What counts as AI governance law
AI governance is how a company decides which artificial intelligence it uses, who owns the risk, and what it checks before and after a tool goes live. AI governance law is the legislation and the regulations that make some of those decisions for you: what you must disclose, what you may not automate, and what records you must keep.
Two kinds of rule sit under that heading. Laws and regulations are binding: a state statute, an agency rule, the EU AI Act. Standards are voluntary: the NIST AI Risk Management Framework and ISO/IEC 42001. A standard becomes binding only when a contract or a regulator points to it, which is happening more often in procurement than in law.
For a small company the practical question is not “which AI law applies?” but “which of our uses of AI touch a regulated decision?” Hiring, pay, credit, housing, insurance and patient care are the uses most of the rules below are written about.
Federal rules that apply today
There is no general federal AI statute that covers every business. The federal rules that bite come from agencies applying the laws they already enforce:
- The FTC and the SEC on AI claims. Both have brought “AI washing” cases against companies that overstated what their AI does; the FTC ran Operation AI Comply, and AI is a named SEC examination priority for 2026. The rule for your marketing is simple: say only what your AI actually does.
- HHS on patient care. Under the Section 1557 rule, healthcare providers and plans that receive federal funds must identify and reduce the risk of discrimination from AI and algorithmic tools they use in patient care. Compliance has been required since 1 May 2025.
- Sector regulators. If you are a New York licensed financial institution, NYDFS industry letters (October 2024 and May 2026) explain how AI-enabled social engineering, deepfakes and AI-driven attacks fall under 23 NYCRR Part 500.
What states have AI regulations
These are the state rules a 5 to 500 person company is most likely to meet, with the dates as our AI governance team tracks them in October 2026. State AI legislation moves fast: check the current text before you rely on any row.
| Law | Who it covers | What it asks | Status |
|---|---|---|---|
| Texas Responsible AI Governance Act (HB 149) | Any business deploying AI in Texas | No AI built or used to discriminate, manipulate people toward self-harm or crime, or produce unlawful deepfakes; healthcare providers must tell patients when AI is used. Attorney general enforcement with a 60-day cure period. | In force since 1 January 2026 |
| Illinois Human Rights Act amendment (HB 3773) | Employers using AI in hiring, promotion, discipline or pay | No AI that produces discriminatory effects in employment decisions, no zip codes as a proxy, and notice to applicants and employees. | In force since 1 January 2026 |
| California FEHA regulations on automated-decision systems | California employers and their vendors | Employers are liable for the AI tools they use in employment decisions and keep automated-decision records for four years. | In force since 1 October 2025 |
| California CCPA regulations on ADMT, risk assessments and cybersecurity audits | Businesses subject to the CCPA | Notice and opt-out for automated decision-making technology, documented risk assessments for higher-risk processing, and phased cybersecurity audits from 2028. | Effective 1 January 2026; ADMT obligations from 1 January 2027 |
| Colorado SB 26-189 | Developers and deployers of automated decision-making technology in Colorado | A narrower transparency and disclosure framework that replaces the 2024 Colorado AI Act, which was enjoined in April 2026. | Effective 1 January 2027 |
The pattern across them: employment decisions and consumer-facing automated decisions are regulated first, disclosure is the most common duty, and enforcement sits with the attorney general or the civil rights agency. Screen résumés or set pay with AI, and hire in Illinois or California? Two of the five rows already apply to you.
The EU AI Act, if you sell into Europe
The EU AI Act reaches US companies that place AI systems on the EU market or whose AI output is used in the EU. It sorts AI by risk: prohibited practices, high-risk systems, systems with transparency duties, and everything else. It also assigns duties by role, so a company that builds an AI system (a provider) carries more than one that uses it (a deployer).
Where it stands as of October 2026:
- Prohibited practices apply now.
- General-purpose AI model duties have applied since 2 August 2025.
- High-risk obligations were deferred to 2 December 2027 by the Digital Omnibus (Regulation 2026/1744), which moved the Annex III deadlines.
- Transparency duties, such as telling people they are talking to an AI, keep their original dates.
A 50-person US company that uses ChatGPT internally and sells nothing AI-powered into Europe has little to do here. One that sells an AI feature to EU customers should know its role and risk tier for each system now, while the high-risk deadline is still a year away.
AI governance standards buyers ask for
Neither of these is law. Both show up in security questionnaires, enterprise contracts and auditors’ requests, and both give you a structure the laws above will recognize.
| Aspect | NIST AI RMF 1.0 | ISO/IEC 42001:2023 |
|---|---|---|
| Published | January 2023, by NIST | December 2023, by ISO and IEC |
| Structure | Four functions (Govern, Map, Measure, Manage), 19 categories, 72 subcategories | Clauses 4 to 10 for the management system, 38 controls in Annex A |
| Certifiable? | No | Yes, by an accredited certification body |
| Best for | Showing US buyers how you manage AI risk | A certificate an enterprise or EU customer can check |
Work done for one carries most of the way to the other. Our guide to the NIST AI RMF maps the four functions to ISO 42001 clause by clause, our ISO 42001 page covers the certification, and NIST AI RMF compliance sets out what we deliver against the framework. If you need to write the program down first, start with how to build an AI governance framework.
A one-page AI compliance checklist
- Inventory the AI you use, including the tools staff signed up for with personal accounts. Firewall and proxy logs show more than a survey does.
- Write an acceptable-use policy and train people on it: which tools are approved, what data may go into them, who approves a new one.
- Classify your data so “no regulated data in public AI tools” is a rule people can follow.
- Name an owner for AI risk, with decision rights and a review date.
- Flag regulated decisions. Any AI in hiring, pay, promotion, credit, insurance or patient care gets reviewed against the state rows above.
- Check your disclosures. Texas healthcare providers must tell patients; EU transparency duties apply to chatbots; California notice duties arrive in 2027.
- Review your AI marketing claims against what the product does, before the FTC or a customer does.
- Review AI vendors the way you review any vendor that touches your data. Our vendor risk questionnaire is a starting point.
- Keep records: risk assessments, decisions, test results and the inventory, dated. Most of the laws above ask for documentation first.
New to the vocabulary? Every term on this page is in our compliance glossary.
With AccuSights: the AI Governance Framework Assessment scores you against the NIST AI RMF and ISO/IEC 42001 Annex A, builds a shadow-AI inventory from 30, 60 or 90 days of your firewall and proxy logs, delivers the policy pack, and ends with a gap register and a 90-day plan, for a fixed fee scoped in 30 minutes.