United States (federal): AI and data protection regulation
The US has no federal AI law: your obligations depend on the states where your customers and employees are.
GROU LLC · built on AI Business Core, by Vreinn · · How we verify sources
Summary
AI obligations in the US come from state laws and from general federal laws that also apply to AI, such as the FTC's rules against deceptive advertising and the employment and lending discrimination laws. California has the most requirements: risk assessments for new processing since 2026, automated-decision notices and rights from 2027, and employment rules in force since 2025. Illinois, Texas, Utah, New York State (companion chatbots) and New York City already require specific notices, audits or prohibitions; Colorado, Washington and Nebraska start in 2027. A federal executive order seeks to limit state laws, but they remain enforceable.
- Binding AI law today?
- Yes
- Obligations verified in the official source
- 57 %
- Information as of
Authorities
- Federal Trade Commission (FTC)
Deceptive advertising, unfair practices and children's privacy (COPPA)
- Equal Employment Opportunity Commission (EEOC)
Employment discrimination
- Consumer Financial Protection Bureau (CFPB)
Consumer credit and adverse action notices
- California Privacy Protection Agency (CalPrivacy)
CCPA, automated decisionmaking and risk assessments
- California Civil Rights Department (CRD)
AI in employment (FEHA)
- NYC Department of Consumer and Worker Protection (DCWP)
Automated employment decision tools (Local Law 144)
- Illinois Department of Human Rights (IDHR)
AI in employment (HB 3773)
- Texas Attorney General
Exclusive enforcement of TRAIGA
- Utah Division of Consumer Protection
AI Policy Act and mental health chatbots
- Colorado Attorney General
Enforcement and rulemaking for SB 26-189
- Washington Attorney General
Consumer Protection Act and companion chatbots
- Nebraska Attorney General
Conversational AI Safety Act
Rules covered
Federal
| Rules | Status | Obligations and dates |
|---|---|---|
| FTC Act Section 5: unfair or deceptive practices FTC Act §5 | In force | 2 |
| Title VII of the Civil Rights Act and the Americans with Disabilities Act (ADA) Title VII and ADA | In force | 2 |
| Equal Credit Opportunity Act and Regulation B ECOA / Reg B | In force | 2 |
| Fair Credit Reporting Act (FCRA) FCRA | In force | 1 |
| Children's Online Privacy Protection Rule (COPPA), as amended COPPA Rule 2025 | In force | 3 |
| Executive Order 14365 on a national AI policy framework Executive order on state AI laws | Regulator guidance | 1 |
| DHS order excluding DeepSeek from federal civilian procurement and systems DHS FASCSA order on DeepSeek | In force | 1 |
California
| Rules | Status | Obligations and dates |
|---|---|---|
| CCPA regulations on automated decisionmaking technology (ADMT) and risk assessments CCPA ADMT and risk assessments | In force | 5 |
| California employment regulations on automated-decision systems (FEHA) FEHA automated-decision systems | In force | 3 |
| California SB 243 on companion chatbots California SB 243 | In force | 4 |
New York (incl. NYC)
| Rules | Status | Obligations and dates |
|---|---|---|
| New York AI Companion Models Law (General Business Law Article 47) New York AI companions | In force | 2 |
| New York City Local Law 144 on automated employment decision tools (AEDT) NYC Local Law 144 | In force | 3 |
| New York ban on DeepSeek on government devices and networks New York: DeepSeek on state devices | In force | 1 |
Illinois
| Rules | Status | Obligations and dates |
|---|---|---|
| Illinois HB 3773 on AI in employment Illinois HB 3773 | In force | 2 |
| Illinois Artificial Intelligence Video Interview Act Illinois AIVIA | In force | 1 |
| Illinois Biometric Information Privacy Act (BIPA) Illinois BIPA | In force | 2 |
Texas
| Rules | Status | Obligations and dates |
|---|---|---|
| Texas Responsible Artificial Intelligence Governance Act (TRAIGA) Texas TRAIGA | In force | 5 |
| Texas ban on Chinese AI apps, including DeepSeek, on state devices Texas: DeepSeek on state devices | In force | 1 |
Utah
| Rules | Status | Obligations and dates |
|---|---|---|
| Utah Artificial Intelligence Policy Act Utah AI Policy Act | In force | 2 |
| Utah HB 452 on mental health chatbots Utah HB 452 | In force | 2 |
Colorado
| Rules | Status | Obligations and dates |
|---|---|---|
| Colorado SB 26-189 on automated decision-making technology Colorado SB 26-189 | Adopted, applies later | 5 |
| Colorado AI Act (SB 24-205) Colorado SB 24-205 | Lapsed or superseded | 0 |
Washington
| Rules | Status | Obligations and dates |
|---|---|---|
| Washington ESHB 2225 on AI companion chatbots Washington HB 2225 | Adopted, applies later | 3 |
Nebraska
| Rules | Status | Obligations and dates |
|---|---|---|
| Nebraska Conversational Artificial Intelligence Safety Act (LB 525) Nebraska LB 525 | Adopted, applies later | 3 |
Key dates
- ADMT obligations for existing uses · CCPA ADMT and risk assessments
- Obligations begin and deadline for Attorney General rules · Colorado SB 26-189
- Effective date · Washington HB 2225
- First annual report to the Office of Suicide Prevention · California SB 243
- Scheduled sunset · Utah AI Policy Act
- Obligations begin · Nebraska LB 525
- Risk assessments for processing that began before 2026 · CCPA ADMT and risk assessments
- Submission of 2026-2027 assessments to the agency with signed attestation · CCPA ADMT and risk assessments
- Mandatory cure period ends · Colorado SB 26-189
Show past dates (42)
- Order notice published in the Federal Register · DHS FASCSA order on DeepSeek
- CFPB rule removing disparate impact under ECOA takes effect · ECOA / Reg B
- IDHR withdraws its proposed notice rules · Illinois HB 3773
- Replaced by SB 26-189 · Colorado SB 24-205
- Signed · Colorado SB 26-189
- Court blocks enforcement (per secondary sources) · Colorado SB 24-205
- General compliance date · COPPA Rule 2025
- CFPB publishes disparate-impact rule (91 FR 21620) · ECOA / Reg B
- Signed · Nebraska LB 525
- Signed · Washington HB 2225
- White House publishes legislative recommendations · Executive order on state AI laws
- Effective date · Texas TRAIGA
- Effective date · Illinois HB 3773
- Effective date · California SB 243
- Effective; risk assessments for new processing · CCPA ADMT and risk assessments
- FTC sets aside its Rytr order · FTC Act §5
- Executive order signed · Executive order on state AI laws
- State Comptroller audit of enforcement · NYC Local Law 144
- Effective date · New York AI companions
- Signed · California SB 243
- Effective date · FEHA automated-decision systems
- Approved by the Office of Administrative Law · CCPA ADMT and risk assessments
- Approved by the Office of Administrative Law · FEHA automated-decision systems
- Effective date · COPPA Rule 2025
- Signed · Texas TRAIGA
- CFPB withdraws Circulars 2022-03 and 2023-03 · ECOA / Reg B
- Budget bill signed · New York AI companions
- Effective date · Utah HB 452
- 2025 amendments take effect · Utah AI Policy Act
- Amended rule published · COPPA Rule 2025
- Ban announced · New York: DeepSeek on state devices
- Ban announced · Texas: DeepSeek on state devices
- EEOC withdraws its AI technical assistance · Title VII and ADA
- Operation AI Comply launched · FTC Act §5
- Signed · Illinois HB 3773
- Amendment limiting accrual of damages · Illinois BIPA
- Signed · Colorado SB 24-205
- Original act takes effect · Utah AI Policy Act
- Rite Aid facial recognition order · FTC Act §5
- DCWP enforcement begins · NYC Local Law 144
- Effective date · Illinois AIVIA
- Effective date · Illinois BIPA
Use cases with their own obligations in United States (federal)
- Customer service chatbot or assistant
- Companion or social chatbot
- AI agents that take actions
- Voice or likeness cloning
- Hiring, evaluation or termination of staff
- Algorithmic worker management (shifts, tasks, pay)
- Worker monitoring
- Credit or creditworthiness scoring
- Insurance pricing or underwriting
- Diagnosis, triage or clinical support
- Admissions, grading or exam proctoring
- Biometrics, facial or emotion recognition
- Selling software or services that include AI
- Other automated decisions with significant effects (housing, pricing, access to services)
Regulatory change alerts by country
Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.
- Changes to the rules of the countries you pick, when we add them to the registry.
- New application dates.
- No more than one email a week. Unsubscribe at any time.
It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.