AI regulation in the United States — federal enforcement and state laws

Developer: technical documentation and update notices to deployers SB 26-189 (developer duties)from 2027-01-01

From January 1, 2027, developers of covered ADMT must provide deployers with technical documentation covering intended uses, categories of training data, known limitations and instructions for appropriate use and human review, and must notify deployers of material updates.

Evidence commonly relevant: Deployer documentation package; Update notification log

Deployer: point-of-interaction notice and post-adverse-outcome explanation SB 26-189 (deployer duties)from 2027-01-01

Deployers must give clear and conspicuous notice at the point of interaction with covered ADMT and, within 30 days after an adverse consequential decision, a plain-language description of the ADMT's role in the decision.

Evidence commonly relevant: Notice text and placement; Adverse-decision explanation template; 30-day SLA tracking

Consumer data access, correction and meaningful human review SB 26-189 (consumer rights)from 2027-01-01

Consumers may request the personal data used by covered ADMT and correction of factually incorrect data, and after an adverse consequential decision may request meaningful human review and reconsideration.

Evidence commonly relevant: Request-handling workflow; Human-review records

Record retention and AG enforcement SB 26-189 (records; enforcement)from 2027-01-01

Developers and deployers must retain records needed to demonstrate compliance for at least three years; violations are deceptive trade practices enforced exclusively by the Attorney General (no private right of action), with a 60-day notice-and-cure before actions filed before January 1, 2030.

Evidence commonly relevant: Compliance record set (3-year retention)

Substantiate AI capability, accuracy and performance claims 15 U.S.C. 45(a); Workado order (2025)

Claims about what an AI product can do, how accurate it is, or that it outperforms non-AI alternatives must be truthful and backed by competent and reliable evidence at the time they are made; 'AI-powered' earnings and business-opportunity claims are treated the same way.

Evidence commonly relevant: Claim substantiation file; Accuracy test evidence; Marketing review sign-off

Avoid deceptive AI output practices and inadequate disclosures 15 U.S.C. 45(a); proposed policy statement (July 2026, not final)

The FTC's proposed July 2026 policy statement says representing an AI system as accurate, objective or reliable while altering outputs toward undisclosed objectives may be deceptive; disclosures that shape expectations must be clear and conspicuous. This is a proposed statement, not a rule, but reflects current enforcement posture under Section 5.

Evidence commonly relevant: Output-steering/alignment disclosure review; Prominent AI disclosures

AI selection tools must not cause unjustified disparate impact 42 U.S.C. 2000e-2(k) (s. 703(k))

An employment practice, including an AI or algorithmic screening tool, that causes a disparate impact on a protected class is unlawful unless the employer shows it is job-related and consistent with business necessity (and no less discriminatory alternative was refused). Employers remain liable for vendor-supplied tools. Private litigation remains available even where federal enforcement priorities change.

Evidence commonly relevant: Adverse-impact analysis (e.g. four-fifths rule) per tool; Validation / job-relatedness study; Vendor due-diligence records

Prohibition on AI with discriminatory effect in employment decisions 775 ILCS 5/2-102(L)(1)from 2026-01-01

Employers may not use AI that has the effect of subjecting employees to discrimination on the basis of protected classes in recruitment, hiring, promotion, renewal, selection for training/apprenticeship, discharge, discipline, tenure or terms, privileges or conditions of employment, and may not use zip codes as a proxy for protected classes.

Evidence commonly relevant: Discriminatory-effect testing; Feature review excluding zip-code proxies

Notice to employees of AI use 775 ILCS 5/2-102(L)(2)from 2026-01-01

Employers must provide notice to employees that they are using AI for the employment purposes listed in the Act; the Department of Human Rights is to adopt rules on the circumstances, timing and means of notice.

Evidence commonly relevant: Notice text and delivery records

Annual independent bias audit and public summary NYC Admin. Code 20-871(a); 6 RCNY 5-300 et seq.from 2023-07-05

An AEDT may be used only if it has been subject to a bias audit (impact ratios by sex, race/ethnicity and intersectional categories) by an independent auditor within one year before use, and a summary of the results and distribution date is publicly posted.

Evidence commonly relevant: Independent bias audit report (< 12 months old); Public audit summary URL

Advance notice to candidates and employees NYC Admin. Code 20-871(b)from 2023-07-05

Candidates and employees residing in NYC must be notified at least 10 business days before an AEDT is used, including the job qualifications and characteristics assessed, and be told how to request an alternative selection process or accommodation and the data retention policy.

Evidence commonly relevant: Notice template and send log

ADMT pre-use notice, opt-out and access rights for significant decisions 11 CCR ss. 7200-7222from 2027-01-01

A business using ADMT to make a significant decision about a consumer must provide a pre-use notice explaining the purpose, how the ADMT works and the consumer's rights, offer the right to opt out (with limited exceptions such as human appeal), and provide access to information about how the ADMT was used for the consumer. Businesses already using ADMT must comply by January 1, 2027.

Evidence commonly relevant: Pre-use notice; Opt-out mechanism; Access-response template

Risk assessments for high-risk processing including ADMT 11 CCR ss. 7150-7157from 2026-01-01

Businesses must conduct and document a risk assessment before processing that presents significant risk to consumers' privacy (including selling/sharing personal information, processing sensitive personal information, using ADMT for significant decisions, and certain training of ADMT), weighing benefits against risks; assessments for processing begun before the effective date are due by December 31, 2027 and summary submissions to the Agency by April 1, 2028.

Evidence commonly relevant: Documented risk assessment per processing activity; Agency submission record

Annual cybersecurity audits (phased by revenue) 11 CCR ss. 7120-7124from 2028-04-01

Businesses whose processing presents significant security risk must complete annual independent cybersecurity audits; first reports are due April 1, 2028 (revenue >$100M in 2026), April 1, 2029 ($50M-$100M) or April 1, 2030 (<$50M).

Evidence commonly relevant: Independent cybersecurity audit report; Certification of completion

Disclose generative AI in consumer transactions when asked Utah Code 13-75-103(1)from 2025-05-07

A supplier using generative AI to interact with an individual in a consumer transaction must disclose that the individual is interacting with generative AI and not a human if the individual asks or clearly and unambiguously prompts whether AI is being used; a safe harbour applies if the AI clearly and conspicuously discloses at the outset and throughout the interaction that it is AI or an AI assistant (13-75-104).

Evidence commonly relevant: Chatbot disclosure configuration; Prompt-handling test showing correct 'are you a bot' response

Prominent disclosure in regulated-occupation high-risk interactions Utah Code 13-75-103(2)from 2025-05-07

Individuals providing regulated-occupation services must prominently disclose when a person is interacting with generative AI in the provision of regulated services where the use constitutes a high-risk AI interaction, and must still meet all requirements of the regulated occupation.

Evidence commonly relevant: Disclosure scripts (verbal at start of oral exchange, written before text exchange)

Prohibited AI uses: manipulation, discriminatory intent, unlawful sexual content Bus. & Com. Code ss. 552.052, 552.056, 552.057from 2026-01-01

No person may develop or deploy AI intended to incite self-harm, harm to others or crime, or with the intent to unlawfully discriminate against a protected class (disparate impact alone is insufficient to show intent), or with the sole intent of producing unlawful sexual material or deepfakes, or that impersonates a minor in sexual conversations.

Evidence commonly relevant: Use-case screening record; Content safety controls

Disclosure of AI interactions by government agencies and health-care providers Bus. & Com. Code s. 552.051from 2026-01-01

Governmental agencies offering consumer-facing AI must clearly disclose that the consumer is interacting with AI (even if obvious), without dark patterns; health-care providers using AI in treatment must disclose to the patient or representative no later than the first date of service (or as soon as reasonably possible in an emergency).

Evidence commonly relevant: Disclosure text; Patient notice records

AG enforcement, cure period and penalties Bus. & Com. Code ss. 552.101-552.105from 2026-01-01

The Attorney General has exclusive enforcement (no private right of action), must give written notice and a 60-day cure period, and may seek civil penalties of $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation and $2,000-$40,000 per day for continuing violations; a rebuttable presumption of reasonable care applies to compliant programs (including NIST AI RMF alignment).

Evidence commonly relevant: AI governance program documentation; Complaint-handling and cure records

Govern: AI risk governance, policies, roles and accountability AI RMF 1.0 Core - Governfrom 2023-01-26

Establish policies, processes, roles, accountability structures, workforce competence and culture for managing AI risk across the organization, including third-party and supply-chain risk.

Evidence commonly relevant: AI policy; RACI / governance charter; Inventory of AI systems

Map, Measure, Manage: context, risk measurement and treatment AI RMF 1.0 Core - Map, Measure, Managefrom 2023-01-26

Establish context and identify risks for each AI system (Map), assess, analyse and track risks using appropriate metrics including trustworthiness characteristics (Measure), and prioritize and act on risks with ongoing monitoring and incident response (Manage).

Evidence commonly relevant: Per-system risk profile; Evaluation metrics and test results; Risk treatment and monitoring plan

Apply generative-AI-specific risk actions NIST AI 600-1from 2024-07-26

Organizations should identify generative-AI-specific risks (e.g. confabulation, harmful content, information integrity, data privacy, intellectual property, value-chain/third-party risk) and implement the profile's suggested actions within their RMF-based program.

Evidence commonly relevant: GenAI risk assessment referencing AI 600-1; Content-safety and provenance controls