US AI Regulatory Hub

Verification required. Claims on this page about US law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.

This page maps US laws, guidance and standards that bear on AI to the wiki's controls.

1. Regional model

There are four layers:

1. Federal executive policy, and agency enforcement under existing statutes by the FTC, EEOC, CFPB, FDA and the banking regulators [Recalled].
2. State AI and privacy laws (California, Texas, Colorado, Illinois, New York and others).
3. Sector rules for health, finance and employment.
4. The NIST AI RMF, a voluntary standard that some state laws recognise.

Apply the law of the strictest state you operate in.

2. Instrument register

3. Categories, tiers and roles

4. Timeline

5. Mapping of common wiki controls

6. Where the wiki covers this

The topics raised on this page are covered by the following controls, test cases and templates.

7. Conflicts and cautions

• Colorado: SB 26-189 gives 1 January 2027, and older trackers show 30 June 2026. The newer report is more likely to be right, but confirm it.
• The approval and effective dates of the California CCPA regulations come from the CPPA page. The other details come from law-firm summaries and were not checked against the approved text.
• Federal preemption has been proposed and is not law. Do not drop state compliance on the strength of an executive order.
• Several effective dates come from tracker sites of mixed quality.
• Bank model risk guidance (US12): on 17 April 2026 the Federal Reserve, the OCC and the FDIC replaced SR 11-7 (OCC Bulletin 2011-12) with revised guidance, issued as Federal Reserve SR 26-2 and OCC Bulletin 2026-13. The revised guidance says generative AI and agentic AI models are novel and rapidly evolving and are not within its scope, and the agencies plan a request for information on model risk management and banks' use of AI. It is expected to be most relevant to banking organisations with over USD 30 billion in total assets. SR 11-7 is no longer current guidance, so its use is optional. A bank can still apply its practices (model inventory, independent validation, ongoing monitoring, governance) to generative and agentic AI as a voluntary benchmark until the agencies say what applies. Checked on 10 October 2026 against the OCC and Federal Reserve pages listed in the sources.

8. Verification checklist

• [ ] Colorado SB 26-189 text and rulemaking
• [ ] California SB 53, AB 2013 and AI Transparency Act text and dates
• [ ] Texas TRAIGA duties
• [ ] Illinois HB 3773 scope
• [ ] Approved text of the CCPA ADMT regulations (definitions, exceptions, thresholds)
• [ ] Text of Executive Orders 14365 and 14409
• [ ] Pending federal bills
• [ ] Current NYC Local Law 144 rules
• [ ] Sector guidance relevant to your clients
• [ ] Add the primary URL and retrieval date beside every confirmed row

9. Sources

All sources are secondary unless marked as a regulator or government page. Each fetched page was summarised by a tool and was not read line by line. A source marked "not read" appeared only as a title or snippet in search results, so do not treat it as support for any claim.

No primary legal text (statute, regulation or circular) was read for any row. Confirm each row against the primary source, and add its URL and retrieval date in the US Regulatory Crosswalk.