrates a fundamental feature of the U.S. approach:
AI-specific rules and existing laws can operate at the same time.
For businesses, compliance therefore cannot be reduced to simply searching for laws containing the words “artificial intelligence.”
The relevant question is often whether an existing legal obligation applies when AI is used to perform a particular function.
What Is the NIST AI Risk Management Framework?
One of the most influential components of the U.S. AI governance ecosystem is the NIST Artificial Intelligence Risk Management Framework (AI RMF).
NIST released AI RMF 1.0 in January 2023.
Unlike a statute or regulation, the AI RMF is designed for voluntary use. Its purpose is to help organizations incorporate trustworthiness considerations into the design, development, deployment, use and evaluation of AI systems.
The framework organizes AI risk-management activities around four core functions:
GOVERN
Establish organizational policies, responsibilities, accountability structures and processes for managing AI risk.
MAP
Understand the context in which an AI system operates and identify relevant risks and potential impacts.
MEASURE
Analyze, assess and monitor identified AI risks using appropriate methods and metrics.
MANAGE
Prioritize and respond to AI risks based on the information gathered through governance, mapping and measurement.
These four functions — GOVERN, MAP, MEASURE and MANAGE — provide organizations with a structured way to think about AI risk throughout the AI lifecycle.
NIST describes the framework as voluntary, non-sector-specific and use-case agnostic.
The framework is also a living document. As of September 2026, NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan.
NIST’s Generative AI Profile
The rapid expansion of generative AI created risks and governance challenges that required more specific guidance.
In July 2024, NIST released the Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1).
The profile builds on the AI RMF and helps organizations identify risks that are particularly relevant to generative AI and consider actions for managing them.
This is important because AI governance is increasingly moving beyond broad principles.
Organizations are beginning to need practical processes for questions such as:
- How should AI risks be identified?
- How should models and AI systems be evaluated?
- Who is responsible for AI governance?
- How should incidents be documented and managed?
- What information should developers, deployers and users receive?
- How should AI risks be monitored throughout a system’s lifecycle?
These questions increasingly connect technical AI development with organizational governance and compliance.
Why State AI Laws Matter
State governments are another major source of AI regulation in the United States.
As AI technology has expanded, states have introduced legislation addressing issues including automated decision-making, transparency, discrimination, deepfakes, consumer protection and frontier AI safety.
California provides a particularly important example.
In 2025, California enacted SB 53, the Transparency in Frontier Artificial Intelligence Act, establishing transparency and safety-related requirements for certain frontier AI developers.
Among other provisions, the law requires covered large frontier developers to publish frameworks describing how they approach significant risks and to report specified critical safety incidents.
California continued expanding its AI oversight framework in 2026. Among other developments, the state enacted SB 813 to establish a framework for independent AI verification organizations and AB 1405 to create a registry and standards for AI auditors.
This illustrates why companies operating across the United States may need to monitor not only federal developments but also state-level legislation.
Federal vs. State AI Regulation
The growth of state AI legislation has also created an important policy debate.
If individual states establish significantly different requirements, companies operating nationwide may face a complex compliance environment.
At the same time, states have historically played an important role in areas such as consumer protection, privacy and other areas relevant to AI.
This creates a central question for U.S. AI governance:
How should regulatory authority be divided between the federal government and the states?
Executive Order 14365, issued in December 2025, reflects the federal administration’s effort to develop a more unified national AI policy framework and address state AI laws that it views as inconsistent with that framework.
The relationship between federal and state AI policy is therefore likely to remain an important area to watch.
U.S. AI Regulation vs. the EU AI Act
The U.S. and European approaches to AI governance can be broadly contrasted as follows:
| Area | United States | European Union |
|---|---|---|
| Overall structure | Decentralized and multi-layered | Comprehensive legislation centered on the EU AI Act |
| Federal/EU-level policy | Laws, executive actions and agency authorities | EU AI Act and related EU legislation |
| Technical risk management | Important role for NIST and standards | AI Act combined with European and international standards |
| Regional regulation | Significant state-level legislation | EU-wide framework with implementation and enforcement involving EU institutions and Member States |
| Regulatory approach | Mix of existing law, sectoral oversight, standards and AI-specific rules | Risk-based statutory framework |
However, describing the United States simply as “lightly regulated” and the EU as “heavily regulated” can be misleading.
AI systems operating in the United States can still be subject to existing federal and state laws, sector-specific requirements and enforcement by government agencies.
The difference is largely one of regulatory architecture.
What U.S. AI Regulation Means for Businesses
For AI developers and companies integrating AI into their products, regulation is increasingly becoming part of the broader technology-management lifecycle.
Organizations may need to consider issues including:
AI governance → risk assessment → data governance → model evaluation → cybersecurity → transparency → contracting → accountability
This has an important implication for the software industry.
AI governance is no longer only a legal or ethics issue. It increasingly intersects with software development, testing, quality assurance, cybersecurity, procurement, contracts and corporate risk management.
As AI becomes embedded in ordinary software products and services, the boundary between traditional software governance and AI governance is likely to become increasingly difficult to separate.
Understanding this intersection will be particularly important for software companies adapting their development and business processes to AI.
What Comes Next for U.S. AI Regulation?
The U.S. AI regulatory landscape remains highly dynamic.
Several developments deserve continued attention:
- implementation of America’s AI Action Plan;
- revision of the NIST AI Risk Management Framework;
- federal agency approaches to AI;
- the evolving relationship between federal and state AI regulation;
- state legislation addressing AI safety, transparency and automated decision-making;
- AI standards and evaluation methods; and
- the integration of AI governance into software development, procurement and contracting.
Rather than viewing AI regulation as a fixed set of rules, it may be more useful to understand it as an evolving system connecting law, public policy, technical standards, risk management and business practices.
That is the approach this blog will take.
Future articles will examine individual parts of this system in greater detail, beginning with the NIST AI Risk Management Framework, America’s AI Action Plan, major state AI laws, and the implications of AI regulation for software companies.
This article is for informational purposes only and does not constitute legal advice. AI laws and policies are developing rapidly, and readers should consult current official sources for the latest requirements.
Official Sources
This article is based primarily on official U.S. government sources. Because AI laws and policies are evolving rapidly, readers are encouraged to check the original sources for the most current information.
- The White House — Executive Order 14179: Removing Barriers to American Leadership in Artificial Intelligence
January 23, 2025. Establishes the administration’s federal AI policy direction, emphasizing U.S. AI leadership, economic competitiveness, and national security. - The White House — America’s AI Action Plan
July 23, 2025. The plan outlines more than 90 federal policy actions organized around three pillars: accelerating AI innovation, building American AI infrastructure, and leading in international AI diplomacy and security. - The White House — Executive Order 14365: Ensuring a National Policy Framework for Artificial Intelligence
December 11, 2025. Addresses the relationship between state AI regulation and the administration’s goal of establishing a national AI policy framework. - National Institute of Standards and Technology (NIST) — Artificial Intelligence Risk Management Framework (AI RMF 1.0)
January 2023. A voluntary framework designed to help organizations identify, assess, and manage risks associated with artificial intelligence. - NIST — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)
July 26, 2024. A companion resource to the AI RMF focused specifically on risks associated with generative AI. - Federal Trade Commission (FTC) — Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems
Proposed in 2026. Discusses how Section 5 of the Federal Trade Commission Act may apply to deceptive practices involving the marketing of AI systems.
This article is for informational purposes only and does not constitute legal advice. AI laws, regulations, and government policies are developing rapidly. Always consult current official sources when evaluating specific legal or compliance requirements