The AI regulation map: what binds you now, soon, and probably never
The honest version of this page keeps changing, which is why it carries a date.
This page is general information for operators, current as of the date shown. It is not legal advice, and reading it does not create an attorney-client relationship. Specific facts change the answer.
What follows are the rules that matter to a US-based AI company, sorted by whether they actually reach you, with flags on the spots where the ground is still moving. The sorting is where the value sits. Most of the AI-law anxiety we hear gets spent on statutes that will never apply to the company asking, while the exposure that will reach them is contractual and already sitting in the inbox as a customer addendum.
Binding now
| Area | Status | Date | Note |
|---|---|---|---|
| FTC + state attorneys general | everyone, today | Not dated | Enforcement against deceptive AI claims is active and continuing, and coalitions of dozens of state AGs are working through existing consumer-protection law rather than waiting for anything new to pass. If you sell AI, your marketing claims are the most exposed surface you have. |
| Texas TRAIGA | in effect Jan 1, 2026 | Not dated | Only the attorney general can enforce it, civil penalties run to $200,000, and you get a 60-day cure period. There is also a safe harbor for documented alignment with the NIST AI Risk Management Framework, and that safe harbor is the practical takeaway here, because it's paper you can produce on your own schedule. |
| Illinois HB 3773 + NYC Local Law 144 | hiring | Not dated | If AI touches employment decisions, whether yours or your customers', notice and bias-audit obligations are already live. |
| EU AI Act, prohibited practices | since Feb 2, 2025 | Not dated | The banned-use list is enforceable, with penalties reaching €35M or 7% of worldwide turnover. Most B2B products are nowhere near any of it, so check yourself against the list once and write down the conclusion. |
| California SB 942 | provenance, operative Aug 2, 2026 | Not dated | Large-scale generative providers have to embed provenance data in output and offer a detection tool. |
Binding soon, probably
| Area | Status | Date | Note |
|---|---|---|---|
| EU AI Act, high-risk (Annex III) | Unsettled | Not dated | On paper it lands August 2, 2026. A provisional political agreement would postpone it to December 2, 2027, but that agreement had not been formally adopted as of this page's date, so plan around both. UNSETTLED, and we track it. If your product touches hiring, credit, education, or essential services under your own brand, the provider question is yours to answer now, whichever date ends up holding. |
| Colorado AI Act | January 1, 2027 | Not dated | Delayed twice, rewritten once, and now narrowed to disclosure duties. The statute matters less than what its history tells you: whatever you wrote about it last year is already stale, and the same goes for the rest of this map. |
The decision that sorts everything: provider or deployer
Most obligations key off a single distinction. Are you the provider of an AI system, meaning you place it on the market under your own name, or are you a deployer of somebody else's? This is where founders get caught out. An application-layer company that ships a hiring-screening feature under its own brand can be the provider of a high-risk system without ever having trained a model. Work it through in order: What does the feature actually do? Whose brand does the user see on it? Which users, in which countries? Write your answer down, put a date on it, and revisit it whenever the feature list changes.
The honest headline
For most US B2B AI companies, the binding constraints run in this order. (1) Your customers' contracts, because AI addenda are private regulation and they arrive years ahead of public law. (2) The FTC and state AGs, on your marketing claims. (3) Sector rules, if you touch hiring, credit, health, or minors. (4) The statutes above, inside their own windows. Get the first two right and you have handled most of what can actually reach you.
The standing posture
We maintain this map. The ground has already moved more than once while companies were busy building on top of it, and the next time it moves, the date at the top of this page moves with it.