United States

Federal

The United States does not yet have a comprehensive federal AI law. Instead, AI is governed through existing laws and a growing patchwork of state regulations. However, this could change with new federal action, such as AI-related executive orders issued under the Trump Administration, which may signal movement toward a more unified national approach.

Take it Down Act

Effective May 19, 2025, this U.S. federal law aimed at combating nonconsensual intimate imagery (NCII), including AI-generated deepfake sexual images shared online. It criminalizes knowingly publishing or threatening to publish nonconsensual intimate images. It requires certain websites and apps to remove reported nonconsensual intimate images quickly (within 48 hours) after receiving a valid request from the victim. The law applies to individuals who post or threaten to post the content and online platforms that host user-generated content.

FTC Section 5

The law bans unfair or deceptive practices in business, and the FTC says AI is no exception.

Fair Credit Reporting Act

The law applies to the following main groups of entities that handle or use consumer credit information: consumer Reporting Agencies (CRAs); entities that provide consumer data to credit reporting agencies; organizations that obtain and use consumer reports to make decisions about individuals; and individual consumers.

§1681b. Limits the use of consumer report data in AI systems

§1681e(b). Requires accuracy of AI-generated reports

§1681m. Requires explanation when AI contributes to adverse decisions

§1681g / §1681i. Consumers can access and dispute AI-related data

§1681a(d). Defines consumer reports that AI systems may produce

Equal Credit Opportunity Act

The law applies to creditors of any person or organization that regularly extends, renews, or continues credit, and protects credit applicants from discrimination based on protected characteristics.

§1691(a) Anti-discrimination. AI models cannot discriminate or create biased outcomes

§1691(d) Adverse action notice. AI credit decisions must be explainable

Regulation B §1002.12. AI decision records must be retained

§1691(c) Special programs. AI may be used for inclusive credit programs

Title VII of the Civil Rights Act

The law applies to employers and employment-related entities and protects individuals from discrimination.

§2000e-2(a) discrimination prohibition. AI hiring systems cannot discriminate

§2000e-2(k) disparate impact. AI tools cannot disproportionately harm protected groups without business necessity

Employer liability. Employers are responsible for third-party AI tools

Age Discrimination in Employment Act

The law protects workers 40 years and older from discrimination in employment.

§623(a) Prohibition of age discrimination. AI cannot favour younger candidates over those 40+

§623(f)(1) Disparate impact. AI systems causing age bias must be justified as a bona fide necessity

§626(d) Record-keeping. AI decisions must be documented for audit and compliance

Genetic Information Nondiscrimination Act

The law prohibits discrimination based on genetic information in employment and health insurance.

§2000ff-1(a) Employment discrimination. AI hiring/performance systems cannot discriminate based on genetic information

§2000ff-1(b) Acquisition & confidentiality. AI systems cannot collect, request, or infer genetic information

§2000ff-3 Health insurance. AI underwriting models cannot use genetic data

Healthcare Industry

The Health Insurance Portability and Accountability Act (HIPAA) applies when AI processes protected health information (PHI).

The U.S. Food and Drug Administration (FDA) regulates AI that qualifies as a medical device. What is covered: AI that diagnoses, predicts, or recommends treatment. AI used to interpret medical images or lab results. AI software classified as Software as a Medical Device (SaMD).

California

California Transparency in Frontier AI Act

Effective January 1, 2026, the law applies to frontier developers (companies or entities) that train or modify frontier AI models. Small startups or AI tools trained with much lower computing power generally aren’t covered under this law.

California AB 2013 TDTA

As of January 1, 2026, AB 2013, known as the Training Data Transparency Act (TDTA), applies broadly, from GenAI model developers to organizations that “substantially modify” them. The law applies to any system, whether free or paid, that is “available to Californians” and was released or significantly modified on or after January 1, 2022.

The law requires AI developers to publish a high-level summary of the datasets used to train their public-facing generative AI systems.

Companion Chatbots Act SB243

Effective January 1, 2026, the law applies to any person or entity (“operator”) that makes a companion chatbot platform available to users in California, meaning companies that deploy or offer these AI systems to California residents must comply.

Healthcare AI Disclosure Act AB489

Effective January 1, 2026, the law applies to artificial intelligence (AI) and generative AI (GenAI) systems used in healthcare contexts, and applies to any person or entity that develops, deploys, markets, or operates AI or generative AI systems that interact with consumers in healthcare‑related ways, especially where the system uses language that could imply it is a licensed health professional.

If an AI system uses terms or letters like “doctor,” “nurse,” “M.D.,” “RN,” “psychologist,” etc., in a way that suggests it is a licensed clinician, that use is now prohibited, even if done by software rather than a person. This prohibition applies both to AI advertising (e.g., marketing) and AI functionality (e.g., how the system responds to users)

Transparency. Generative AI used by health facilities or physician practices in written or spoken patient communications must include a clear disclaimer that the message was generated by AI and provide clear instructions on how to contact a human provider

Texas

Texas Responsible AI Governance Act (TRAIGA)

Effective January 1, 2026, the law applies to people or entities that fall into these categories if they meet any of these criteria: Promote, advertise, or conduct business in Texas; Produce a product or service used by Texas residents; or Develop or deploy an AI system in Texas. The law also applies to Texas state and local government entities when they use or deploy AI systems, but some exclusions apply, such as certain educational institutions or hospital districts.

Transparency and disclosure requirement to a consumer who is interacting with an artificial intelligence system
If an artificial intelligence system is used in relation to health care service or treatment, the provider of the service or treatment shall provide the disclosure to the recipient of the service or treatment or the recipient's personal representative not later than the date the service or treatment is first provided, except in the case of emergency, in which case the provider shall provide the required disclosure as soon as reasonably possible
Prohibit manipulation of human behaviour. A person may not develop or deploy an artificial intelligence system in a manner that intentionally aims to incite or encourage a person to: (1) commit physical self-harm, including suicide; (2) harm another person; or (3) engage in criminal activity
Social Scoring. A governmental entity may not use or deploy an artificial intelligence system that evaluates or classifies a natural person or group of natural persons based on social behaviour or personal characteristics
A governmental entity may not develop or deploy an artificial intelligence system for the purpose of uniquely identifying a specific individual using biometric data or the targeted or untargeted gathering of images or other media from the internet or any other publicly available source without the individual's consent, if the gathering would infringe on any right of the individual under the United States Constitution, the Texas Constitution, or state or federal law
A person may not develop or deploy an artificial intelligence system with the sole intent for the artificial intelligence system to infringe, restrict, or otherwise impair an individual's rights guaranteed under the United States Constitution; or to unlawfully discriminate against a protected class in violation of state or federal law
Certain sexually explicit content and child pornography are banned

Utah

Utah AI Policy Act

The law applies to any business or organization using generative AI to interact with consumers in Utah.

A person who uses, prompts, or otherwise causes generative artificial intelligence to interact with a person in connection with any act administered and enforced by the division, shall clearly and conspicuously disclose to the person with whom the generative artificial intelligence interacts, if asked or prompted by the person, that the person is interacting with generative artificial intelligence and not a human

A person who provides the services of a regulated occupation shall prominently disclose when a person is interacting with a generative artificial intelligence in the provision of regulated services

A person is prohibited to provide the services of a regulated occupation through generative artificial intelligence without meeting the requirements of the regulated occupation

A deceptive act or practice by a supplier in connection with a consumer transaction is prohibited whether it occurs before, during, or after the transaction

Illinois

Illinois House Bill 3773 (HB 3773)

The law applies directly to the use of artificial intelligence (AI) in employment decisions as part of the Illinois Human Rights Act. It focuses on preventing discriminatory outcomes from AI use in the workplace and is effective January 1, 2026.

Employers cannot use AI (including automated decision systems or predictive analytics) in hiring, recruitment, promotion, retention, discipline, discharge, training selection, or conditions of employment if it results in discrimination against protected classes such as race, sex, religion, national origin, age, disability, etc

Employers cannot use proxies like ZIP codes that effectively act as stand‑ins for protected characteristics

Employers must notify employees and job applicants in advance if AI will be used in employment decisions that affect them